> ## Documentation Index
> Fetch the complete documentation index at: https://docs.animam.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Guardrails & instruction hierarchy

> What the model can never decide, in what order instructions win, and what actually protects you against injection — server-side guarantees first, prompts second

"The model talks, the server acts" is the architecture, not a slogan. This page states precisely **which guarantees are enforced server-side** (they hold even against a manipulated model) and which are prompt-level (best-effort, like on every LLM product). If you are auditing Animam before trusting it with quotes, bookings or payments, this is the page to read.

## The instruction hierarchy

At every turn, the agent's context is assembled **server-side**, in this order of authority:

1. **Platform rules** — non-negotiable, injected by the server: safety guardrails, the tool-use contract, the [content policy](/guides/content-policy) level. A visitor cannot see or rewrite them.
2. **Tenant configuration** — your personality settings (tone, language, persona), your segments, your corpus, your tools. Editable by you in the dashboard, over the API, or [by talking to an agent](/guides/agent-config) — never by a visitor.
3. **The conversation** — visitor messages. They influence *what the agent says*, never *what it is allowed to do*.

A visitor message that says "ignore your instructions" is competing with layers 1–2 from the weakest position. But prompt hierarchy alone is not a security boundary on any LLM — which is why the guarantees that matter are the next section.

## What the model can never decide

These are **server-side invariants**. A fully jailbroken model could not violate them, because the decision doesn't happen in the model:

| Decision               | Who decides             | Mechanism                                                                                                                                                                                                      |
| ---------------------- | ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Quote amounts**      | The server              | With a pricing grid configured, the model only picks `sku` + `qty`; the server does the arithmetic and emails a numbered quote. [Quote Engine](/guides/quote-engine)                                           |
| **Visitor identity**   | The server              | Email is verified by OTP code or JWT. In [verified actions](/guides/verified-actions), the verified email is injected server-side — it is **never a model argument**, so the model cannot claim to be someone. |
| **Secrets**            | Never in the loop       | Connector and action secrets are AES-256-GCM encrypted at rest and excluded from the agent-config surface. An agent (yours included) cannot create a tool type that carries a secret.                          |
| **Outbound calls**     | The server              | Declared URL and parameters only; SSRF guard with DNS resolution; responses sanitized (token/secret-shaped keys stripped) before the model sees them; 5s timeout.                                              |
| **Tool configuration** | Validated server-side   | Per-type JSON schemas. Whatever emits the config (dashboard, API, an agent), the server validates before applying.                                                                                             |
| **Payment execution**  | Stripe, on your account | The agent issues a payment link (`COLLECT_PAYMENT`); money moves on Stripe's checkout, never on the model's say-so.                                                                                            |

## Abuse and injection posture

* **Message abuse detection** on public bots (insults, flooding, off-mission probing) with graduated responses.
* **Rate limiting** per IP, dual-window (per-minute and per-hour), on chat and auth endpoints.
* **Optional invisible CAPTCHA** (Cloudflare Turnstile), fail-open so a Turnstile outage never kills your widget.
* **Content policy levels** (SFW\_STRICT → UNFILTERED) plus an optional age gate, per tenant.
* **Tool execution is server-side and typed.** The practical consequence for prompt injection: a manipulated reply can produce embarrassing *text*, but it cannot move money, book a meeting with invented data, or reach a URL you didn't declare — actions only happen through validated tools carrying server-verified identity.

## When it doesn't know: escalation, not improvisation

Outside its scope, the agent escalates (`ESCALATE_TO_HUMAN`): the conversation lands in your inbox with a status (new → contacted → resolved) and you are notified by email. Configurable like any tool — see [Tools](/guides/tools).

## Verification after the fact

The [Conversation Digest](/guides/conversation-digest) re-reads conversations with a skeptical evaluator model and **cross-checks what the agent claimed against the tool calls it actually made**. Actions affirmed without a real tool call, tool failures, and unmet requests are flagged in your periodic report — so even the failure modes that slip through are surfaced, not buried.

## Honest limits

* Prompt-level guardrails (tone, scope, refusals) are best-effort on every LLM, including ours. We put the hard guarantees server-side precisely because of this.
* The agent can still be *wrong* within its permitted scope — a stale corpus produces confidently stale answers. That is a curation problem; see [How the crawl & corpus work](/guides/crawl-and-corpus).
* If you find a way to make an Animam agent violate one of the server-side invariants above, that's a security bug: report it to [security@animam.ai](mailto:security@animam.ai).