Configuring Advanced Guardrails

Guardrails let you define the operational boundaries in which an agent or workflow can act with your Box content. When you configure guardrails, you decide where an action can run, which managed users it can affect, and how it interacts with external users. This gives admins precise control over automated activity and helps keep sensitive content protected while scaling AI and workflow adoption. Guardrails are available to Enterprise Advanced customers. Not all actions referenced in this article are available in every Box product. For product-specific setup and supported actions, see:

• Creating workflows in Box Automate
• Guardrails in custom agents
• Guardrails for Box MCP server tools

This article explains the constraint types you can configure, how each option behaves, and the patterns to follow when defining allowlists and denylists.

​

Guardrail constraint types

You can configure three types of guardrail constraints:

• Content Restrictions — controls where the action can run.
• Managed User Criteria — controls which internal (managed) users the action can involve.
• External User Criteria — controls how the action interacts with external users.

​

Content restrictions

Content restrictions define the target location of the action. From the Content Restrictions dropdown, select one of the following:

• No restrictions — no guardrails are applied to the target location.
• Allow on specific items — define an allowlist of permitted targets.
• Don’t allow on specific items — define a denylist of blocked targets.

​

Allow on specific items (allowlist)

Classification Labels: select one or more classification labels to define the allowed target. To define criteria based on a classification label, you must first have Box Shield classification labels configured in your organization. See Classification Labels. Examples of using classification-based content restrictions:

• For Delete File, selecting Internal Only means only files labeled Internal Only can be deleted.
• For Move File, selecting Internal Only means files can only be moved into folders labeled Internal Only.

Folders: select one or more folders to define the allowed target. What that selection covers depends on whether the action targets a folder or a file.

• When the action targets a folder, the selection covers that folder and its subfolders. For example, with Folder A selected, a create file action can create a file in Folder A and in a subfolder of Folder A.
• When the action targets a file, the selection covers files saved directly in that folder. For example, with Folder A selected, an edit file action can edit a file saved directly in Folder A. A file saved in a subfolder of Folder A is outside that selection.

Hubs: select one or more Hubs to define the allowed target.

​

Don’t allow on specific items (denylist)

Classification Labels: select one or more classification labels to define the blocked target. To define criteria based on a classification label, you must first have Box Shield classification labels configured in your organization. See Classification Labels. Examples of using classification-based content restrictions:

• For Delete File, selecting Restricted means files labeled Restricted cannot be deleted.
• For Move File, selecting External Sharing means files cannot be moved into folders labeled External Sharing.

Folders: select one or more folders to define the blocked target. What that selection covers depends on whether the action targets a folder or a file.

• When the action targets a folder, the selection blocks that folder and its subfolders. For example, with Folder A selected, a create file action is blocked from creating a file in Folder A and from creating a file in a subfolder of Folder A.
• When the action targets a file, the selection blocks files saved directly in that folder. For example, with Folder A selected, an edit file action is blocked from editing a file saved directly in Folder A. A file saved in a subfolder of Folder A is still allowed.

Hubs: select one or more Hubs to define the blocked target.

​

Don’t allow on any externally accessible items

The Don’t allow on any externally accessible items toggle is available only when you select Don’t allow on specific items. Enable it to prevent the action from running at any target location that is externally accessible. A location is considered externally accessible when any of the following are true:

• The target, any folder in its ancestor tree, or a Hub containing it is accessible to the public through a shared link.
• The target, any folder in its ancestor tree, or a Hub containing it is accessible to external collaborators.
• The target is owned by an external organization or user.

Example: with Don’t allow on any externally accessible items enabled for Upload File, a file cannot be uploaded to a folder (or any ancestor folder) that has a shared link set to anyone can access, has external collaborators, or is owned by an external user.

​

Managed user criteria

For actions that involve internal users, use Managed User Criteria to define which managed users the action can target. From the dropdown, select one of the following:

• No restrictions — no managed user guardrail is applied.
• Specific managed users only — allowlist of permitted managed users.
• All managed users, with exceptions — denylist of blocked managed users.

After you select an option, enter user names into the Select users text box and select the users you want to include. Common uses of managed user guardrails:

• Add Collaborator — allow only a specific list of managed users to be added by a workflow.
• Send Notification — limit notifications to an approved list of managed users.

​

External user criteria

For actions that involve external users, use External User Criteria to define how the action can interact with them. From the dropdown, select one of the following:

• No restrictions — no external user guardrail is applied.
• Specific external users only — allowlist of permitted external users.
• All external users, with exceptions — denylist of blocked external users.
• External users not permitted — blocks the action from involving any external user.

After you select Specific external users only or All external users, with exceptions, enter user names into the Select users text box and select the users you want to include. Common uses of external user guardrails:

• Add Collaborator — select External users not permitted to prevent any external collaborator from being added by the workflow or agent.
• Send Notification — limit outbound notifications to a defined list of external users.

​

Known limitations

• Box MCP server guardrails apply only to write tools. To control which content agents can read, use Shield Smart Access policies.
• Not every action supports every constraint type.
• Guardrails configured for Box AI custom agents don’t apply to session folders. If guardrails block the agent from saving a file to another folder, the Box AI custom agent saves the file in the session folder instead.
• Classification-based guardrails depend on the classification labels defined for your enterprise. See Classification Labels.