Troubleshooting & FAQ
Common issues
Diagnose missing activity, unexpected blocks, unmasked data and other frequent integration problems.
No events in the activity log
| Check | Fix |
|---|---|
| Wrong system or key | Guard answers 401 (unauthorized or system_id_mismatch). Use the System ID and API key of the same system. |
| The call bypassed AgentID | Only wrapped calls are protected. Look for direct provider calls, the Responses API or a second raw client. |
| Only Guard is called | The row stays at Prompt checked. Log the answer with the Ingest API or use an SDK wrapper. |
| Stale timestamp | Ingest rejects events older than 5 minutes (stale_event_timestamp). Use the current time. |
| Process exits early | In serverless functions, wait for log() to finish before returning. |
The AI provider still received personal data
- Is the system in Active Guard? Shadow Mode never masks.
- Is Mask Personal Information (or Mask Secrets & API Keys) on?
- Does your code send
transformed_input, not the originalinput? - Is the whole history protected? Earlier turns with raw values reach the model unless they were masked when first sent or protected with
protectMessageHistory(). - Did the check fail open? Look for
bypassed: trueor theX-AgentID-Status: BYPASSED_INFRA_ERRORheader. - Is the value covered by detection? Add a content policy for terms only you know, such as project names.
The chat shows placeholders or [REDACTED_BY_GATEWAY]
Your app is rendering the protected text. Keep the user's original message in local UI state and send only the protected copy to the provider. To show originals in the answer, enable restoration.
Prompts are blocked unexpectedly
Open the row in the activity log: the detail shows the reason and the detected types or signals. Then:
- adjust the switch in Guardrails, for example switch Block Personal Information to Mask Personal Information,
- add an Allow content policy for a term that is wrongly detected,
- use Mark as False Positive to record the case,
- calibrate with Shadow Mode before enforcing.
Requests fail with 429
The system hit its per-minute, daily or token limit. Wait for Retry-After, then review Service Protection.
Requests fail with 503
A fail-closed system could not complete the check, or the circuit breaker stopped it (circuit_breaker). Retry with backoff. If it repeats, check the system status and the Circuit Breaker settings.
Cost and tokens are empty
Completion events need a model id and usage or tokens. Guard-only events and non-model workflow steps carry no cost.