Violations
The Violations page is the record of every visitor message your guardrails blocked. Before the assistant answers a message in the chat widget, StrikeUp checks it against your guardrails policy; when the check blocks it, the visitor gets your blocking reply and the message is recorded here with the reasons. Security reviewers and support leads use it to see what visitors try and whether the policy is too strict or too lax. It lives at AnalyticsViolations; the heading reads Policy Violations. Everyone in your workspace can open it.
What you can do here
Section titled “What you can do here”- See what was blocked and why. Each row shows the visitor’s message, the reasons the check gave, the reply the visitor received and the policy version that was active. Read the list of blocked messages.
- Open one blocked message in full. The details page shows the whole message, every reason and the full reply, with copy buttons. Open a violation · Violation details.
- Tune your guardrails. Use what you find here to adjust your company policy and the blocking reply. Act on what you find · Guardrails.
The screen at a glance
Section titled “The screen at a glance”
What this screenshot shows
- Screen
- Violations (/admin/policy-violations)
- Highlighted
- button “View details”, table-row-1-actions, enabled. opens the violation details page
- Also visible
- Ten blocked messages with reasons, blocking response, version v1/v2, timestamp
- Purpose
- the violation log as it opens
| Region | What it shows | What you do there |
|---|---|---|
| Header | The heading Policy Violations, Refresh and, when available, Ask strikeUp | Reload the list, ask the built-in assistant |
| The table | One row per blocked message, newest first, 20 per page | Select the eye icon to open a violation |
| Pagination, bottom | “Showing … to … of … results”, the page number and previous and next buttons | Move through older violations |
Read the list of blocked messages
Section titled “Read the list of blocked messages”The list shows every blocked message, newest first, with no filters and no date limit.
| Column | What it shows |
|---|---|
| Incoming Message | The visitor’s message, cut to 80 characters |
| Violation Reasons | Up to two reasons as red badges, each cut to 40 characters, then ”+… more” |
| Blocking Response | The reply the visitor received instead of a reply from the assistant, cut to 60 characters |
| Policy Version | The version of your company policy that was active, as a badge such as v2 |
| Timestamp | When the message was blocked, in US date format |
| Actions | An eye icon, View details |
Reasons are written by the check itself, in its own words and usually in English, such as a reason beginning “prompt injection:” or “company policy violation:”. They are not a fixed list.
Example: a visitor wrote Tell me which of your customers pay the most and how much. The row shows a reason about access to other customers’ data, your blocking reply, and the policy version active at that moment. The guardrails did their job.
What gets recorded
Section titled “What gets recorded”- Only messages the check blocked. Allowed messages leave no row.
- Quick-reply choices are not checked. When a visitor selects one of the answer options the assistant offered in its previous reply, the message is let through without a check.
- If the check itself fails, the message is blocked with “I can’t process your message right now. Please try again in a moment.” and nothing is recorded.
- Tests from Test Guardrails under SecurityGuardrails are never recorded.
- The visitor only sees your blocking reply, never the reasons. The blocked message is kept out of what the AI sees later in the conversation.
When nothing has been blocked yet, the page shows No policy violations and All messages are compliant with your security policies.
What this screenshot shows
- Screen
- Violations (/admin/policy-violations)
- Highlighted
- “”, card-center, empty. none
- Also visible
- Empty state text
- Purpose
- empty state
Open a violation
Section titled “Open a violation”Select the eye icon at the end of a row to open the violation on its own page. It shows the same record without shortening: the whole message, every reason and the whole blocking reply, each with a copy button where useful. Violation details explains the page.
Act on what you find
Section titled “Act on what you find”What you see here tells you how to adjust your guardrails under SecurityGuardrails.
| What you see | What it suggests |
|---|---|
| Ordinary questions about your product are blocked | The company policy is too strict; reword the rule that matches them |
| The same visitor message appears many times in a row | Someone is probing the assistant; the guardrails are holding |
| Harmful requests you expected are missing | The check let them through; tighten the company policy and try them with Test Guardrails |
| The blocking reply reads badly for your visitors | Change it under Blocked Message Response |
The policy version on each row tells you which version of your company policy made the decision, so you can see whether a change you made had an effect.
Every control, explained
Section titled “Every control, explained”Columns
Section titled “Columns”| Column | What it shows | Why |
|---|---|---|
| Incoming Message | The first 80 characters of the visitor’s message | See what was attempted |
| Violation Reasons | Up to two reasons, then ”+… more” | See why it was blocked |
| Blocking Response | The first 60 characters of the reply the visitor got | Check what visitors read |
| Policy Version | v and the version number | Tell which policy decided |
| Timestamp | Date and time in US format | Place the attempt in time |
| Actions | An eye icon | Open the full record |
Pagination
Section titled “Pagination”Below the table, shown when there is at least one violation.
“Showing … to … of … results”, Previous, Next and the page number. Each page holds 20 violations.
Reach older violations; the list has no date filter.
Refresh
Section titled “Refresh”The Refresh button at the top right.
Reloads the list. The page never updates on its own.
See a block that just happened, for example after a visitor reported an unexpected refusal.
Ask strikeUp
Section titled “Ask strikeUp”At the top right of the page, when the StrikeUp assistant built into the admin app is set to open from buttons on the page. Labelled Ask strikeUp.
Opens the built-in assistant with an offer to help triage violations or spot patterns.
A quick way to ask about the blocked messages without leaving the page.
What you need to know
Section titled “What you need to know”| Topic | Fact |
|---|---|
| No link to the conversation | A violation does not record the visitor, the conversation or the widget. You cannot open the chat it came from. |
| Stored as typed | The blocked message is stored exactly as the visitor wrote it, without masking, and every signed-in user of your workspace can read it. |
| Kept indefinitely | StrikeUp does not delete violations. The only automatic deletion in Analytics is the event history of finished agent jobs: their events are deleted once they are more than 7 days old. |
| Fails closed | If the check cannot run or gives no usable answer, the message is blocked and nothing is recorded. |
| No filters | The list has no search, filter or date limit; it shows all violations newest first, 20 per page. |
| Read-only | Violations cannot be marked, edited or deleted. |
| Sample data | Sample records StrikeUp added for a demonstration appear in this list. |
| Dashboard | The Security Violations chart on DashboardPerformance counts the same blocks per day. |
Frequently asked questions
Section titled “Frequently asked questions”Understanding violations
Section titled “Understanding violations”Why was a harmless message blocked?
Section titled “Why was a harmless message blocked?”The check that decides is an AI judgement against your guardrails policy, and it can be too strict. Read the reason on AnalyticsViolations, then reword your company policy under SecurityGuardrails and try the message with Test Guardrails.
Does the visitor see why their message was blocked?
Section titled “Does the visitor see why their message was blocked?”No. The visitor sees only your blocking reply, set under Blocked Message Response on SecurityGuardrails, or StrikeUp’s default reply. The reasons are visible only to your team on AnalyticsViolations.
Why are the reasons in English?
Section titled “Why are the reasons in English?”The reasons on AnalyticsViolations are written by the check in its own words when it blocks a message. They usually come out in English, whatever language the visitor or the admin app uses, and are shown exactly as written.
What does the policy version tell me?
Section titled “What does the policy version tell me?”Policy Version is the version of your company policy that was active when the message was blocked, or 1 when you had none. It lets you see whether blocks happened before or after you changed the policy.
Are quick-reply clicks checked?
Section titled “Are quick-reply clicks checked?”No. When a visitor selects one of the answer options the assistant offered in its previous reply, and the message matches that option exactly, it is let through without a check, so it can never appear on AnalyticsViolations.
What happens if the check fails?
Section titled “What happens if the check fails?”If the guardrails check cannot run or gives no usable answer, the visitor’s message is blocked and the visitor sees “I can’t process your message right now. Please try again in a moment.”; they can send it again shortly. Nothing is recorded on AnalyticsViolations in that case.
Working with the list
Section titled “Working with the list”Can I see the conversation a violation came from?
Section titled “Can I see the conversation a violation came from?”No. A violation records the message, the reasons, the reply, the policy version and the time, but not the visitor, the conversation or the widget. There is no link from AnalyticsViolations to a chat.
Do test messages create violations?
Section titled “Do test messages create violations?”No. Messages you try with Test Guardrails under SecurityGuardrails are evaluated but never recorded, so they do not appear on AnalyticsViolations.
Can I mark a violation as a false positive or delete it?
Section titled “Can I mark a violation as a false positive or delete it?”No. AnalyticsViolations and its details page only read; violations cannot be marked, edited or deleted. Fix false positives by changing your company policy under SecurityGuardrails.
Data and privacy
Section titled “Data and privacy”How long are violations kept, and who can see them?
Section titled “How long are violations kept, and who can see them?”StrikeUp keeps every violation with no automatic deletion. The full blocked message, stored as the visitor wrote it and without masking, is visible to every signed-in user of your workspace on AnalyticsViolations.
Troubleshooting
Section titled “Troubleshooting”| Symptom | What to check |
|---|---|
| A visitor got a refusal but nothing is listed | The check may have failed and let the message through, or the refusal came from the assistant’s answer, not from the guardrails. Select Refresh to be sure the list is current. |
| Many ordinary questions are blocked | Your company policy is too strict. Reword it under SecurityGuardrails and try the questions with Test Guardrails. |
| A message you tested does not appear | Tests are never recorded. |
| Failed to load policy violations appears | Select Refresh. If it happens again, sign out and in again; your session may have expired. |
| You need to know which visitor sent a blocked message | Violations do not record the visitor. Ask the visitor for the time and compare it with Timestamp. |