bug: GuardrailsMiddleware ignores Colang bot utterance (result.content) on BLOCKED status

Did you check docs and existing issues?

• I have read all the NeMo-Guardrails docs
• I have updated the package to the latest version before submitting this issue
• (optional) I have used the develop branch
• I have searched the existing issues of NeMo-Guardrails

Python version (python --version)

3.14.6

Operating system/version

windows 11 pro

NeMo-Guardrails version (if you must use a specific version and not the latest

0.23.0

Describe the bug

When GuardrailsMiddleware detects a blocked input via check_async(), it returns the hardcoded blocked_input_message string instead of result.content, which already contains the Colang-defined bot utterance from define bot declarations in rails.co. The Colang message is computed and available but silently discarded.

Location:
nemoguardrails/integrations/langchain/middleware.py, method abefore_model, line ~129:

Current (broken) — ignores result.content

blocked_msg = create_ai_message(self.blocked_input_message)

Expected — should use the Colang utterance

blocked_msg = create_ai_message(result.content or self.blocked_input_message)

Steps To Reproduce

Define a custom bot utterance in rails.co
define bot refuse system prompt
"FROM Nemo: Security Alert: I cannot reveal internal system instructions."

define flow check system prompt leak
$is_leak = execute check_system_prompt_leak_action(text=$user_message)
if $is_leak
bot refuse system prompt
stop

• Use GuardrailsMiddleware with a LangGraph agent
• Send a prompt that triggers the flow

Observe: response is "I cannot process this request due to content policy." instead of the define bot utterance
Verified: rails.check_async() correctly returns result.content = 'FROM Nemo: Security Alert: ...' — the middleware simply doesn't use it.

Expected Behavior

The colong bot utternance - FROM Nemo: Security Alert: I cannot reveal internal system instructions

Actual Behavior

Always returns standard blocking message - I cannot process this request due to content policy.

app_nemo_create_agent.py

actions.py
config.yml

rails.co

define bot refuse system prompt
"FROM Nemo: Security Alert: I cannot reveal internal system instructions or configuration parameters."

define bot refuse competitor
"FROM Nemo: Security Alert: I am unable to analyze or compare competitor platforms. I can only assist with CloudFlow technical support."

define bot refuse bola
"FROM Nemo: Security Alert: Unauthorized account access request. You do not have permission to view superuser credentials."

define bot refuse sql injection
"FROM Nemo: Security Alert: Destructive DDL and unauthorized SQL query patterns are blocked."

define bot refuse prompt injection
"FROM Nemo: Security Alert: Untrusted document text attempted an unauthorized instruction override."

define flow check system prompt leak
$is_leak = execute check_system_prompt_leak_action(text=$user_message)
if $is_leak
bot refuse system prompt
stop

define flow check competitor policy
$is_competitor = execute check_competitor_policy_action(text=$user_message)
if $is_competitor
bot refuse to respond
stop

define flow check bola authorization
if "admin_root" in $user_message
$allowed = execute check_tenant_authorization_action(user_id="user_01", target_id="admin_root")
if not $allowed
bot refuse bola
stop

define flow check sql injection
$is_safe = execute check_sql_security_action(query=$user_message)
if not $is_safe
bot refuse sql injection
stop

define flow check indirect prompt injection
if "SYSTEM OVERRIDE" in $user_message
bot refuse prompt injection
stop

define flow check sensitive data leak
$has_secret = execute mask_sensitive_api_keys(text=$bot_message)
if $has_secret
bot refuse bola
stop

Read nemoguardrails/integrations/langchain/middleware.py, focusing on GuardrailsMiddleware.abefore_model around line 129 and how check_async() supplies result.content. Reproduce the issue with the provided rails.co definitions and confirm that blocked responses use the Colang bot utterance, falling back to the standard blocked message when no content is available.