FAQ

XecGuard Overview

What is XecGuard?

XecGuard is an AI security Guardrail API developed by CyCraft, designed specifically to defend against Prompt Attacks targeting large language models (LLMs). It provides real-time detection and analysis of malicious conversation content, offering comprehensive LLM safety capabilities including Prompt Injection Protection, Prompt Extraction Protection, System Prompt Enforcement, Harmful Content Protection, Malicious Skills Protection, Sensitive Data Protection, and Custom Policy configuration. XecGuard is particularly well-suited for AI Agent and various AI application scenarios, effectively preventing malicious external inputs such as Prompt Injection or adversarial messages, preventing models from being manipulated into producing errors, going off-task, or taking harmful actions, and ultimately enhancing the overall security and trustworthiness of the system.

What role does XecGuard play in an AI security architecture?

XecGuard is a key protection component in an AI security architecture. It is designed to address semantic-level attack risks that traditional security tools are often unable to handle effectively. XecGuard can be deployed between User Input and Assistant Response to perform real-time security analysis on both user inputs and LLM responses. This helps organizations detect Prompt Injection, Prompt Extraction, unauthorized instructions, sensitive data leakage, and content risks that violate enterprise policies.
In AI Agent scenarios, XecGuard helps ensure that the Agent’s execution flow is not manipulated by malicious instructions. It can also check whether the output remains aligned with the task scope, role logic, and constraints defined by the organization. Through semantic-level detection and blocking, XecGuard reduces the risk of AI applications being abused, misled, or induced into generating inappropriate behavior.
However, XecGuard does not replace an organization’s overall security governance mechanisms. Organizations should still combine prompt design, identity and access control, least-privilege permissions, traffic monitoring, DLP, audit logging, and human review processes to establish a comprehensive AI security architecture.

Is XecGuard a general-purpose language model or a dedicated Guardrail module?

XecGuard is a dedicated Guardrail module fine-tuned and optimized based on language model technology. It is not a general-purpose chat model, nor is it a RAG system.
Its core role is to act as a “security guard” between the front end and back end of AI applications. XecGuard is responsible for checking whether user inputs, model outputs, or related content comply with enterprise security rules and governance policies, and determining whether the content should be allowed to pass. The purpose of XecGuard is not to converse with users, generate articles, or answer general questions. Instead, it focuses on detection, decision-making, and protection.
XecGuard operates through an API-based model, with an emphasis on real-time detection and blocking of risky content rather than rewriting content. Therefore, XecGuard does not automatically rewrite user input into a harmless version, nor does it decide the final response behavior on behalf of the application. When a risk is detected, the application can determine whether to block, notify, log, escalate to human review, or take other actions based on its own product logic, enterprise policies, or user experience design.

What is the XecGuard Community Support Program (CSP)?

The XecGuard Community Support Program was established to support and advance the AI developer community in building safer applications. We have observed that while the developer community is innovating and growing rapidly in the AI space, security mechanisms are often not given equal attention. This program not only provides tangible resource support, but also advocates for a core principle: "AI safety should be a default, not an option." Only by embedding security into the core architecture from the very beginning can AI systems truly achieve long-term trust and scalable growth.
Eligible open-source project maintainers and contributors will receive a free three-month XecGuard Lite API subscription at no cost during the program period. Through this support, we aim to lower the barrier for developers to adopt AI security mechanisms, enabling more open-source projects to innovate quickly while maintaining safety and stability. For detailed eligibility and terms of use, please refer to the Terms of Service.

XecGuard Policy & Rules

Can XecGuard enforce global rules that are not written in the System Prompt?

XecGuard supports enterprise-defined Global Policies. Even if these rules are not written in the System Prompt of each individual AI Application, they can still be detected and enforced with priority.
This allows organizations to manage AI behavior more flexibly, such as prohibiting references to specific executive names, company names, product names, or other restricted terms.

How does XecGuard resolve conflicts between a System Prompt and a Guardrail Policy?

XecGuard evaluates each Policy independently and does not handle dependencies between Policies.
Every configured Policy module is evaluated; if any Policy is found to be violated, the API returns UNSAFE and indicates which rules were violated. How the application ultimately responds is left entirely to the caller based on their own scenario.

How should Guardrail Policies and System Prompts be separated and used together?

Guardrail Policies are suitable for defining high-level, enterprise-wide security policies. They mainly describe what an AI application must not do, or which risks it must avoid. For example, they can be used to prohibit the processing of specific types of content, prevent the output of information that violates enterprise policies, prevent the leakage of sensitive data, or block certain high-risk actions.
If a rule describes what the AI application should do, such as task objectives, role settings, response format, business workflows, operating procedures, or detailed conditions, it is more suitable to define it in the Application’s System Prompt.
In simple terms, the System Prompt defines the task and behavior logic, while Guardrail Policies define the security boundaries and red lines that must not be crossed.

What should I do if my Guardrail Policies are too long or exceed the limit?

A Policy can currently include two custom rule modules, each with up to three rules; each rule can be up to approximately 400 English words.
If you have many rules, we recommend writing the AI application's operating conditions clearly in the System Prompt, and using XecGuard as a higher-level security layer to enforce compliance with those guidelines.

Can XecGuard detect LLM hallucinations?

Yes. XecGuard provides Context Grounding detection, which is suitable for checking fidelity hallucinations, especially in RAG scenarios. When users provide RAG reference materials as context, XecGuard can detect whether the response follows the provided materials and return four types of results: complete, incomplete, ungrounded, and conflicting information.
Hallucinations can generally be divided into two categories:
Factual Hallucination refers to content generated by the model that is inconsistent with real-world facts. In other words, the information itself may be incorrect, nonexistent, outdated, or lacking reliable evidence. When a model encounters uncertain information or does not have corresponding knowledge, it often tends to “make up” a logically complete response instead of answering “I don’t know.” Factual Hallucination requires external fact-checking and knowledge update mechanisms.
Fidelity Hallucination refers to cases where the model’s response may sound reasonable, and the content itself may not necessarily be incorrect, but it does not faithfully follow the given source, context, task requirements, or original materials. Instead, the model may add, infer, or distort information beyond the provided source. Fidelity Hallucination requires Context Grounding, citation verification, source constraints, and output consistency checks.

What data formats does XecGuard’s PII Policy support?

Currently, XecGuard supports detection of various common Chinese personal information and sensitive data formats, including addresses, phone numbers, email addresses, credit card numbers, IBANs, Taiwan national ID numbers, passport numbers, National Health Insurance card numbers, bank account numbers, business registration numbers, vehicle license plate numbers, and more. The supported scope covers general international formats as well as various Taiwan-specific local formats.
Please note that the PII Policy detects whether the content contains personal information-related attributes. It is not designed as a malicious activity detection alert. Therefore, its detection approach is relatively broad, and the defined Risk Level is comparatively lower. The PII Policy is more suitable for financial application scenarios or other specific use cases.

Can XecGuard verify whether input or output involves copyrighted or other intellectual property content?

To a certain extent, yes. XecGuard can help organizations enforce data usage policies and compliance controls through customer-defined rules, such as Custom Policies and Rules. For example, an organization can define specific policies to check whether employees are sending specific project materials, source code, internal documents, or content containing specific copyright notices, confidential markings, or intellectual property-related information to an AI system. This helps detect and verify whether AI inputs or outputs may involve copyright, trade secret, or other intellectual property risks.
However, it is important to clarify that XecGuard is a Prompt Attack detection and defense system, not a dedicated legal compliance review system. Therefore, XecGuard can serve as part of an organization’s AI usage governance and data leakage risk control framework, but it cannot replace the company’s existing and comprehensive legal review and compliance management mechanisms for copyright law, patent law, trademark law, trade secret law, and other related regulations.

XecGuard Deployment and Performance

The scan is not fast enough. How can performance be improved?

In terms of performance, scan speed can be affected by several factors. First, the more Policies that are enabled, the longer the analysis may take. Based on observed results, each additional Policy may add approximately 350 to 800 milliseconds of latency on average. In addition, if both User Input and Assistant Response are analyzed, the overall processing time may increase to roughly twice the original duration. The length of the Context also affects analysis performance: the longer the content, the longer it may take to process.

Performance can be improved in the following ways:

• Enable only the necessary Policies to reduce the number of rules applied in each Scan
  
• Reduce the number of API calls and avoid scanning every round of conversation
  
• In Agent / A2A / MCP scenarios, perform checks only at critical steps, such as before tool invocation or before generating the final answer, instead of scanning every sentence
  
• Avoid sudden bursts of high-concurrency requests, and use request queuing or traffic control mechanisms where appropriate
  

Which cloud platforms does the XecGuard API support?

XecGuard currently supports cloud architectures on AWS and Azure, and will soon support deployment to GCP.

What are the recommended hardware specifications for On-Premise deployment?

On-Premise deployment is not part of our standard offering. Currently, the standard version of XecGuard is provided only as a Cloud API service. If there is a requirement for self-hosted deployment, it must be discussed separately as a project-based engagement. The project-based version is planned to support On-Premise deployment, but the final specifications will still need to be confirmed based on the actual project requirements. We recommend contacting the CyCraft team directly for further discussion.

Does XecGuard support HA mode?

Yes, HA mode can be supported.
Through the LiteLLM API Gateway, traffic can be configured at the gateway layer and routed to multiple XecGuard API Servers.
However, this requires provisioning multiple machines, as well as introducing and configuring the LiteLLM service.

Does XecGuard provide a Dashboard or Web UI? Why can I only use the API?

The paid commercial version of XecGuard provides a Web management interface and Dashboard. Commercial license plans such as Standard and Advanced are available for enterprise users only.
If you are a user of the XecGuard Community Feedback Program, your license is the Lite version, which provides API access only and does not include the Web Dashboard management interface. However, please note that the API interface provides the same core functionality as the Web Dashboard management interface. The only difference is that the Lite License has a lower API rate limit of 100 RPM.

Does XecGuard support a multi-tenant architecture with multiple user roles for managing multiple AI applications?

Yes. XecGuard supports a multi-tenant architecture and multi-role permission management, helping enterprise groups, subsidiaries, or different business units centrally manage multiple AI applications and various use scenarios.
XecGuard provides a flexible "multi-level rule management mechanism" that allows different Guardrail Rules and security policies to be configured for different LLMs, different Chatbot functions, different AI applications, or different subsidiary and department requirements. At the same time, enterprises can use different Service Tokens to distinguish between AI applications or use scenarios, separately performing usage statistics, policy application, record tracking, and operational management — making AI governance clearer and easier to scale.
In addition, the XecGuard Dashboard provides multiple account roles to support enterprise security governance and tiered management needs, including:

• Territory Admin: Enterprise group administrator, who can manage the overall tenant and cross-organization settings.
• Org Manager: Subsidiary or organization administrator, who can manage the applications, rules, and settings within their organization.
• Org User: Subsidiary or organization API user, who can use the Scan API for security detection.
• Org Auditor: Subsidiary or organization read-only account, who can view records, settings, and report data but cannot modify system settings.

Through its multi-tenant architecture, Service Token-based traffic management, and role-based permission control, XecGuard helps enterprises establish a consistent and manageable AI security governance mechanism across environments with multiple AI applications, departments, and subsidiaries.

For the on-premise version of XecGuard, can customers purchase Red Hat themselves as a replacement?

No, it cannot be replaced.
The on-premise version of XecGuard is delivered as a complete product package. Its related system components must not be separated or replaced by the customer, in order to avoid management risks related to future maintenance, upgrades, compatibility verification, and troubleshooting.
The XecGuard system includes a multi-VM/Docker architecture and requires NVIDIA Linux Driver and related GPU runtime environments. The operating system version, drivers, system parameters, and performance settings have all been optimized and validated according to product requirements. Therefore, the on-premise version currently does not support customer-specified or customer-replaced Linux OS.

XecGuard uses PostgreSQL DB. Can customers purchase SQL Server themselves and include it under shared management as a replacement?

No, it cannot be replaced.
The on-premise version of XecGuard is delivered as a complete product package. Its related system components must not be separated or replaced by the customer, in order to avoid management risks related to future maintenance, upgrades, compatibility verification, and troubleshooting.
XecGuard’s system services, database schema, application integration methods, and deployment process have all been developed, optimized, and validated for PostgreSQL and the existing containerized runtime environment. Therefore, the on-premise version currently does not support customer-specified or customer-replaced databases, nor does it support replacing PostgreSQL with SQL Server.

XecGuard API Usage

Does XecGuard support structured output such as JSON?

Yes. All XecGuard APIs return JSON structured output, and can also be used with Function Calling (Tool Calls), making it easy for downstream systems to parse, integrate, and process results automatically.

Is XecGuard easy to integrate into an existing AI application?

Yes. XecGuard's API design closely follows common industry integration specifications such as the OpenAI API, so existing AI applications can typically integrate quickly by adjusting the API endpoint, token, and related parameters, reducing onboarding costs and the barrier to system modification.
In addition, XecGuard provides a LiteLLM Plugin module that can be integrated directly into an existing AI Gateway architecture, upgrading your original LLM Gateway into an AI security gateway with Guardrail protection capabilities. In this mode, the application side typically requires no major modifications to adopt Prompt Attack detection, protection, and policy control capabilities.

Does XecGuard support real-time inspection of streaming responses?

Not currently.
Under current conditions, XecGuard latency is approximately 350 to 800 milliseconds, so streaming is generally not needed to manage wait times.

How is XecGuard priced? How do I estimate which plan my company needs?

One important advantage of XecGuard is that its pricing is not based on token usage, but primarily on the number of API requests and request frequency. Compared with other Guardrails that charge by token (token-based pricing), where costs can be substantial, XecGuard's model makes it easier for enterprises to estimate and control Guardrail protection costs when using AI applications at scale, avoiding rapid cost inflation caused by longer input content, conversation history, or increased model output.
In terms of performance specifications, a single XecGuard compute unit can support up to approximately 1,500 RPM (Requests Per Minute). Based on our practical experience, this scale can support roughly 300 to 400 concurrent users.
However, the actual number of users supported still depends on how the AI application is designed, user interaction frequency, request content length, whether streaming or multi-turn conversations are used, and the characteristics of the application scenario. Therefore, the figures above serve only as a preliminary capacity-planning reference; for actual deployment, we still recommend conducting stress testing and capacity assessment based on your enterprise's application scenarios and traffic models.

How can XecGuard Dashboard User login support enterprise SSO or AD integration? Does it support SAML?

XecGuard Dashboard User login is based on OAuth 2.0, with OIDC (OpenID Connect) as the identity layer. XecGuard uses OIDC to communicate with AWS Cognito and receives JWT-based tokens.
For enterprise environments where customers already use internal SSO solutions, such as AD FS, Azure AD / Microsoft Entra ID SAML, or traditional Okta SAML, the enterprise Identity Provider may use SAML instead of OIDC. In this case, the integration can be handled as follows:
User → XecGuard Dashboard ← OIDC → AWS Cognito ← SAML → Enterprise IdP (AD FS, Azure Entra ID, Okta SAML, etc.)
AWS Cognito natively supports SAML. Therefore, when a customer uses enterprise SSO such as AD or AD FS, the SAML integration can be handled at the Cognito layer, while the XecGuard Dashboard frontend remains unchanged and continues to use OIDC.
Please note that in the production deployment version, we use an alternative solution equivalent to AWS Cognito.

What are common XecGuard API Error Codes?

400 Bad Request
Description: Malformed request, or input content exceeds the Context Length limit
Common Causes & Resolution:

• Verify that request body field names and types are correct
• If the input is too long, shorten the messages or remove unnecessary conversation history
• Specifying no Policy or using an invalid Policy ID in a Scan request will also trigger this error
• If using a pattern_regex Policy, ensure all rules are valid regex syntax

401 Unauthorized
Description: API Token is invalid, missing, or the License has expired
Common Causes & Resolution:

• Confirm the Authorization header format is Bearer <YOUR_TOKEN>
• Confirm you are using the full token string (Service Token format: xgs_[16-char hex]_[secret])
• Confirm the Token status is enable and has not expired
• Use GET /xecguard/v1/licenses to check whether the License is still valid

403 Forbidden
Description: Authentication succeeded, but the Token does not have permission for this operation
Common Causes & Resolution:

• Management operations (creating/updating Tokens, Policies, querying stats) require a Management Token (xgm_)
• Scan operations (/scan, /grounding) require a Service Token (xgs_)
• Confirm you are using the correct Token type for the endpoint

409 Conflict
Description: The request conflicts with the current state of a resource
Common Causes & Resolution:

• Common scenarios: creating a duplicate Policy or Service Token name, or version mismatch on update
• Check whether the resource already exists before creating (GET /xecguard/v1/policies or GET /xecguard/v1/tokens)
• To modify an existing resource, use PATCH instead of re-POSTing

413 Content Too Large
Description: The request content exceeds the maximum acceptable Context Length (128K tokens)
Common Causes & Resolution:

• Shorten the messages content or remove unnecessary conversation history
• Ensure the input does not exceed the 128K token limit
• XecGuard is designed for real-time chat content analysis and is not recommended for scanning large documents or complete files

422 system_prompt_exceeds_license_scan_budget
Description: The System Prompt exceeds the License's per-scan token limit (Lite: 10K tokens / Standard·Advanced: 38K tokens)
Common Causes & Resolution:

• Shorten the System Prompt to fit within the limit for your plan
• If the System Prompt has multiple segments, check whether the combined total length is approaching the limit

429 Too Many Requests
Description: API calls per minute have exceeded the rate limit (RPM) allowed by the License
Common Causes & Resolution:

• Implement Retry with Exponential Backoff
• Add request queuing or traffic throttling to avoid burst concurrency
• If this occurs frequently, consider upgrading your License plan

What happens when a Token is invalid or the License has expired?

When a Service Token does not exist, has been disabled, or the License has expired, the API returns a 401 Unauthorized or 403 Forbidden error, and all API endpoints become inaccessible.
After the License expires, even if the Token itself has not yet expired, no operations can be performed. A new License must be requested to obtain a new Management Token.
It is recommended to periodically check the License expiration date via GET /xecguard/v1/licenses to avoid service interruptions.

What should I do if my Management Token is lost or needs to be deleted?

The XecGuard Management Token is a unique management credential for each user and cannot be regenerated or deleted by the user.
If your Management Token is lost, needs to be reissued, or you wish to terminate the plan early and delete the Token, please submit a request via email.
These operations are currently handled manually, and we will respond as soon as possible upon receiving your request.

What should I do if my Service Token is lost or needs to be deleted?

If a XecGuard Service Token is lost, suspected of being leaked, or no longer in use, you can handle it through the XecGuard application interface.
Go to the Application page, select the corresponding application, and use the Manage function to regenerate or delete the Service Token.

• If the Token is lost or suspected of being leaked, we recommend using Regenerate Service Token to generate a new Token.
• If the Token is no longer in use, or the corresponding application should no longer access the XecGuard API, you can delete the Service Token directly.

After regenerating a Service Token, the system issues a new Token Secret. Please copy and store it securely immediately; for security reasons, the new Token is displayed only once and cannot be viewed again after the window is closed.

How can I improve false positives or missed detections?

Since natural language content varies greatly by context, and there is no fully consistent and precise industry standard for determining "malicious intent" and "unsafe content," no AI Guardrail system can guarantee a 100% detection rate. Actual detection effectiveness is influenced by the application scenario, System Prompt design, task boundaries, user input content, and how Guardrail Policy / Custom Policy rules are written.
If false positives or missed detections occur, consider adjusting in the following directions:

• Optimize the wording of Custom Policy Rules Make rule descriptions more explicit, avoiding overly vague, overly broad, or condition-less rules. When necessary, add positive and negative examples to help the system more accurately understand the boundary between content that should be blocked and content that should be allowed.
• Add explicit blocklists or prohibited conditions If the enterprise already has specific terms, project names, confidential codenames, data types, or high-risk behaviors that must not appear, you can add additional blocklists or explicit prohibition conditions in XecGuard Policies to improve protection in specific scenarios.
• Optimize the application's System Prompt If the detection result is related to the application's task boundaries, we recommend reviewing and strengthening the application's System Prompt so that role settings, allowed behaviors, prohibited behaviors, and task constraints are clearer, allowing System Prompt Enforcement to work more effectively.

Overall, the best Guardrail results usually come from combining "clear application task boundaries" with "explicit security policy rules." For how to write Custom Policies and related best practices, please refer to the relevant sections in the XecGuard API documentation.

What is the difference between a Service Token and a Management Token?

• Service Token: Used for actual API calls (such as Guardrail Scans). Multiple Service Tokens can exist. The maximum number of Service Tokens depends on your License plan.
  
• Management Token: Each License has one unique Management Token, used for management functions such as Token management, Policy management, usage statistics, and system governance.
  
  ⚠️ Both Management Tokens and Service Tokens are bearer tokens that grant access to your resources. These credentials are highly sensitive and must be stored securely, with access strictly controlled, and never exposed.

Are there format restrictions on the Request Body?

Yes. The Request Body must be valid JSON and conform to the request structure defined by the API.
If the content format is invalid or cannot be parsed, the API will return an error message and the security scan will not be executed.

What happens if a Policy name is incorrect?

If a non-existent Policy name is specified in the policy_names of a Scan request, the API returns a 400 Bad Request with the error message "The following policy_names do not exist: <incorrect name>", and the scan will not be executed.
Make sure to use the complete and correct Policy name (e.g., Default_Policy_GeneralPromptAttackProtection). Policy names are case-sensitive.
You can query all available Policies via GET /xecguard/v1/policies to avoid name input errors.

What result statuses does the XecGuard API return after a scan?

After a Guardrail Scan is completed, the API returns the security assessment result for the application to handle accordingly. The main information includes:

• Decision (SAFE / UNSAFE): Indicates whether the input or output content was determined to have security risks
  
• Violated Policy: Identifies the Policy name that triggered the security judgment
  
• Violated Rules: Lists the specific rules that were violated
  
• Rationale: Provides an explanation of why the content was flagged as risky
  
• Trace ID: If the decision is UNSAFE, the system generates a corresponding Security Trace for subsequent detailed record queries
  
  This can be used for response control, security alert display, event auditing, and risk analysis.

XecGuard Specifications

What is XecGuard's context processing capacity and input limit?

The maximum input Context Length per request is 128K tokens. If the input exceeds this limit, the API returns a 413 Content Too Large error and the request will not be processed.
The actual content analyzed depends on the License plan: Lite processes only the last 10K tokens, while Standard and Advanced process only the last 38K tokens. If the input exceeds these processing windows, only the most recent portion of the content is analyzed, and earlier content is ignored, which may impact detection completeness and accuracy.
Therefore, XecGuard is designed for analyzing real-time chat content or prompt/response interactions, and is not recommended for scanning large documents or full-length files.

What detection modules and Policies does XecGuard provide?

XecGuard currently provides eight detection modules and Policies:

General Prompt Attack Protection
Description: Detects and prevents most prompt injection, prompt extraction, and evasion attacks, blocking attackers from overriding model behavior, exposing protected system instructions, or bypassing security mechanisms through obfuscation and encoding techniques.

System Prompt Enforcement
Description: Ensures AI systems strictly follow enterprise-assigned AI Agent task scope (System Prompt Following), achieving true context-aware security that goes beyond traditional content filtering.

Content Bias Protection
Description: Detects and mitigates outputs exhibiting prejudice, harassment, or harmful stereotypes, ensuring generated content is non-discriminatory and respectful of protected attributes, health status, and socioeconomic background.

Harmful Content Protection
Description: Detects and prevents harmful or dangerous AI outputs through semantic-level analysis, rather than relying solely on keyword filtering.

PII & Sensitive Data Protection
Description: Enterprise-grade AI privacy and data leakage prevention, ensuring AI does not expose personal or sensitive information.

Malicious Skills Protection
Description: Detects whether AI Agent Skills and related file content contain malicious or harmful content targeting the system, protecting Agent AI from the impact of malicious Skills.

Custom Policy Enforcement
Description: Enables organizations to define custom Guardrail Rules in natural language based on their business or AI/Chatbot task requirements, and enforce organization-specific AI governance rules.

Context Grounding Validation
Description: An API-only feature for detecting AI hallucinations, checking whether response content strictly adheres to user-provided documents and approved RAG context.

What License plans does XecGuard offer?

XecGuard offers three main License plans:

• XecGuard Lite: Maximum request rate (RPM) of 100(~180) requests/min; up to 2 Service Tokens (API keys); Context length limit of approximately 10K Tokens. Designed for proof-of-concept (POC), small-scale deployments, and the XecGuard Community Support Program.
  
• XecGuard Standard: Maximum request rate (RPM) of 700 requests/min; up to 7 Service Tokens. Recommended for most production scenarios and multi-application environments.
  
• XecGuard Advanced: Maximum request rate (RPM) of 1500 requests/min; up to 15 Service Tokens. Suitable for high-traffic or enterprise-grade deployments.
  To select or upgrade a plan based on your traffic or management needs, please contact your sales representative or system administrator for recommendations and plan details.