Guardrails are where you decide how much Arbyn is allowed to do with your orders, on its own, versus how much always comes back to you first. This is the safety layer underneath everything else Arbyn does: it controls how an action fires, separately from when Arbyn escalates (that's your Escalation Triggers) and what offers exist (that's Sales Skills). This article covers what each setting actually does, honestly, including where Arbyn deliberately never acts alone today.

Guardrails let you set, action by action, whether Arbyn handles refunds, cancellations, address changes, returns, and subscription questions completely hands-off, only after gathering details and asking your approval, or (for the one action where it's available) fully on its own within a limit you set. Everything defaults to off. Arbyn never touches a single one of these until you turn it on.

Settings → Guardrails.

At the top of the page is Arbyn's overall on/off switch for sending replies automatically. In Observing mode, Arbyn drafts every reply, but you review and send each one yourself, this is where every store starts. The page shows you how many conversations Arbyn has observed so far. Once you've reviewed enough real conversations to trust Arbyn's replies, you switch to Live mode, and Arbyn starts sending its confident replies automatically, still drafting the rest for your review. You can flip back to Observing at any time, and doing so never touches or resets any of the order-action settings described below, they're independent switches.

Every reply Arbyn drafts comes with a confidence score. The threshold slider sets the point below which Arbyn stops and hands the conversation to you instead of replying (or acting) on its own. Push it higher and Arbyn escalates more often, safer, but more work for your team. Push it lower and Arbyn handles more by itself, once you've reviewed enough conversations to trust it.

Click Configure on any row to open its settings. Every action shares one rule: it is only usable on the channels you allow (email and chat are available today; Instagram DMs and Facebook Messenger are greyed out here until those channels are wired up).

Refunds. Arbyn never issues a refund itself, on any setting, only a person on your team completes one. Two settings shape how a request reaches you. The mode, Off or Require approval, decides whether Arbyn just hands the conversation straight to your team as a general escalation, or actively gathers the order and reason first and files it as a proper request in your Approvals queue. Separately, you choose how Arbyn talks to the customer while it does this: escalate immediately (hand off right away, no questions asked) or collect the reason first, then escalate (Arbyn asks what happened before handing it over). Either way, when a refund is ready to happen, you complete it yourself from the inbox quick-actions, Arbyn never has the ability to move money on its own.

Cancellations. Off, or Ceiling Limits. There's no fully autonomous mode for cancellations, Arbyn never cancels an order itself. What Ceiling Limits does is triage: you set a cancel ceiling (an order total) and an optional cancel window (how many days after purchase a cancellation is still allowed). Orders at or under your ceiling are filed in your inbox flagged ready to process; orders over it are flagged for review. You also choose which cancellation reasons you accept, and whether a shipped or partially-shipped order should always escalate for review instead (recommended, since a shipped order usually can't be pulled back anyway). Arbyn still does the gathering and filing. You do the actual cancel.

Inside Ceiling Limits there's also an Allow cancellations switch, on by default. It's a separate control from the Off/Ceiling Limits choice above, and the distinction is useful: turning the whole action Off means Arbyn treats cancellation as a topic it doesn't handle, while switching Allow cancellations off keeps the triage machinery configured, your ceiling, your window, your accepted reasons, and simply stops Arbyn acting on it. If you run seasonal periods where you can't accept cancellations at all, this is the switch to use, so you don't have to rebuild your ceiling settings from scratch when the period ends.

Address change. Off, Escalate, or Autonomous, and this is the one action on the page that can run completely on its own today. In every mode, Arbyn validates the new address before doing anything with it (so a mistyped or undeliverable address never slips through). In Off mode, it files the validated change in your inbox for you to apply by hand. In Escalate mode, it prepares the change and waits for your one-click approval before applying it. In Autonomous mode, it applies the validated address to the order immediately and confirms it to the customer, no review needed, unless the order has already shipped or been fulfilled, in which case it always escalates to you instead (carriers usually can't redirect a package mid-transit, so Arbyn doesn't try).

Returns. Its own set of four options, because a return is rarely just "yes or no": Off (Arbyn escalates any return request to you to decide), Arbyn Returns (Arbyn gathers the order, the reason, a photo for damage or defect claims, and the customer's preferred resolution, then escalates the whole package to your inbox for you to approve or decline), Direct to your returns page (Arbyn answers the question, confirms the order, then sends the customer to a returns page you provide), or Shopify self-serve returns (Arbyn confirms the order, then sends the customer to their own Shopify account to start the return, where your Shopify return rules decide eligibility). None of these have Arbyn processing a return on its own, every path either escalates to you or redirects the customer somewhere you control. Choosing Arbyn Returns unlocks a full policy setup: your return window in days, which reasons you accept (damaged, wrong item and not-as-described carry no restocking fee, since those are on you; the rest carry whatever restocking fee you set), which resolutions you're willing to offer (refund, exchange, store credit, free replacement), and which collections or products are marked final-sale and therefore never eligible.

There's also a Generate prepaid return shipping labels switch in that same policy setup, off by default. Turn it on and, where Shopify Shipping is configured on your store, Arbyn attaches a prepaid return label to the customer's reply so they don't have to arrange postage themselves. It depends on Shopify Shipping being set up: without it there's no label to generate, and Arbyn simply continues without one rather than promising a label that never arrives. Worth knowing how this interacts with your restocking fee, because the two follow the same fault logic: damaged, wrong item and not-as-described are your store's fault, so they carry no restocking fee and get a free label; change-of-mind reasons carry whatever fee you've set.

There's also a dedicated field for your EU/UK 14-day withdrawal page, since that's a legal right in those regions independent of your regular returns policy, and Arbyn needs somewhere real to send those customers rather than inventing one.

Subscriptions. Its own three options too: Off (Arbyn still answers general questions like "do you offer subscriptions?", but escalates anything about an existing subscription, pause, cancel, or otherwise, to your team), Send to your portal (Arbyn answers from what it knows, then hands the customer a button to your subscription management page), or Escalate (Arbyn answers general questions, then escalates account-specific requests). If you pick the portal option but leave the URL blank, Arbyn falls back to escalating rather than sending customers to a broken link. You also tell Arbyn which app runs your subscriptions (Recharge, Appstle, Shopify Subscriptions, or whatever you use) so it can answer accurately; this is for Arbyn's own knowledge only and is never shown to your customers.

Any setting that lets Arbyn act without your review comes with a required safety limit before it's allowed to run: a dollar ceiling for order value, or a rule like "always stop if the order has already shipped." You can't save an autonomous setting without one, this is a deliberate guardrail against a bad draft ever running unchecked on a real order.

Can Arbyn ever refund a customer without me knowing? No. Arbyn never issues a refund itself, on any setting. It always escalates the request to your inbox, and a person on your team completes the actual refund.

Which action can Arbyn do completely automatically? Only address changes, and only if you set that action to Autonomous. Every other action (refunds, cancellations, returns, subscriptions) always either waits for your approval or sends the customer somewhere you've set up in advance.

What happens if an order has already shipped when a customer asks to change the address or cancel? Arbyn escalates it to you instead of acting, on both actions, since a package already moving is usually out of everyone's hands at that point.

Do I have to set up all five actions? No. Everything defaults to off. Turn on only the actions you want Arbyn handling, and leave the rest escalating to your team.