AI, explained
What is an AI guardrail?
A guardrail is not an instruction in a prompt, it is a control the model cannot talk its way past.
Three layers, not one
Guardrails are usually discussed as content filtering. In production they operate at three levels, and the third is the one that determines whether a system can be trusted with real work.
Input guardrails
These run before the model sees anything: stripping or redacting personal data, rejecting oversized or malformed payloads, detecting prompt injection attempts embedded in retrieved documents, and enforcing which users may ask which questions. Retrieved content is the underrated risk here, because a document in your own corpus can carry instructions aimed at your agent.
Output guardrails
These check what came back before anyone sees it: schema validation so a downstream system does not receive malformed data, groundedness checks that every claim traces to a retrieved source, refusal handling for topics outside scope, and personal data scanning on the way out as well as in.
Action guardrails
These constrain what the system may do. Which tools exist at all, what each one is permitted to touch, spend and rate limits, and which actions require a human approval before execution. This is the layer that separates a system that can waste time from one that can cause damage, because an agent with a write credential and no action guardrail is an unsupervised employee with production access.
Why prompt instructions are not guardrails
An instruction telling the model never to do something is a preference expressed in the same channel as the attack. Anything that arrives as text can argue with it. A guardrail lives in deterministic code outside the model: the tool is not registered, the credential is scoped, the spend cap is enforced by the runtime, the approval step blocks execution. If disabling it requires changing code and permissions rather than changing wording, it is a guardrail.
What to build first
- Scope every credential to the minimum the agent needs, read-only wherever the task allows.
- Put irreversible actions, anything that sends, pays, deletes or publishes, behind an explicit human approval.
- Set a hard spend ceiling per workflow with an alert well below it.
- Log every tool call with inputs, outputs and the identity that triggered it, so an incident can be reconstructed.
An AI audit maps which of these are missing before an agent touches production systems.
Frequently asked questions
What is an AI guardrail?
A control placed around a model in code rather than in the prompt, constraining what input reaches it, what output is allowed through, and which actions it may take. Input guardrails redact and screen, output guardrails validate and check grounding, and action guardrails scope credentials, cap spend and gate irreversible operations behind human approval.
Are prompt instructions enough to keep an AI system safe?
No. An instruction in a prompt sits in the same channel as any adversarial text arriving from a user or a retrieved document, so it can be argued with. A real guardrail lives outside the model in deterministic code: the tool is not registered, the credential is scoped, the runtime enforces the cap.
Which guardrail matters most?
The action layer. Input and output controls limit embarrassment, but an agent holding a write credential with no action constraint can send, pay, delete or publish. Scope credentials to the minimum, gate irreversible actions behind human approval, cap spend in the runtime, and log every tool call with the identity behind it.
Related
Ready to put AI to work?
Book a discovery audit and we will map the highest-ROI AI agents and automations for your business.
Book a discovery audit →