Definition
Guardrails are controls around an AI system that check or constrain inputs, outputs, tool calls, and workflow transitions. They may include allow-lists, schema validation, content classifiers, policy checks, rate limits, approval steps, output filtering, and rules that prevent certain actions.
A guardrail may use deterministic rules, a model, human review, or a combination. Even when a model performs a check, the control belongs to the surrounding system.
Simple example
A support assistant can draft refund recommendations but cannot issue refunds directly. Before executing a refund, the application validates the tool request against a schema, checks order ownership against its own records, enforces an amount limit, and requires human approval above a lower threshold. A content check blocks a drafted response if it detects account secrets.
These controls act at different points in the workflow. A prompt asking the model to behave safely does not replace them.
Why it matters
A model’s response is not a reliable authority for whether an operation is allowed, even with deterministic decoding. Ambiguous or adversarial input can influence it. Guardrails give the surrounding system places to enforce policy, reject malformed data, block disallowed actions, and record why an operation was allowed or denied.
They also make failures easier to test because each control can have defined inputs, decisions, and fallback behavior.
One important nuance
“Guardrails” is a broad label, not a single security boundary or product feature. A classifier can miss harmful content, schema-valid output can still violate business rules, and a second model can be manipulated or inconsistent. Guardrails do not make an unsafe architecture secure. Keep authorization, least privilege, data isolation, and audit logging in place. Add human approval where the consequences warrant it, and test where each guardrail fails.