Guardrails are controls around an AI system that limit unsafe, disallowed, or business-rule-breaking behavior.
They make safe behavior a system property, not only a sentence in a prompt.
What is it?
Guardrails are controls used to limit unsafe, disallowed, or business-rule-breaking AI behavior.
They can inspect an input, restrict a tool call, enforce a permission, check an output, or stop an action before it reaches the outside world.
Where guardrails fit
Guardrails can be placed around the model and around every action it proposes.
USER
↓
INPUT GUARDRAIL
↓
LLM / AGENT
↓
TOOL PERMISSION
↓
TOOL
↓
OUTPUT GUARDRAIL
↓
USER
Types of guardrails
Input Guardrails
Inspect incoming requests before the model sees them.
Output Guardrails
Check generated content before it reaches a user or system.
Tool Guardrails
Limit which tools an agent may call and how it may call them.
Permission Controls
Define which data, systems, and actions are allowed.
Business Rules
Enforce rules such as amount limits, approval steps, or required fields.
Content Moderation
Detect, block, or route unsafe or disallowed content.
Agent scenario · Coding Agent
A Coding Agent may be capable of many operations. Guardrails define which operations are actually available in this environment.
ALLOWED
read_fileedit_project_filerun_test
BLOCKED
sudorm -rf /read_sensitive_file_outside_project
Important distinctionThe model “knows it should not do something” and the system “technically prevents it from doing something” are not the same thing.
Think of it like...
PromptTell an employee: “Do not enter the server room.”
→
GuardrailThe server-room door actually has access control.
A prompt communicates a rule. A guardrail adds a control that can enforce the rule.