Guardrails
Controls placed around an LLM, on its inputs, outputs and actions, that enforce policy, block unsafe content and keep the system within its intended scope.
Definition
Guardrails are the deterministic layer around a probabilistic model. They sit at three points. Input guardrails inspect what goes in: detect injection attempts, strip personal data, reject off-topic requests. Output guardrails inspect what comes out: check format, block disallowed content, verify that claims cite a retrieved source. Action guardrails govern what the model is allowed to do through tools: allow-lists, rate limits, spend caps and human approval for irreversible steps.
Implementations range from simple rules and regular expressions to dedicated classifier models and provider moderation services. The common principle is that the control is enforced by code the model cannot influence. A system prompt saying "never reveal customer data" is a request; a filter that redacts account numbers in every response is a guardrail.
Example: a banking assistant may discuss products and explain statements. Input rules route anything about investments to a human. Output checks remove full account numbers. The only tool with write access, "raise a dispute", requires the customer to confirm in the app before it runs.
What it means in practice
- They are the practical answer to prompt injection and to models behaving unexpectedly.
- They make scope explicit, which keeps a support bot from giving legal advice or a sales agent from giving discounts.
- They produce logs and evidence that regulators, insurers and auditors increasingly ask for.
- They must be tested like any control: red teaming and evals measure whether they hold.
How Teksmobile uses it
Guardrail design is central to our prompt injection defence service and is reviewed in every LLM security audit. For customer-facing deployments we pair them with the monitoring from our LLMOps and monitoring work so that blocked events are logged and reviewed rather than dropped silently.
Related terms
Part of the Teksmobile AI Glossary. Try the AI security checklist.
Frequently asked questions
Are guardrails just a stricter system prompt?
No. Instructions in the prompt can be overridden by prompt injection. Real guardrails run outside the model: classifiers, validators, permission checks and approval steps the model cannot talk its way past.
Do guardrails hurt the user experience?
Badly tuned ones do, by refusing legitimate requests. Measure false positives with evals and keep the controls proportionate to the risk of each action.
Which guardrail tools exist?
Options include provider moderation endpoints, open-source frameworks and purpose-built classifiers. The choice matters less than deciding, per feature, what must never happen and testing for it.