Guardrails: the safety barriers around an AI system
Guardrails are checks added around an AI model to inspect the requests it receives and the answers or actions it produces. Their job is to block, correct or flag anything that falls outside what the application is meant to do.
Data as of October 22, 2026
Key figures
| Level | Intermediate |
|---|
What guardrails are for
A language model can make mistakes, drift off topic, produce harmful content or follow malicious instructions. The system prompt sets a frame, but it is only an instruction. Guardrails add checks that can be enforced at several points.
NVIDIA’s open-source NeMo Guardrails toolkit distinguishes five kinds, which is a handy way to picture the idea:
- input: inspect the user’s request, then reject or rewrite it;
- dialog: steer the conversation, for example by declining certain topics;
- retrieval: filter the documents fetched in a RAG pipeline;
- execution: check the inputs and outputs of tools or actions;
- output: review the model’s answer, then block or fix it.
A concrete example
A bank launches an assistant that answers questions about payment cards. An input guardrail spots card numbers typed by mistake and masks them. A dialog guardrail politely declines requests for investment advice. An output guardrail checks that the answer contains no personal data about another customer. Finally, any sensitive action, such as freezing a card, goes through human approval or an explicit confirmation step.
Before automating a task, our Can I trust an agent with this? tool helps you spot where this kind of protection is needed.
Why it matters
Once agents act inside real tools, a wrong answer can turn into a wrong action. Guardrails are one of the recommended defences against prompt injection, together with least-privilege access and adversarial testing (red teaming). Requiring structured output also makes automatic checks easier to write.
Common mistakes and myths
- “A well-aligned model needs no guardrails.” Alignment reduces unwanted behaviour, but an application still has to enforce its own business rules.
- “The more filters, the better.” Guardrails that are too strict block legitimate requests and frustrate users.
- “A guardrail is just a list of banned words.” Modern approaches often rely on classifiers or dedicated models, which are far more nuanced than a word list.
- “Set it up once and you are done.” Bypass techniques keep changing, so guardrails need regular testing and tuning.
Related terms
- Prompt injection · An attack that slips hidden instructions into text an AI reads, to make it ignore its original instructions or act against its user.
- AI alignment · The research and methods aimed at making an AI system actually pursue the intentions and values of the people who build and use it.
- System prompt · Background instructions given to a model before the conversation starts (role, tone, rules) that shape every answer that follows.
- Human-in-the-loop · A design where a person reviews, corrects or stops the important steps of an AI system or agent before they take effect.
- Red teaming · Adversarial testing in which people or other AIs deliberately attack a model to uncover its weaknesses before real attackers do.
- Structured output · An AI model's answer produced in an enforced format, usually JSON that matches a schema, so that a program can read it reliably.
Try it
Full glossary
Frequently asked questions
Are guardrails inside the model or around it?
Both exist. Some cautious behaviour is learned during training, which is the work of alignment. But the word guardrails usually refers to the checks an application adds around the model: filters, classifiers, rules and validation steps.
Which tools can add guardrails?
Well-known projects include NeMo Guardrails, an open-source toolkit from NVIDIA released under the Apache 2.0 licence, and Llama Guard, a Meta model presented in December 2023 that classifies prompts and responses against a risk taxonomy. Major providers also offer their own moderation filters.
Do guardrails make an AI 100% safe?
No. They reduce risk but can be bypassed, for instance by a well-crafted prompt injection, and they also make mistakes the other way by blocking legitimate requests. They work alongside other measures such as limited permissions and human approval.
Do guardrails slow down responses?
Often a little, because each extra check takes time, especially when it calls another model. How much to add is a trade-off that depends on how risky the application is.
Data sources
Data as of October 22, 2026
Report an error
Does a figure, a date or a fact look wrong? Tell us: every report is checked.