What are guardrails in AI?

Barriers on a motorway keep cars from leaving the road. In AI, guardrails do the same job: they are checks that limit what a model accepts and what it returns. Models come with safety behavior from their own training, but that is not enough for a product; the company building it needs an extra layer based on its own rules.

An example of why: in 2024 a Canadian airline was held liable by a tribunal for a refund policy its chatbot had described incorrectly to a customer.

• Input checks: messages are scanned for attempts to trick the model (prompt injection, jailbreaks), personal data such as ID and card numbers is masked, and off topic requests are filtered.
• Output checks: answers are checked for harmful, abusive or legally risky content, facts such as prices and stock are compared with real system data, and the output format is validated.
• Action checks: what an agent may do is restricted, and steps such as payments and deletions require human approval.

Guardrails are built in layers. The simplest layer is rules in the system prompt, but on its own it is not reliable. Stronger methods are separate checks placed before and after the model call: word and pattern filters, classifier models (such as Meta's Llama Guard) or open source tools like NVIDIA's NeMo Guardrails. For critical decisions the last layer is a person.

Guardrails limit the damage from hallucination and misuse. The dose matters too: an overly strict set stops the model from answering harmless questions and drives users away. A good set is tuned against real conversations and reviewed regularly.