AI guardrails
Definition
AI guardrails are checks and limits placed around an AI system that block or flag unsafe or wrong inputs and outputs before they cause harm. The strongest ones run as code outside the model, so a cleverly worded request can't talk its way past them.
By Ronan Liedmeier, fractional head of growth and course author · Published 17 October 2026 · Last updated 17 October 2026
Also called: LLM guardrails, AI safety checks
They matter once AI can send messages or change live systems without a person reading each output.
How it works
Guardrails sit at three points. Before the model, allow-lists and deny-lists decide which inputs get in at all. Inside the prompt, refusal instructions tell the model what to decline. After the model, code checks the output, for example a range check on numbers or a scan for banned phrases, and stops anything that fails.
For agents that use tools, the strongest guardrail is limiting which tools the agent can call, with caps on tool calls and spend per run. Actions that move money or delete data go behind human approval or stay out of the agent's reach entirely. A blocked action should alert a person, so someone sees the failure.
Example
A property manager uses AI to draft replies to tenant repair requests. A code check scans every draft for dates and money amounts. Any draft that commits to a repair date or a cost goes to a staff member's queue instead of being sent, and the prompt rule against making promises stays in place too.
Common mistake
Writing the rule in the prompt and leaving the risky tool connected. If the agent can still edit live ad campaigns, "never modify live campaigns" in the prompt does not stop it. Remove or restrict the tool, and write down which checks exist so someone other than the builder knows what is enforced.
Learn it in AI Academy
- Simple GuardrailsAdvanced · 15 min
- Guardrails, Permissions & Safety ArchitectureExpert · 8 min
Related terms
- Human in the loop
- Human in the loop is a setup where an AI system pauses at set points so a person can approve or correct its work before it takes effect. It is used for actions that are hard to undo, such as sending emails to customers or moving money.
- Prompt injection
- Prompt injection is an attack where text an AI reads, such as an email, web page or file, contains instructions that make the model do something its user did not intend. OWASP ranks it first in its Top 10 risks for LLM applications.
- Structured output (JSON mode)
- Structured output is a way of getting an AI model to return its answer in a fixed, machine-readable format, usually JSON with named fields, instead of free text. It lets another program read the answer reliably, for example to fill a spreadsheet row or pick the next step in a workflow.
- AI governance
- AI governance is the set of rules, owners and checks an organization uses to decide which AI uses are allowed, how their risks are handled, and who answers when something goes wrong. In the US, NIST publishes a voluntary framework for it, the AI Risk Management Framework.