What are AI guardrails?

A model's own training makes it refuse some things. Guardrails are the extra checks a builder puts around the model, in the app, because training alone is not enough. Think of them less as one wall and more as a series of gates a request has to pass on the way in and the answer has to pass on the way out.

Where they sit

On the way in. Before your message reaches the main model, a check can look at it. Is it on topic? Is it an attempted JailbreakJailbreakA prompt written to talk a model out of its safety rules, so it produces something it was trained or instructed to refuse.? Does it contain someone's card number? Often this check is a second, smaller model. OpenAI's agent toolkit gives the example of a support agent built on a large, slow model: a cheap, fast model screens each request first, and an off-topic one, such as a homework question, is stopped before the expensive model runs.

Around actions. For an AgentAgentA model that uses tools in a loop, deciding each next step from what the last one returned, until the task is done., the most important gates are on its tools. A tool can be allowed, blocked, or set to ask a person first. Checks can also run on a tool's inputs before the call and its result after it, which helps catch prompt injectionPrompt InjectionAn attack that hides instructions in text a model reads, such as a web page, an email or a file, so the model follows the attacker instead of you. in fetched content.

On the way out. The finished answer can be checked too: is it in the format expected, does it leak private data, does it claim something the sources do not support?

When a check fails, the usual move is to stop. OpenAI's toolkit calls this a tripwire: the run halts and the app decides what to tell the user.

Instructions are not guardrails

A line in the system promptSystem PromptInstructions the builder of an AI app gives the model before you type anything. It sets the role, the tone and the rules, and it outranks what users say. saying "never discuss competitors" helps, but the model can be talked out of it. A guardrail in code cannot be argued with. Good apps use both, and put anything that must never happen, like moving money without approval, in code.

What they cost

Each check adds a little delay and a little cost, and a strict one will sometimes block a perfectly fair request. Builders tune them to the stakes: light on a recipe bot, heavy on a bank.

Spotting them as a user

"I can't help with that here", a request to confirm before an agent sends something, a message cut short: those are guardrails at work. The confirmation prompts are the ones to keep switched on.