# What are AI guardrails? Checks placed around a model that stop or change what goes in and what comes out, such as a filter on user messages or an approval step before an agent acts. - Page: https://tecyfy.com/concepts/guardrail - Subject: How AI works (https://tecyfy.com/concepts) - Level: beginner - Also called: Guardrails - Last checked: 2026-10-14 A model's own training makes it refuse some things. Guardrails are the extra checks a builder puts around the model, in the app, because training alone is not enough. Think of them less as one wall and more as a series of gates a request has to pass on the way in and the answer has to pass on the way out. ## Where they sit **On the way in.** Before your message reaches the main model, a check can look at it. Is it on topic? Is it an attempted [Jailbreak](https://tecyfy.com/concepts/jailbreak)? Does it contain someone's card number? Often this check is a second, smaller model. OpenAI's agent toolkit gives the example of a support agent built on a large, slow model: a cheap, fast model screens each request first, and an off-topic one, such as a homework question, is stopped before the expensive model runs. **Around actions.** For an [Agent](https://tecyfy.com/concepts/agent), the most important gates are on its tools. A tool can be allowed, blocked, or set to ask a person first. Checks can also run on a tool's inputs before the call and its result after it, which helps catch [prompt injection](https://tecyfy.com/concepts/prompt-injection) in fetched content. **On the way out.** The finished answer can be checked too: is it in the format expected, does it leak private data, does it claim something the sources do not support? When a check fails, the usual move is to stop. OpenAI's toolkit calls this a tripwire: the run halts and the app decides what to tell the user. ## Instructions are not guardrails A line in the [system prompt](https://tecyfy.com/concepts/system-prompt) saying "never discuss competitors" helps, but the model can be talked out of it. A guardrail in code cannot be argued with. Good apps use both, and put anything that must never happen, like moving money without approval, in code. ## What they cost Each check adds a little delay and a little cost, and a strict one will sometimes block a perfectly fair request. Builders tune them to the stakes: light on a recipe bot, heavy on a bank. ## Spotting them as a user "I can't help with that here", a request to confirm before an agent sends something, a message cut short: those are guardrails at work. The confirmation prompts are the ones to keep switched on. ## Related - [Jailbreak](https://tecyfy.com/concepts/jailbreak): A prompt written to talk a model out of its safety rules, so it produces something it was trained or instructed to refuse. - [Prompt Injection](https://tecyfy.com/concepts/prompt-injection): An attack that hides instructions in text a model reads, such as a web page, an email or a file, so the model follows the attacker instead of you. - [System Prompt](https://tecyfy.com/concepts/system-prompt): Instructions the builder of an AI app gives the model before you type anything. It sets the role, the tone and the rules, and it outranks what users say. - [Safety Filter](https://tecyfy.com/concepts#safety-filter): A model or rule set that blocks disallowed content. - [Content Moderation](https://tecyfy.com/concepts#content-moderation): Automated detection of toxic, unsafe, or disallowed content. - [Agent](https://tecyfy.com/concepts/agent): A model that uses tools in a loop, deciding each next step from what the last one returned, until the task is done. ## Sources - [Guardrails](https://openai.github.io/openai-agents-python/guardrails/), OpenAI Agents SDK documentation, 2026-10-14. Guardrails do checks and validations of user input and agent output. Input guardrails check the user's input, output guardrails check the agent's final output, and tool guardrails run before and after a function tool is called. When a guardrail detects a violation, a tripwire stops the agent. A fast, inexpensive model can screen a request before a large, slow model starts, saving time and money. - [Mitigate jailbreaks and prompt injections](https://platform.claude.com/docs/en/test-and-evaluate/strengthen-guardrails/mitigate-jailbreaks), Anthropic, Claude API documentation, 2026-10-14. Harmlessness screens use a lightweight model to pre-screen user input, and the same screening can be applied to tool outputs. Least privilege, continuous monitoring and layering safeguards together strengthen guardrails. - [LLM01:2025 Prompt Injection](https://genai.owasp.org/llmrisk/llm01-prompt-injection/), OWASP Gen AI Security Project, 2026-10-14. Mitigations include defining and validating expected output formats, input and output filtering, least privilege access and requiring human approval for high-risk actions. - [Securely deploying AI agents](https://code.claude.com/docs/en/agent-sdk/secure-deployment), Anthropic, Claude Code documentation, 2026-09-25. Each tool can be set to allow, block or ask first. - [Reduce hallucinations](https://platform.claude.com/docs/en/test-and-evaluate/strengthen-guardrails/reduce-hallucinations), Anthropic, Claude API documentation, 2026-09-25. Models can state things that are wrong with confidence, and checking a claim against sources reduces this.