Guardrails

Guardrails are the automated checks wrapped around a support AI to keep it inside safe, on-policy behaviour, and they come in layers. Input guardrails screen the incoming message for prompt injection, abuse, or out-of-scope requests. Output guardrails inspect the drafted reply before it ships — confirming it is grounded in a real source, stripping PII, and blocking banned topics, bad advice, or off-tone language. Action guardrails cap what the agent may do on its own, such as issuing a refund or changing an account, and force a handoff to a human above a set risk or confidence threshold.

They are what separates a convincing demo from something you can put in front of customers, because the company owns whatever its bot says. A 2024 Canadian tribunal held Air Canada liable for a wrong answer its support chatbot gave a grieving customer; "the chatbot did it" was not a defence. The failure categories are well catalogued — the OWASP Top 10 for LLM Applications lists prompt injection and sensitive-information disclosure as leading risks a guardrail layer exists to contain.

Guardrails are a discipline, not a metric. You judge them against your own red-team and evaluation set: how many bad outputs they catch, and how few good ones they wrongly block.

What it hides: guardrails manufacture a feeling of safety that easily outruns their real coverage. A filter only catches the failure modes someone thought to write a rule or a test for, so novel jailbreaks, plausible-but-wrong policy answers, and confidently-cited-but-stale sources still slip through. Each layer also adds latency and false positives; over-tuned guardrails block legitimate answers and quietly push the volume back to humans, so a bot that looks "100% safe" may just be one that has learned to refuse. Track escaped defects and false-block rate, not the number of guardrails you switched on.