Guardrail

What is a guardrail?

A guardrail is a control that constrains, validates, blocks, or escalates an AI agent's inputs, outputs, decisions, or actions. Guardrails reduce the chance that flexible model behavior causes unsafe, unauthorized, or low-quality outcomes.

They can operate before, during, or after an agent action.

Types of guardrails

Common guardrails include:

• input checks for malicious or prohibited requests;
• output validation for format, policy, or sensitive data;
• tool schemas and business-rule validation;
• permission and access-control checks;
• human approval for high-impact actions;
• spending, time, token, and retry limits;
• environment isolation and sandboxing;
• stopping or escalation conditions.

For example, an agent may draft a refund but application code blocks execution above a threshold until a human approves it.

Guardrail versus agent instructions

[Agent instructions](/glossary/agent-instructions/) tell the model how it should behave. A guardrail enforces or checks a boundary.

“Do not send email without approval” is an instruction. Preventing the send tool from executing without a valid approval token is a technical guardrail. Strong systems use both because a model can misunderstand or fail to follow text instructions.

Guardrail versus evaluation

Evaluation measures whether behavior met criteria. A guardrail intervenes in execution by allowing, rejecting, transforming, or escalating an operation.

Evaluation results can reveal where new guardrails are needed, while guardrail events become observability signals.

Limits and trade-offs

Guardrails can produce false positives, block legitimate work, or create a false sense of safety. A content classifier cannot replace authorization, and a schema cannot confirm that a user owns the specified account.

Controls should be layered according to impact and reversibility. Critical restrictions belong in deterministic code and permissions rather than relying only on model judgment.

Why it matters

Agents can take actions across real systems, so safety must extend beyond generated text. Guardrails bound autonomy and make sensitive behavior reviewable.

The goal is not to prevent every possible variation. It is to create enforceable limits, safe fallbacks, and clear escalation paths around the failures that matter most. See [Anatomy of an AI Agent](/anatomy-of-an-ai-agent/) for how guardrails fit with tools, state, and execution.