Guardrail (Agent)
You can ask an agent nicely, in its system prompt, not to delete anything. A guardrail is what you build when asking is not enough: code outside the model that inspects what is about to happen and refuses it. The model can be talked out of an instruction. A guardrail does not negotiate, because it never reads intent — it checks facts about the input, the output, or the action.
Three places a guardrail sits
- On the way in — screening content before it reaches the model: instructions smuggled into a web page or a tool result, off-topic or abusive requests.
- On the way out — checking the response for leaked secrets, personal data, or claims the deployment is not permitted to make.
- Around the action — the strongest of the three: a tool allowlist, argument validation, a spend cap, a path restriction, a ceiling on the refund the agent can issue without a person.
Why the loop needs them
An agent's outputs are executed, not read, so a single bad step is a change in the world rather than a sentence to ignore. Guardrails make that tolerable — and they hold under prompt injection and jailbreaks precisely because they are not part of the conversation being manipulated. Implementations range from a regular expression to a classifier model to a policy engine; the OpenAI Agents SDK and NVIDIA's NeMo Guardrails both ship the pattern as a first-class component. Keep them distinct from sandboxing and permission scoping, which bound what the agent could ever reach: a guardrail judges each individual act inside those bounds.
A guardrail is an enforced constraint outside the model that inspects and can block what an agent receives, says or does — screening injected instructions in tool output, filtering sensitive data from responses, or validating a tool call against an allowlist, argument rules and spend limits. Unlike a prompt instruction, it cannot be argued with, which is why it holds under prompt injection. It judges individual actions, where sandboxing bounds reach.
A card that simply refuses payments over a set amount is more reliable than a promise to spend carefully. Guardrails are the same idea applied to AI that can act on its own.
You can write instructions telling the software what not to do, and most of the time it will listen. But instructions are just words, and words can be twisted — by a confusing situation, or by someone deliberately trying to trick it. A guardrail is a hard check sitting outside the AI: it looks at what is about to happen and stops it if it breaks a rule. No refunds above this much. Never touch these files. Nothing gets sent until a person signs off.