Quick answer
Guardrails are the rules, filters, and checks wrapped around an AI system to keep its behaviour within safe, intended limits — separate from whatever safety training the underlying model already has. They typically sit at three points: before a prompt reaches the model, while the model decides what tool to use, and after the model responds. Guardrails reliably catch known failure patterns but, like the models they wrap, are not foolproof against novel attacks or edge cases nobody anticipated.
A chatbot company building on top of GPT-5.6 or Claude Opus 4.8 does not just trust the raw model to behave. It wraps the model in its own extra layer of rules — because a general-purpose model needs to be shaped into "this specific company's customer support assistant, which never discusses competitors and never gives financial advice."
The three places guardrails sit
- Input filtering — blocking or flagging a user's message before it even reaches the model (profanity, personal data, known attack patterns)
- Action limits — stopping an agent from taking a destructive or out-of-scope action, like refusing to let a support bot issue refunds above a threshold
- Output filtering — checking the model's response against a policy before it ever reaches the user, catching things the model itself missed
What guardrails are built from
In practice this is a mix of simple rule-based filters (block certain words, redact patterns that look like a credit card number), smaller classifier models trained specifically to spot policy violations, and sometimes a second full LLM call that reviews the first model's answer before it ships. Products like Guardrails AI, NeMo Guardrails, and Lakera package this as a standalone layer that can sit in front of any underlying model.
Guardrails are a separate layer from the model's own training — you can swap the underlying model and keep the same guardrails, or vice versa.
Where they fail
Guardrails are pattern-matchers at heart, and pattern-matchers miss novel patterns. A jailbreak phrased in a way nobody has tried before, or an indirect prompt injection buried in a webpage, can slip past filters tuned on known attack styles. Companies treat guardrails as one layer of defence, not a guarantee — the honest framing every serious AI safety team uses.
Related reading
Bottom line
Guardrails are why most production AI products don't say obviously terrible things, most of the time. They are not a solved problem — they are ongoing maintenance, patched continuously as new failure modes turn up in the wild.
