What are AI guardrails?
By Nick Jang, founder of MINERVA Studio ·
The short answer
AI guardrails are the checks that sit around an AI model and stop it from doing things it shouldn’t. Input guardrails screen what goes in (prompt injection, sensitive data, off-limits topics), output guardrails screen what comes out (harmful content, leaked personal information, answers not grounded in the source), and for agents, action guardrails decide which tools it may call, with what arguments, and when a person has to approve first. They’re mostly used to keep a system safe, on-topic and within policy while it runs. They reduce risk; they don’t remove it.
Why the model alone isn’t enough
A large language model is trained to be helpful, and training can make it refuse some requests, but it can’t know your business rules. It doesn’t know that your customer service bot mustn’t give investment advice, that account numbers must never appear in a reply, or that refunds over a limit need a supervisor. Guardrails carry those rules, outside the model, where they can be written down, tested and changed without retraining anything.
The kinds of guardrail
| Where | Guardrail | Example |
|---|---|---|
| Input | Prompt attack detection | Blocks “ignore your instructions and…” and instructions hidden in a document the model is asked to read. |
| Input | Topic restriction | A mortgage assistant declines questions about crypto trading. |
| Input and output | Sensitive information filter | Masks a social insurance number or card number before it reaches the model or the user. |
| Output | Content filter | Stops hateful, violent or otherwise harmful replies. |
| Output | Grounding check | Flags an answer that isn’t supported by the documents the system retrieved. |
| Output | Format and schema validation | Rejects output that isn’t valid JSON or is missing a required field before another system uses it. |
| Action | Tool permissions | An agent may read the CRM but not delete records, and may only call the payments tool below a set amount. |
| Action | Human approval | Payments, emails to customers and data deletion wait for a named person to approve. |
| Usage | Rate and cost limits | Caps requests per user and spend per session. |
Tools that provide them
Cloud providers build guardrails into their AI services. Amazon Bedrock Guardrails, for example, offers content filters, denied topics, word filters, sensitive information filters, contextual grounding checks and automated reasoning checks, and can be applied to any text through its own API. Microsoft and Google have equivalents.
There are open-source options too. NVIDIA’s NeMo Guardrails adds programmable rails to conversational applications, and Guardrails AI is a Python framework that validates inputs and outputs against rules you choose. AI gateways and security products sit between users and models and apply guardrails across many applications at once.
Under the hood, guardrails range from simple rules (a regular expression for card numbers) to classifiers (a model trained to spot prompt injection) to another LLM judging the first one’s output. Simple rules are predictable but narrow; model-based checks catch more but can be fooled and add delay. Singapore’s 2026 agentic AI framework makes a related point: a control built into the system’s structure, such as a tool the agent simply doesn’t have, is stronger than one written into a prompt.
Guardrails for AI agents
Agents raise the stakes because they act. A chatbot that says something wrong is embarrassing; an agent that sends a payment to the wrong account is a loss. Agent guardrails therefore focus on actions:
- Least privilege: give each agent only the tools and data it needs for its task.
- Per-call checks: evaluate every tool call against a policy before it runs, not just the conversation.
- Approval for what can’t be undone: hold irreversible or high-value actions for a person.
- Limits: caps on amounts, volumes and spend per session.
- A kill switch: a way to stop an agent at once, held by a named person.
- A record: every decision the guardrail made, permitted, refused or held, with the arguments.
The OWASP agentic top 10 is a good list of what these guard against.
What guardrails don’t do
Guardrails are one control, and attackers probe them constantly; red teaming regularly finds ways past them. They also don’t answer the governance questions: who approved this use of AI, who decided what the guardrail allows, who changed it last month, and whether anyone checked it still works. A guardrail with no owner and no history is a setting, not a control.
That’s the part MINERVA handles. An agent’s policy, what it may do and what must be held, is written as code, proposed and approved by someone other than the person who built the agent, enforced on every tool call, and recorded, so an examiner can see the rule, who decided it and what it did. See policy as code and agentic AI governance.
Related questions
What are AI guardrails primarily used for?
To keep an AI system safe and within policy while it runs: blocking harmful or off-topic inputs and outputs, protecting sensitive data, checking answers against sources, and for agents, limiting what actions they can take.
What is the difference between AI guardrails and AI governance?
Guardrails are runtime controls on a specific system. AI governance is the wider set of decisions and evidence: which AI is used for what, who approved it, what the guardrails allow, and whether they work.
What is Guardrails AI?
An open-source Python framework, also called Guardrails AI, for validating the inputs and outputs of large language models against rules, using validators that check things such as format, toxicity or sensitive data.
Can AI guardrails be bypassed?
Yes. Prompt injection and jailbreak techniques regularly get past model-based guardrails, which is why they are combined with structural limits such as restricted permissions, human approval and monitoring.
What are guardrails for AI agents?
Controls on what an agent may do: which tools it can call, with what arguments and limits, which actions need human approval, and a way to stop it, with each decision recorded.
Sources
- AWS — Amazon Bedrock Guardrails documentation
- NVIDIA — NeMo Guardrails
- Guardrails AI — open-source framework
- OWASP GenAI Security Project — Top 10 for LLM Applications (2025)
- IMDA — Model AI Governance Framework for Agentic AI (2026)
New answers are posted on MINERVA on LinkedIn. Follow along, or send the question you’d like answered next to minerva@minerva.studio.
A plain-language explanation, not legal advice. The regulator’s own text is the source; read it, and take advice on how it applies to your institution.