Agent guardrails
securityguardrails · AI guardrails · runtime guardrails
Controls that run in real time over what goes into an agent, what comes out, and what it's allowed to touch: they block, redact or stop the action before it reaches a user or a system.
A guardrail doesn't advise. It cuts. It sits in three places: on the input (validating the request, retrieved content and memory before the model reads them), on the output (blocking or redacting before text reaches anyone), and on the action (limiting which tools the agent can call, with which permissions, over which data). The practical difference from the rest of the security stack is timing. Evaluation tells you before you ship whether the agent is any good. Observability tells you afterwards what happened. The guardrail is the only thing that acts during. If your only defence lives in the system prompt, you don't have guardrails — you have a polite request.
How it differs from
- Agent governance
- Governance is the policy: who decides what an agent may do and who answers for it. The guardrail is that policy executed at runtime. Policy without guardrails is a document; guardrails without policy are a patch.
- Agent evaluation (evals)
- Evals measure quality against known cases, typically before deploy or in CI. Guardrails act on every real request, including the ones no eval anticipated.
- Human in the loop
- HITL puts a person inside the decision. A guardrail decides on its own, in milliseconds. Use both: the guardrail filters the volume and escalates to the human only what deserves judgement.
Examples
- Blocking an output containing personal data before it lands in the customer chat.
- Stopping a procurement agent from calling the payment tool above a threshold without human approval.
FAQ
- Do guardrails slow the agent down?
- They add latency, yes, and that's the price of not shipping a hallucination or leaking personal data. The expensive mistake isn't the slow guardrail — it's the irreversible action nobody intercepted.
- Isn't putting the rules in the system prompt enough?
- No. A prompt is an instruction the model can ignore and an injection can overwrite. A guardrail is code outside the model that applies even when the agent is compromised — which is exactly why it works.