# What is AI Guardrails?

Also called Guardrails, AI Safety Rails, LLM Guardrails.

AI guardrails are controls placed around a language model that constrain what reaches it and what it is permitted to produce or do. They run outside the model itself, using classifiers, rules, allow lists, schema validation, and policy checks at the input, retrieval, output, and tool layers. Guardrails complement training-time safety rather than replacing it.

A language model is probabilistic, so its behavior cannot be guaranteed by instruction alone. Guardrails add deterministic checks around the probabilistic core: a filter that rejects an unsafe request before inference, a validator that rejects malformed output after inference, an allow list that limits which tools can be called, and a permission check that runs before any action touches a real system.

Guardrail layers are usually named by position. Input rails inspect the incoming message. Retrieval rails inspect documents and web content fetched into context. Output rails inspect the generated response before it is shown or sent. Execution rails sit in front of tools and APIs, deciding whether a requested action is allowed, needs approval, or must be refused outright.

Guardrails are configured against a written policy, not invented per request. That policy states which topics are in scope, which data categories may leave the system, which actions are irreversible, and what happens on failure. Failing closed, meaning blocking when a check errors or times out, is the safer default for consequential actions, though it trades availability for safety.

No guardrail set is complete. Classifiers produce false positives and false negatives, rules miss novel phrasings, and attackers adapt. The practical goal is defense in depth, where a single bypassed control does not lead to harm because a second independent control still stands between the model and the consequence.

## Key points

- Deterministic controls wrapped around a probabilistic model
- Layers: input, retrieval, output, and tool execution
- Configured from a written policy, not improvised
- Complement training-time alignment, do not replace it
- Defense in depth, since every single control can be bypassed

## In practice

An assistant that answers billing questions is given guardrails at four points. An input classifier flags requests for legal advice and routes them to a disclaimer. A retrieval rail strips documents outside the requesting account. An output rail scans the draft reply for account numbers and blocks any that appear. An execution rail allows read-only lookups automatically but holds refunds for human approval.

## Related terms

- [Input Safety](/en/glossary/input-safety)
- [Output Safety](/en/glossary/output-safety)
- [Content Moderation](/en/glossary/content-moderation)
- [Approval Gateway](/en/glossary/approval-gateway)
- [Prompt Injection](/en/glossary/prompt-injection)

[Back to the AI Glossary](/en/glossary)