For Heads-of · Practitioner
Guardrails
Also known as: AI guardrails · LLM guardrails
Runtime checks on an AI system's inputs and outputs, such as classifiers, filters and policy rules, that block, modify or flag content before it reaches the model or after it leaves. They reduce risk, but they are probabilistic: a guardrail is a layer of defence, not a security boundary.
- guardrails
- LLM firewall
- AI gateway
- content filtering
- output validation
What they do
Input guardrails screen what reaches the model: injection attempts, prohibited topics, personal data that should not be sent to a provider. Output guardrails screen what comes back: harmful content, leaked data, malformed output, claims that fail a check. Many guardrails are themselves models, which is why they share the weaknesses of the models they protect.
What they do not do
A guardrail that catches 99% of attacks still lets the rest through, and an attacker can try as often as they like. Where an output could cause irreversible harm, the protection has to be deterministic: least privilege on what the system can do, structural validation of what it produces, and human confirmation before it acts. Guardrails are also sold under names such as LLM firewall and AI gateway; the function is the same.
Where it sits in the register
The control is output validation and guardrails, which pairs probabilistic filtering with deterministic checks. It addresses improper output handling and reduces, without eliminating, prompt injection.
Sources
Related Terms
Hallucination
Output that is fluent, confident and false. It arises from the same mechanism that produces correct output (a model predicting plausible continuations), which is why it is best understood as a property of the technology to be bounded rather than a defect to be fixed.
Jailbreak
A technique for inducing a language model to produce output that its safety training was intended to refuse. It targets the model's alignment rather than any particular application, and works substantially the same way wherever that model is deployed.
OWASP Top 10 for LLM Applications
The OWASP GenAI Security Project's ranked list of the ten most critical security risks in applications built on large language models. The 2026 edition, published in August 2026, is the closest thing the field has to a shared vocabulary for LLM application security, and every item on it maps to an entry in this site's risk register.
Prompt Injection
An attack in which untrusted content reaching a language model is interpreted as instructions rather than data, causing the model to act on an attacker's intent instead of the operator's. It is a property of how the application assembles its context, not a flaw in any particular model.