In brief
- Filters can detect categories such as violence, personal data, denied topics or prompt attacks.
- Thresholds always trade missed risks against legitimate cases that are blocked incorrectly.
- Guardrails must be adapted and tested for the task, language, audience and impact of errors.
- Deterministic permissions, business rules and approvals remain necessary.
Which kinds of guardrail exist?
The term covers different controls along the data flow. Some classify content probabilistically; others validate exact patterns, schemas or business rules. Their effect and limitations should be documented separately.
| Guardrail type | Detects or prevents | Typical example | Does not guarantee |
|---|---|---|---|
| Probabilistic content filter | Likely categories such as violence, sensitive data or prompt attacks. | Flag or block output that may contain an account number. | Complete detection; multilingual and novel variants can pass through. |
| Grounding and source check | Answers without sufficient evidence or inconsistent with a retrieved passage. | Visibly refuse a policy answer that has no valid source. | That the source itself is current, complete or professionally correct. |
| Schema and value validation | Invalid formats, prohibited values and missing required fields deterministically. | Stop a payment with an invalid currency or amount above a threshold. | That a formally valid value is appropriate or authorised. |
| Authorisation and business rule | Actions beyond the user's role, destination system or permitted process. | Read only approved contracts and create drafts only for internal recipients. | That the preceding model output is factually correct. |
| Human approval | Consequential or hard-to-reverse actions before execution. | Have an authorised person confirm a bank change or external contract response. | Effective oversight if context, time or decision authority are missing. |
Where should controls sit in the workflow?
A filter only before the model is not enough. Untrusted documents may arrive later through retrieval or tools, and problematic output may become visible only in a planned action. Protection needs several checkpoints.
- Step 1
Before processing
Check user input, files and external content for known risks.
- Step 2
After retrieval and tools
Treat returned content as untrusted and confirm permissions.
- Step 3
After model output
Check the response for sensitive data, denied content and grounding.
- Step 4
Before an action
Enforce parameters, business rules and approvals deterministically.
What are the limits of filters?
Classifiers can block legitimate content or miss risky variants. Language, dialect, code, images and context change detection. A blocked text also says nothing about whether data access or tool permissions are configured correctly.
- False positives disrupt legitimate workflows
- False negatives leave risks undetected
- Supported languages and modalities vary by service
- New bypasses require ongoing tests and adaptation
- Filter results are signals, not a final risk assessment
How should guardrails be operated?
Thresholds must be calibrated on real cases. The team measures not only block rates but which legitimate cases are affected and which critical attacks pass. Changes are versioned and protected by regression testing.
- Separate test sets for normal use, edge cases and attacks
- Minimum requirements for each risk and user group
- A visible and helpful response to blocking or uncertainty
- Monitoring of bypasses, false alarms and human overrides
- Clear ownership of rules, release and exceptions
Example: an internal writing assistant
A writing assistant checks input for personal data and output for confidential labels. A legal term is legitimate for the Legal team but blocked in a public chat. The teams test English, German and French separately. A filter finding prevents publication but does not replace documented approval by an accountable person.
What to remember
Use guardrails as measurable defence layers at several points. For each filter, define the risk it reduces, the errors it may make and the independent control that contains remaining impact.
Sources and further reading
These primary sources provide further detail on definitions, technical foundations or responsible use.
Content reviewed