Guardrails

Because a language model is probabilistic, system prompt instructions such as 'Never mention competitors or reveal personal data' are polite suggestions rather than hard engineering guarantees. Guardrails wrap the model call inside a deterministic and statistical enforcement pipeline that inspects traffic at three checkpoints: input rails (before the prompt hits the LLM), tool/execution rails (before an agent invokes an external function), and output rails (before the completion reaches the user).

Input rails run fast checks such as PII detection and masking (replacing UK National Insurance numbers, NHS numbers, and credit cards with placeholders), topic classification to reject off-domain requests, and prompt-injection heuristics. Tool rails verify that agent function calls respect RBAC permissions, spend caps, and parameter allowlists. Output rails enforce JSON Schema grammar, check groundedness against retrieved RAG passages, strip hallucinated URLs, and block toxic or regulated financial-advice statements.

For instance, a UK retail bank runs a two-stage guardrail pipeline on its customer chat assistant: sub-10ms regex and Microsoft Presidio NER checks scrub sort codes and account numbers on ingress, while a lightweight classifier model verifies on egress that no response contains unregulated mortgage recommendations.

Guardrails separate a fragile prototype from an enterprise-grade system that security and compliance officers can sign off. They provide defence in depth: even if a base model update changes tone or a user crafts a clever adversarial prompt, independent output and tool rails prevent data leakage, brand damage, or unauthorised API mutations.

The engineering trade-off is latency and false-positive friction. Stacking three heavy LLM-based guardrail checks onto every turn can add two seconds of latency, double token costs, and frustrate legitimate users when overly aggressive topic filters block valid questions. Teams should push as many checks as possible into zero-latency deterministic rails (JSON Schema constrained decoding, regex validators, and code assertions) and reserve neural guardrail models for nuanced semantic policies.