guardrails
Software checks placed around an AI model that screen what goes into it and what comes out, and block or alter anything that breaks set rules.
- A topic rule that stops a support bot from discussing the weather
- A classifier that screens prompts and replies for harmful content
- A filter that redacts personal details from a model’s reply
- A check that halts an agent asked for math homework help
- Current meaning
- 2023
- Open-source toolkits add software checks around model inputs and outputs.
- Also called
- Safeguards
- Merriam-Webster’s synonym. Meta calls Llama Guard a safeguard model.
In plain words
In AI, guardrails are checks placed around a model that stop harmful or off-limits requests and replies without changing the model itself.
A large language model can be asked almost anything, and it can be talked into replies its maker never intended. Guardrails are the checks a company places around the model to keep it in bounds. One check reads each request before the model does. Another reads each reply before the user sees it. Merriam-Webster lists this AI sense of the word.1
The checks sit outside the model for a reason. A jailbreak or a prompt injection can talk a model out of its instructions. A separate check does not depend on the model’s cooperation. NVIDIA researchers distinguish rules trained into a model from rules added around it while it runs, which work with any model.2
In everyday use the word is looser. Engineers mean software such as NVIDIA’s NeMo Guardrails or Guardrails for Amazon Bedrock. Researchers and reporters also use it for the refusals a model learns in training. In 2023, researchers undid those in GPT-3.5 Turbo by fine-tuning it on 10 examples, for less than $0.20. Lawmakers use it for rules on how AI is developed and deployed.
Guardrails are not a complete defense. A 2025 study showed that guardrail systems built to catch jailbreaks and prompt injections can be evaded. They can also stop legitimate work. In 2026, security researchers complained that Anthropic’s Fable model refused tasks as ordinary as a code review.3
Guardrails are often mistaken for alignment, the training that shapes a model’s own behavior. They also differ from a system prompt, an instruction the model reads and may not follow.
How it works
A guardrail sits between the application and the model. Guardrails for Amazon Bedrock, for example, screens everything passing into and out of the model. When it blocks something, it answers with a message the operator has written.4
Input checks run first. They look for banned topics, attempts to override the model’s instructions, or personal data that should not reach the model. Output checks run on the reply before anyone sees it. They can block the reply or strip out details such as a phone number.
The checks take several forms. Some are fixed rules, such as word lists or text patterns set by the operator. Some are classifiers, models trained to label text as safe or unsafe. Meta’s Llama Guard labels both prompts and responses. Some pass the request to a second, cheaper model for a verdict. In OpenAI’s Agents SDK, a failed check trips a wire that halts the agent.5
Each check adds cost, and each can err in both directions: blocking safe requests or missing harmful ones. Against 10,000 synthetic jailbreaks, Anthropic’s input and output classifiers cut the success rate from 86% to 4.4%. Compute cost rose 23.7%.6
Origin and first known use
A compound of guard and rail. Merriam-Webster dates guardrail, a railing that protects people, for instance from falling, to 1860. Its plural sense covers any protection against something undesirable. An early AI use applied it to limits on the industry itself: in 2019 Microsoft president Brad Smith urged tech companies to adopt guardrails. In 2023 two open-source toolkits, Guardrails AI and then NVIDIA’s NeMo Guardrails, made it a name for software that checks a model’s inputs and outputs. Policy writing kept the broader sense of rules on how AI is built.
- 1860 Merriam-Webster’s first known use of guardrail, a railing that protects, as by stopping people from falling.Merriam-Webster, “guardrail” merriam-webster.com →: source for 1860
- 2019 Discussing AI ethics on NPR, Microsoft president Brad Smith proposes a motto for tech companies that ends: “Put guardrails in place, and think about society.”NPR, “Microsoft President Brad Smith Discusses The Ethics Of Artificial Intelligence”, All Tech Considered, 2019 npr.org →: source for 2019
- 2023 Shreya Rajpal releases Guardrails, an open-source Python package for checking and fixing what large language models produce, summarized as “Adding guardrails to large language models.”Shreya Rajpal, guardrails-ai 0.1.0, Python Package Index, 13 Mar 2023 pypi.org →: source for 2023
- 2023 NVIDIA releases NeMo Guardrails, open-source software with three kinds: topical guardrails keep a bot on subject, safety guardrails filter unwanted language, security guardrails limit outside connections.Jonathan Cohen, “Right on Track: NVIDIA Open-Source Software Helps Developers Add Guardrails to AI Chatbots”, NVIDIA blog, 25 Apr 2023 blogs.nvidia.com →: source for 2023
- 2023 Meta researchers release Llama Guard, an “input-output safeguard” model that classifies prompts and responses, and report it matching or beating existing content moderation tools.Inan et al., “Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations” arXiv 2312.06674 →: source for 2023
- 2023 Announcing the AI Act deal, the European Parliament files its rules for general-purpose AI under the heading “Guardrails for general artificial intelligence systems”.European Parliament, “Artificial Intelligence Act: deal on comprehensive rules for trustworthy AI”, press release europarl.europa.eu →: source for 2023
- 2024 Amazon makes Guardrails for Amazon Bedrock generally available after a preview at re:Invent 2023. It screens inputs and outputs against topic, content, word and personal-data policies.Esra Kayabali, “Guardrails for Amazon Bedrock now available with new safety filters and privacy controls”, AWS News Blog, 23 Apr 2024 aws.amazon.com →: source for 2024
- 2025 OpenAI’s new Agents SDK builds in guardrails: configurable checks on what users send in and what agents send back.OpenAI, “New tools for building agents”, 11 Mar 2025 openai.com →: source for 2025
In the wild
-
“Topical guardrails prevent apps from veering off into undesired areas.”
-
“Without guardrails in place regulating how AI is developed, audited, and deployed… we risk living in a total free for all, which nobody wants.”
Chuck Schumer, Senate majority leader, remarks at CSIS democrats.senate.gov →: Chuck Schumer, Senate majority leader, remarks at CSIS, 21 Jun 2023Archived →: copy of Chuck Schumer, Senate majority leader, remarks at CSIS, 21 Jun 2023 -
“…we jailbreak GPT-3.5 Turbo’s safety guardrails by fine-tuning it on only 10 such examples at a cost of less than $0.20 via OpenAI’s APIs…”
-
“Regularly review security and safety guardrails, especially if the GAI system is being operated in novel circumstances.”
NIST, Generative AI Profile (NIST AI 600-1) nist.gov →: NIST, Generative AI Profile (NIST AI 600-1), 26 Jul 2024Archived →: copy of NIST, Generative AI Profile (NIST AI 600-1), 26 Jul 2024 -
“Guardrails: Configurable safety checks for input and output validation.”
OpenAI, product announcement openai.com →: OpenAI, product announcement, 11 Mar 2025Archived →: copy of OpenAI, product announcement, 11 Mar 2025 -
“Large Language Models (LLMs) guardrail systems are designed to protect against prompt injection and jailbreak attacks. However, they remain vulnerable to evasion techniques.”
-
“Plenty of vendors will sell you “guardrail” products that claim to be able to detect and prevent these attacks.”
-
“Cybersecurity researchers aren’t happy about the guardrails on Anthropic’s Fable”
-
“Abliteration.ai is making a business out of removing AI guardrails”
Not to be confused with
-
Alignment
Alignment shapes the model’s own behavior through training, so its effects live in the weights. Guardrails, in the strict sense, are separate checks that run around the model and can change without retraining it.
-
System prompt
A system prompt is an instruction the model reads alongside everything else it is given, and a jailbreak can override it. A guardrail is a separate check that acts whether or not the model complies.
-
Content moderation
Content moderation reviews what people post on a platform. AI guardrails borrow its tools, such as harmful-content classifiers, but apply them to the prompts a model receives and the replies it writes.
Questions
What are AI guardrails?
AI guardrails are software checks placed around a language model. Input checks screen a request before the model sees it, and output checks screen the reply before a user does. A check can block the text, strip out personal details or halt an agent. Examples include NVIDIA’s NeMo Guardrails, Guardrails for Amazon Bedrock, Meta’s Llama Guard and the guardrails in OpenAI’s Agents SDK.
What is the difference between guardrails and alignment?
Alignment is training that shapes how the model itself behaves, so its effects live in the weights. Guardrails in the strict sense run outside the model and work with any model. Everyday use blurs the two. Reporters often call a model’s trained refusals its guardrails, and in 2023 researchers undid those in GPT-3.5 Turbo by fine-tuning it on 10 examples.
Can AI guardrails be bypassed?
Yes. A 2025 study showed that guardrail systems built to detect jailbreaks and prompt injections can be evaded. Against 10,000 synthetic jailbreaks, Anthropic’s input and output classifiers cut the success rate from 86% to 4.4%, which is lower but not zero. Simon Willison has warned about vendors selling guardrail products that claim to detect and prevent prompt injection attacks.
Can guardrails block legitimate requests?
Yes. A check tuned to catch harmful requests can also stop safe ones. In June 2026, security researchers complained that Anthropic’s Fable model refused tasks only loosely tied to cybersecurity, such as reviewing code. Anthropic had earlier reported that a prototype of its classifier system over-refused, and that a later version raised refusals on real traffic by 0.38%.
Why do lawmakers talk about AI guardrails?
In policy, guardrails means rules on how AI is built and used rather than software filters. In June 2023, Senate majority leader Chuck Schumer warned that AI without guardrails on how it is developed, audited and deployed would be a free-for-all. The European Parliament’s announcement of the AI Act deal that year filed rules for general-purpose AI under the same word.
Watch
Cite this entry
“Guardrails.” SUPERR_dictionary, Superrduperr, 24 Sept. 2026, superrduperr.com/
Superrduperr. (2026, September 24). Guardrails. In SUPERR_dictionary. https://superrduperr.com/
Superrduperr. “Guardrails.” SUPERR_dictionary. September 24, 2026. https://superrduperr.com/