What are AI guardrails? Definition and examples
On this page
Guardrails are checks placed around an AI model that limit what it accepts, says and does, so its behavior stays inside rules the business has set.
How it works
A language model follows instructions most of the time, not all of the time. Guardrails add checks that do not depend on the model agreeing to behave. They usually sit at four points:
- Instructions. The system promptA system prompt is the set of instructions an application gives a language model before a conversation starts: its role, rules, tone and what it must not do. states the rules. This is the softest layer: useful, but a model can be talked out of it.
- Input checks. Before the model answers, a check screens the message: off-topic requests, personal data that should not be stored, or attempts at prompt injectionPrompt injection is when text an AI model reads, typed by a user or hidden in a page or file, overrides its instructions and changes what it says or does..
- Output checks. Before the answer is shown, a check confirms it is supported by the sources, avoids forbidden claims and fits the format.
- Action checks. Before a tool runs, such as booking a meeting or updating a record, ordinary code verifies the request is allowed.
OpenAI's Agents SDK names these layers directly: input guardrails, output guardrails and tool guardrails. When a check fails, it trips a "tripwire" that halts the agent's run, and the documentation suggests running checks "with a fast/cheap model" (OpenAI).
OWASP's guidance is to "implement a system of guardrails outside of the LLM itself" and says permission checks "must not be delegated to the LLM"; they should run in a "deterministic, auditable manner" (OWASP).
Why it matters for your website
An assistant on your website speaks for your business. The risky moments are predictable: quoting a price that is not on the site, promising a discount, giving legal or medical advice, mishandling personal data, or taking an action the visitor was not entitled to.
Guardrails for answers also reduce hallucinationAn AI hallucination is a fluent, confident answer from a language model that is false or unsupported, such as an invented price, policy or citation.. Anthropic's documentation lists simple ones: let the model say "I don't know", restrict it to the provided documents, and verify each claim against a quote or citation. It adds that these techniques reduce hallucinations but "don't eliminate them entirely" (Claude docs). That is why a good assistant also offers a human handoffHuman handoff is when an AI agent passes a conversation to a person, with the transcript and key details, because the visitor asked or the AI reached a limit..
Example
| Rule | Where it is enforced |
|---|---|
| Answer only from the site's pages | Instructions, plus an output check that every answer cites a retrieved passage |
| No discounts or custom terms | Instructions, plus an output check for price and discount wording |
| No legal, tax or medical advice | Input check that routes these questions to a human |
| Book meetings only for real slots | Action check in code against the calendar |
| Never reveal other visitors' data | Access control in code; the model never receives that data |
The pattern: the model is told the rule, and something that is not the model makes sure.
Related terms
- System prompt: where the rules are first stated.
- Prompt injection: the main way instructions get bypassed.
- Hallucination: confident answers with no support.
- Grounding: tying answers to sources.
- Human handoff: the fallback when the AI should stop.
Sources
- Guardrails (OpenAI Agents SDK documentation) — accessed October 21, 2026
- LLM07:2025 System Prompt Leakage (OWASP Gen AI Security Project) — accessed October 21, 2026
- Reduce hallucinations (Claude documentation) — accessed October 21, 2026