What is Guardrail?
Governance & ControlA check on an agent's inputs, outputs, or actions that blocks or redirects unsafe behavior. The umbrella term; where a guardrail runs decides whether it is a control or a suggestion: inside the prompt it is decoration, at the tool boundary it is enforcement.
Why It Matters
Guardrail is the umbrella term the industry reaches for first, which is exactly why it needs unpacking: everything from a system-prompt sentence to a hardware-enforced sandbox gets called a guardrail, and the difference between them is the difference between a suggestion and a control. The Aegis evaluation quantified the gap: prompt-level guardrails recorded 79 violations in 6,300 actions, while runtime enforcement of the same policy recorded zero. A guardrail’s placement decides what it is worth.
Where a Guardrail Runs
In the prompt. An instruction the model is asked to respect. Cheap to write, impossible to enforce, and the first thing context compression or a hostile input pushes aside.
On the output. A check on what the model produced before it reaches the user: content filters, format validators, groundedness checks. Real enforcement, but only over text, and only after generation.
At the tool boundary. A check on the action itself before execution: the pre-action gate pattern. The only placement that governs what the agent does rather than what it says.
Where It Breaks
The term’s looseness is the failure mode. Teams report “we have guardrails” meaning a paragraph in the system prompt, and the claim survives until the first incident. Output guardrails have a subtler gap for agents specifically: they check the message, but an agent’s damage travels through tool calls, not prose, so a perfectly filtered answer can sit on top of an unfiltered action. Guardrails that matter for agents live at the action boundary or they live nowhere.
How Flytebit Handles It
We treat “guardrail” as a question about placement, not a feature: every check in the systems we ship declares where it runs, and action-affecting checks run at the tool boundary as policy-as-code, not in prompts. The placement argument and the numbers behind it are in Governing Agentic AI, and the engagement version is our AI governance and risk work.