Guardrails: how we keep an AI system from saying the wrong thing

The short answer

Any AI system will occasionally produce something wrong, off-topic or harmful: a price that does not exist, a refund it had no authority to promise, a paragraph of medical advice on a plumber’s website. Guardrails are the layers around the model that catch those cases before a customer sees them. They are not instructions inside the prompt, though the prompt is the first layer. They are checks on the input, grounding in your documents, validation of the output, limits on what the system may do, escalation to a person, and logging of everything that fired. Designed against the specific failures that matter to your business, they turn a clever demo into something people can rely on.

The layers

Layer	What it does	Example
Input checks	Screens what comes in: length, language, injection attempts, off-scope requests	A message that tries to override the instructions is flagged, not obeyed
Grounding	Requires answers about facts to come from retrieved documents	Prices and policies are quoted from the source or not at all
Scope limits	Defines what the assistant may discuss and what it must decline	Legal, medical and financial questions get a polite redirect
Output validation	Checks the answer against rules before it is shown	No numbers that do not appear in the sources; no promises from a forbidden list; no personal data echoed
Action allow-list	Restricts what the system can do, not just say	It can draft a refund request; it cannot issue a refund
Escalation	Routes low confidence, high stakes or repeated failure to a person	An angry customer or an unusual request goes to a human
Logging	Records inputs, outputs, sources and every guardrail that fired	The weekly review sees what was caught and what slipped

Designing against your own failures

What it looks like in a live system

A customer asks about a return. The input check passes. Retrieval finds the return policy. The model drafts an answer grounded in it, citing the clause. Output validation confirms every date and amount appears in the policy text. The answer is shown. A second customer asks whether they can have a refund outside the policy. Grounding finds no basis; the scope rule identifies a commitment; the case is escalated to a person with the draft and the context. Both interactions are logged. Neither embarrasses anyone.

What this means for you

Expect any AI system to fail sometimes, and build so that the failures are caught before they reach anyone. Input checks, grounding, scope limits, output validation, action allow-lists, escalation and logging, each chosen against the specific failures that would hurt your business. The prompt is layer one. The rest is what makes the system safe to rely on, and it is what separates the assistants that stay in service from the ones quietly switched off after the first incident.