What are LLM guardrails and where do they sit?

Guardrails are checks placed around the model, not inside it, at each point where something can go wrong. On the input side, I screen for prompt injection attempts and requests outside the product's scope, and redact personal data if it should not go to the model provider.

In the middle, the most effective guardrails are boring ones: retrieval only returns documents the user may see, tools run with the narrowest credentials, and every tool argument is validated in code. On the output side, I validate structure against a schema, run policy or safety classifiers, check that factual claims are supported by retrieved sources where that matters, and scan for leaked secrets or personal data. Finally, at the action layer, anything irreversible, such as payments, deletions or external messages, requires explicit approval.

Guardrails have costs. Each check adds latency, and strict classifiers block legitimate requests, which frustrates users. So I measure block rates and false positives on real traffic, review samples of blocked requests, and tune thresholds. No single layer is perfect, which is the reason for layering them.