The 30-second answer

Guardrails are the fence around the AI agent. They block the model from talking about topics it shouldn't (competitors, legal advice, medical claims), taking actions it shouldn't (issuing refunds above a threshold, changing account ownership), or skipping things it has to (regulatory disclosures, identity verification before an account action). Without them, every AI deployment is one bad customer prompt away from a problem that ends up in the press.

The three layers

A modern guardrail system has three checkpoints around the AI agent. Each catches a different failure.

  • Input filtering. Before the customer's message reaches the AI, a check runs: is this a prompt-injection attempt? Does it contain PII the AI shouldn't process? Is the customer asking about something off-policy (e.g. competitor pricing)? If yes, the system either rejects the message or routes it elsewhere.
  • Action limits. When the AI tries to do something — issue a refund, change an address, escalate a complaint — a separate check enforces the rules: refunds only up to $50; address changes only after identity verification; complaints about safety always go to a human. The check sits between the AI and the actual systems.
  • Output validation. Before the AI's reply reaches the customer, a final check runs: does it contain required disclosures? Does it commit to anything the AI doesn't have authority to commit to? Does it leak PII? If yes, the reply is rewritten or blocked.

Most vendors implement all three but call them different things. The architecture matters more than the labels.

What they prevent

  • Hallucinated promises. The AI can't refund $500 if action limits cap it at $50. The AI can't promise a 30-day return window if output validation requires the policy text be quoted verbatim.
  • PII leaks. If a customer asks for another customer's order details, the input filter or the action layer should refuse — and log the attempt.
  • Regulatory missteps. Financial services, insurance, healthcare all require specific language at specific moments. Guardrails enforce those; without them, the AI is one phrasing away from a compliance event.
  • Brand-safety problems. The AI won't recommend a competitor, won't discuss politics, won't crack jokes about a sensitive topic — because the input filter pre-empts those conversations.
  • Unauthorised actions. The AI can't cancel a subscription on behalf of someone who hasn't authenticated; can't change a delivery address without verification; can't issue store credit above a defined limit.

The trade-off

Every guardrail trades capability for safety. A heavily guarded agent is harder for legitimate customers to use — they hit "I can't help with that, let me transfer you" more often, even on questions the AI could safely answer. A loosely guarded agent is more capable but creates real risk.

The honest framing isn't "guardrails good, more is better." It's: guardrails should match the actual cost of getting it wrong. A B2C ecommerce agent handling order-status queries needs few guardrails. A B2B fintech agent that can move money needs many. Most teams over-guard in low-risk domains (and frustrate customers) while under-guarding in high-risk ones (and create blowups).

How vendors implement them

Three patterns, with different cost profiles:

  • Built-in to the agent platform. Intercom Fin, Decagon, Sierra, Ada all ship guardrail configuration as part of the product. Lowest setup cost, least flexibility.
  • Standalone guardrail layer. Products like NVIDIA NeMo Guardrails, Guardrails AI, or Lakera sit between your agent and the model. Use when you have multiple agents or custom builds.
  • Custom-built. Engineering team writes the rules. Most flexibility, highest maintenance cost. Common at companies with strong AI-platform teams (large fintechs, healthcare).

What to ask vendors

  • What are the default guardrails? What can be turned off, and by whom?
  • How do you handle prompt injection — show me a recent test.
  • What happens when a guardrail fires — does the customer see a graceful message or a system error?
  • Can guardrails be tuned per-topic (refund flow vs general FAQ) or are they global?
  • How are guardrail failures logged and reviewed?

A vendor that can't answer the first two specifically is selling you a model wrapper, not a production AI agent.