Adding Guardrails to AI Systems

Guardrails are the checks you put around an AI system to enforce constraints the model alone cannot be trusted to uphold consistently. They operate at two points: on the way in, validating and filtering user inputs before they reach the model; and on the way out, inspecting model outputs before they reach the user. Together they create a safety envelope around the model's probabilistic behavior.

Input guardrails

Input guardrails intercept the user's message before it reaches the model. Common checks include content classification (is this message within the scope the product is designed to handle?), toxicity detection (does it contain hateful or abusive language?), PII detection (does it include sensitive data that should not be sent to a third-party API?), and prompt injection detection (does it contain instructions trying to override the system prompt?).

def input_guardrail(user_message: str) -> str | None:
    """Returns None if the input passes, or an error message if it is blocked."""
    # Scope check
    if not is_on_topic(user_message):
        return "I can only help with questions about our product. Please try a different question."
    # PII detection
    if contains_pii(user_message):
        return "Please avoid sharing personal information like SSNs or credit card numbers."
    # Prompt injection heuristic
    if injection_score(user_message) > 0.85:
        return "Your message could not be processed. Please rephrase your question."
    return None  # pass

Output guardrails

Output guardrails inspect the model's response before it is shown to the user. They can check for policy violations (did the model produce advice it is not authorized to give?), factual grounding (does the response cite sources not present in the retrieved context?), format compliance (is the JSON output well-formed?), and toxicity (did the model produce harmful content despite instructions not to?).

Guardrail architecture

• Layer 1 — fast heuristics: regex patterns and keyword lists; microseconds, high recall, moderate precision
• Layer 2 — ML classifiers: fine-tuned text classifiers for toxicity, PII, off-topic; sub-100ms
• Layer 3 — LLM-based checks: a fast model judges the output against a policy; 200-500ms
• Fallback path: when any layer blocks, route to a safe default response or human review queue

Latency and cost tradeoffs

Every guardrail adds latency. A full stack with three layers can add 500 ms or more to response time, which is noticeable in interactive applications. Optimize by running input and output checks in parallel where possible, using fast classifiers for the common case and invoking the expensive LLM judge only when the cheaper layers signal ambiguity, and pre-computing embeddings for scope classification at session start rather than per message.