What are AI guardrails?

AI guardrails are the checks and policies that keep an AI system inside the limits its builders set. In an LLM application, the term usually means runtime checks that inspect a user’s message, the model’s reply or an agent’s planned tool call, then allow it, block it, rewrite it or flag it for review. They run in your code, around the model, so they enforce your rules rather than only the model vendor’s.

Types of guardrails

A guardrail is defined by what it inspects and when it runs. The OWASP Top 10 for LLM Applications (2025) gives the risks each placement targets.

The frameworks name the placements differently. NVIDIA NeMo Guardrails has input, dialog, retrieval, execution and output rails. Amazon Bedrock Guardrails offers content filters, denied topics, word filters, sensitive information filters, contextual grounding checks and Automated Reasoning checks, applied to prompts and responses. OpenAI’s Agents SDK has input, output and tool guardrails, and its tool guardrails do not cover handoffs.

OWASP describes prompt injection as input that alters the model’s behavior “in unintended ways,” including instructions hidden in websites or files the model reads (LLM01:2025). Retrieved documents and tool results can carry injected instructions, so they need checks as well as the user’s message.

Rules, classifiers and LLM judges

Deterministic rules (regexes, keyword lists, schema validators, allowlists) are fast and predictable but match only what you anticipated. Model-based checks read meaning.

• Llama Guard is a Meta model tuned to classify prompts and responses against a safety taxonomy. The current version, Llama Guard 4 12B (April 2025), also classifies images. The previous version, Llama Guard 3 8B, predicted labels for 14 hazard categories.
• OpenAI’s open-weight gpt-oss-safeguard models (October 2025) read a developer-written policy at inference time, so the policy changes without retraining.
• The moderation endpoint is free and scores text and image inputs, and can score generated output too.

Vendor safety training is a separate layer. It targets content that is harmful in general, so limits specific to your product, such as staying on topic, need a check in your application.

Blocking checks and scoring checks

A blocking check sits in the request path and can stop a request. A scoring check runs after the fact and raises an alert. The choice follows the cost of a miss: a card number reaching the model or an agent moving money has to be blocked, while tone or answer quality can be scored.

Blocking checks differ in how much latency they add:

• Bedrock evaluates the input against each configured policy in parallel “for improved latency”, and discards the model call if the input is blocked.
• The Agents SDK runs input guardrails in parallel with the agent by default, which gives the lowest latency but means the agent “may have already consumed tokens and executed tools” before it is cancelled. Blocking mode stops the agent before it starts, at the cost of added latency. Output guardrails always run after the agent finishes.
• A cascade runs a cheap check on everything and sends only flagged cases to a costlier one. Anthropic’s next-generation Constitutional Classifiers (Jan 9, 2026) use this shape: a linear probe screens all traffic and escalates flagged exchanges to a probe-classifier ensemble for the final judgment.

Latency and false positives in published numbers

Primary sources report few numbers, and they are not comparable across vendors. Public as of 2026-10-30:

These come from each vendor’s own test sets. Test any guardrail on your own traffic before you rely on its published rate. Bedrock’s docs say the same about their safeguards, whose underlying models AWS updates automatically.

Guidance from standards bodies

The OWASP Top 10 for LLM Applications (2025) lists ten risks, from prompt injection (LLM01) to unbounded consumption (LLM10). Use it as a checklist for which placements you need.

The NIST AI RMF is a voluntary framework released January 26, 2023, with a Generative AI Profile (NIST-AI-600-1) released July 26, 2024. It sets risk management goals and does not prescribe runtime checks.

For how guardrail results fit with the rest of your monitoring, see LLM monitoring and agent observability.

Tracking guardrail decisions in HoneyHive

Blocking happens in your guardrail code. HoneyHive records each decision on the trace so you can see what fired and why. The custom metrics guide says guardrails such as safety checks and PII detection are ideal to compute client-side with enrich_span(metrics=...). Log guardrail_blocked as 0 or 1 with the guardrail’s name in metadata, then set an alert on the average so a jump in blocks reaches your team. Checks that only score can run as online evaluations, which run asynchronously after ingestion and add no latency to your app.

With a coding agent, install the honeyhive-instrument skill (setup) and paste:

Use the honeyhive-instrument skill to trace this app. In every function that runs a
guardrail, call enrich_span with metrics guardrail_blocked (0 or 1) and metadata for
the guardrail name and the rule or policy that fired. Do not change what the guardrails block.

FAQ

Does ChatGPT have guardrails?

Yes. OpenAI trains its models to follow a published Model Spec that sets red-line principles, a section on specific risks and an order of authority between OpenAI, developers and users. Developers who build on the API can add their own checks on top, such as the free moderation endpoint, which classifies harmful text and images.

Are there any AI models with no guardrails?

Open-weight models can be downloaded and run with no application-level guardrails at all. They still carry the safety tuning their developers trained in, but that tuning is easy to wear down: one study removed GPT-3.5 Turbo's refusals by fine-tuning it on 10 adversarial examples for under $0.20, and found that fine-tuning on ordinary benign data also weakened safety, to a lesser degree (Qi et al., 2023). If you fine-tune or self-host a model, plan to add your own input and output checks.

What are the top 3 AI security risks?

For LLM applications, the OWASP Top 10 for LLM Applications (2025) ranks prompt injection first, sensitive information disclosure second and supply chain risks (compromised models, datasets or packages) third. Input and output guardrails address the first two directly. Supply chain risk is handled outside the request path, by vetting and pinning the models and libraries you depend on.