Guardrails are enforced outside the model rather than requested inside the prompt. Asking a model not to do something is a preference; withholding the ability to do it is a guarantee, and only the second survives an unexpected input.
In practice they are permission scopes, spending and volume limits, allowed recipients, and categories of action that always require approval. The useful test is whether the constraint still holds if the model is confidently wrong.
The design failure is putting them all in the system prompt. Prompt instructions are the right place for tone and judgement, and the wrong place for anything you would describe as a limit.
Read next
Frequently asked
What is the difference between a guardrail and a prompt instruction?
A prompt instruction asks the model to behave a certain way and depends on it complying. A guardrail is enforced by the surrounding system, so it holds whether or not the model cooperates. Anything that genuinely must not happen belongs in the second category.
What should always sit behind a guardrail?
Anything that spends money, contacts someone outside the business, deletes data, or touches regulated information. The common thread is that undoing it is impossible or embarrassing.
More from Agentic AI
All termsAI Agent
Software that decomposes a goal into multi-step actions, executes those actions across applications, and reports back, with optional human approval at each step.
ReadAgentic Workflow
A multi-step task an AI agent plans and executes, watching, reading, drafting, and acting, rather than answering a single prompt.
ReadHuman-in-the-Loop
A design where an AI agent drafts and proposes, but a person approves before consequential actions execute.
Read