AI Guardrails

General definition

AI Guardrails are the layer of checks that sits between users, a large language model and the systems the model can reach. The model itself is probabilistic and will follow whatever text reaches it, so guardrails enforce policy from the outside: they inspect what goes in, what comes out and what the model is permitted to do in between. Guardrails do not replace a well written system prompt; they catch the cases where the prompt is ignored, overridden or simply not enough.

• Input guardrails: topic restriction, prompt injection and jailbreak detection, and blocking of PII and PHI before it reaches a third-party model
• Output guardrails: toxicity and harassment filters, refusal of off-policy answers, checks that an answer is grounded in the retrieved sources, and redaction of secrets or personal data in the reply
• Tool and action guardrails: an allowlist of tools, scoped credentials, limits on how many actions an agent can take, and human approval for consequential steps
• Operational guardrails: rate limits, token budgets, timeouts and logging, so a runaway loop is stopped and can be audited afterwards

Guardrails are implemented in several ways, usually combined. Deterministic rules (regular expressions, keyword lists, schema validation) are cheap and predictable. Classifier models score text for toxicity, PII or intent. A second LLM can judge whether an answer breaks policy. Model providers offer hosted moderation endpoints. Open-source frameworks such as NVIDIA NeMo Guardrails and Guardrails AI package these techniques as configurable pipelines. Each layer trades latency and cost for coverage, so most teams apply fast rules to every message and reserve model-based checks for the cases that need them.

Guardrails reduce risk; they do not eliminate it. Attackers iterate, filters have false positives that frustrate legitimate users, and a check that runs after the model has already sent data to an external API is too late for privacy purposes. Treat guardrails as one part of a defence in depth that also includes least-privilege tool access, grounding to limit hallucination, evaluation before release and monitoring in production.

In the Ethora ecosystem

Ethora applies guardrails at the messaging layer rather than only inside the model call. The Trust and Safety (TnS) system inspects messages in a room using stop words, regular expressions and AI auto-moderation, and can block, censor, quarantine and report, or report only. Because it works on messages, it covers what people send to an AI agent and what the agent sends back, and it can remove accidentally shared sensitive data immediately or after a delay, with reports delivered to your systems via message bus, API or email.

On the agent side, the AI SDK gives every agent its own system prompt and model choice, so policy is written per agent rather than globally, and tool calling is limited to the tools you attach to that agent. Multi-agent rooms have a response gate and an autonomous-turn cap so agents cannot loop indefinitely, and every exchange lands in the audit trail. Teams that must keep prompts and PHI inside their own perimeter can run the whole stack, model included, on a self-hosted LLM.