Guardrails or authorization? What secures AI agents
Whoever wants to secure AI agents quickly arrives at guardrails. They improve a model's behavior considerably but answer a different question than authorization. For actions with consequences, the difference is decisive.
Leutrim Miftaraj, Founder, Innopulse Consulting GmbH
Published
Key points
- Guardrails filter a model's inputs and outputs and work with probabilities.
- Authorization decides deterministically, outside the model, whether an action is allowed.
- Actions with consequences need authorization; guardrails complement it but do not replace it.
What this is about
Guardrails are protective mechanisms around a language model. They detect known attack patterns in inputs, block confidential data in outputs and keep the model on its intended use. They work with rules, classifiers or a second model and deliver probabilities.
Authorization decides whether a specific action is allowed: this payment, this order, this access. It happens outside the model, in a policy decision point, according to fixed rules and with a result that can be traced.
The comparison
| Feature | Guardrails | Authorization |
|---|---|---|
| Question | Is this content wanted? | Is this action allowed? |
| Location | Around the model | Outside the model, in the gateway |
| Method | Probabilities, patterns | Fixed rules, deterministic |
| Can be bypassed by | New wording, unknown patterns | Only by changing the rules or the mandate |
| Evidence | Filtering log | Signed decision, verifiable |
| Strength | Content, tone, data protection | Limits for money, contracts, rights |
When to use what
- Guardrails for everything the model says: harmful content, confidential data, topics outside the purpose.
- Authorization for everything the agent does that has consequences: payments, orders, changes to data and systems.
- Both in every production agent: guardrails reduce the number of problematic attempts, and authorization catches what gets through.
How the two work together
An attack through prompt injection has to clear two hurdles. First the guardrails, which detect many known patterns. If it still manages to bring the model to an action, authorization checks that action against the mandate. A payment above the limit fails there, no matter how convincing the instruction was. What the guardrails blocked also provides valuable indications of attack attempts.
Common misconceptions
- “Good guardrails make authorization unnecessary.” Guardrails reduce the risk but do not rule it out. A single successful bypass is enough for damage.
- “Authorization replaces guardrails.” It prevents unauthorized actions, but not unwanted statements or data leaking in answers.
- “A second model as checker is authorization.” A checking model also works with probabilities and can be influenced.
The role of KYA
KYA is not a guardrail. KYA verifies the evidence of authorization: mandate, decision and receipt. This makes it possible to show for every action whether it was allowed, regardless of how the model arrived at it. The article Prompt injection and authority offers background.
Decision guide in three questions
- Can the action affect money, contracts or rights? Then it needs authorization outside the model.
- Is it about content, tone or confidential data in answers? Then guardrails are the right tool.
- Must it later be proven that an action was allowed? Then a signed decision is needed.
Frequently asked questions
What is the difference between guardrails and authorization?
Guardrails filter content and influence the model's behavior with probabilities. Authorization decides deterministically whether a specific action is allowed.
Are guardrails enough to prevent prompt injection?
No. They detect many known patterns, but not all. Actions with consequences also need a check against clear limits outside the model.
Can a second model take over authorization?
Not reliably. A checking model can also be influenced. Authorization should rest on fixed rules.
Where does authorization sit in an agent architecture?
In a gateway in front of the tools and interfaces that has every action with consequences checked by a decision service before it is executed.
How do I prove that an action was authorized?
With a signed decision against a mandate and a receipt of execution. KYA verifies this evidence and shows the result in the certificate.
How much do guardrails and authorization cost in operation?
Guardrails add computing time per request, often through a second model. Authorization against a mandate is a fast, rule-based check and costs hardly any time per action.
What do I do with actions that guardrails blocked?
Analyze them. If blocks cluster around a topic or a source, this points to deliberate attack attempts.
Do small companies need both?
Yes, as soon as an agent carries out actions with consequences. To start, the platform's guardrails and a simple check against a mandate with a few limits are often enough.
Sources
- OWASP: LLM01 Prompt Injection: https://genai.owasp.org/llmrisk/llm01-prompt-injection/
- NIST SP 800-207: Zero Trust Architecture: https://csrc.nist.gov/pubs/sp/800/207/final