---
title: "Guardrails: definition | KYA glossary"
url: https://knowyouragent.ch/en/knowledge/glossary/guardrails
lang: en
updated: 2026-10-12
license: © Innopulse Consulting GmbH
---

# Guardrails

Guardrails are protective mechanisms around a language model that filter inputs and outputs, such as harmful content, confidential data or topics outside the intended use.

Guardrails sit in front of and behind the model. Input filters detect known attack patterns or sensitive data; output filters prevent the model from revealing confidential information or giving unwanted answers. They are implemented with rules, classifiers or a second model that evaluates the output.

Guardrails improve an agent's behavior but work with probabilities: a well-worded attack can bypass them. Actions with consequences therefore also need deterministic authorization that checks every action against clear limits.

## Example

A customer service agent has guardrails that block insults and the disclosure of customer data. A customer still talks it into a large credit, because her message contains no known attack pattern. Only the check against the mandate denies the credit.

## How it differs

Guardrails influence what a model says and does, with probabilities. Authorization decides deterministically whether an action is allowed. The page “Guardrails or authorization?” offers a detailed comparison.

## In practice

- Use guardrails for content and data protection, but not as the only limit for actions.
- Check actions with consequences deterministically against a mandate.
- Treat what guardrails block as an indication of attacks.

## Role in KYA

KYA is not a guardrail. KYA verifiably checks whether an action lay within the mandate, regardless of how the model arrived at it.

A term from the flow, not a check of its own. [To the method](https://knowyouragent.ch/en/method)

[Verify now: open a matching example](https://knowyouragent.ch/en/verify?beispiel=abgelehnt)

## Frequently asked questions

### What are guardrails?

Protective mechanisms around a language model that filter inputs and outputs, such as harmful content or confidential data.

### Are guardrails enough for secure AI agents?

Not for actions with consequences. Guardrails work with probabilities and can be bypassed. Actions also need deterministic authorization.

### How are guardrails implemented?

With rules, classifiers or a second model that evaluates inputs and outputs. Many platforms offer ready-made building blocks.

### What is the difference from a policy decision point?

A PDP decides about actions according to fixed rules. Guardrails assess content and influence the model's behavior.

### Is KYA a guardrail?

No. KYA verifies evidence and shows whether an action was allowed on someone's behalf. It filters no inputs or outputs.

### How do I test whether my guardrails work?

With targeted tests, known as red teaming, in which known and new attack patterns are tried. It is important to also check what happens when a guardrail is bypassed: then authorization must stop the action.

## Sources

- [OWASP: LLM01 Prompt Injection](https://genai.owasp.org/llmrisk/llm01-prompt-injection/)
- [NIST SP 800-207: Zero Trust Architecture](https://csrc.nist.gov/pubs/sp/800/207/final)

## Related terms

- [Prompt injection](https://knowyouragent.ch/en/knowledge/glossary/prompt-injection)
- [Policy decision point (PDP)](https://knowyouragent.ch/en/knowledge/glossary/policy-decision-point)
- [Tool poisoning](https://knowyouragent.ch/en/knowledge/glossary/tool-poisoning)
- [Agent mandate](https://knowyouragent.ch/en/knowledge/glossary/agent-mandate)

---
Quelle: https://knowyouragent.ch/en/knowledge/glossary/guardrails · KYA – Know Your Agent