Mehmet EmrahKonyaTR
← Back to glossary

Guardrail

Koruma katmanı

D5

A guardrail is a defined control that constrains, checks, or routes AI-system input, output, tool use, or actions to reduce specified risks.

Review status: 2026-12-04

Technical explanation

Guardrails can include input and output checks, checks around custom function-tool invocation, and rules that route work to human review, selected for a stated risk and context.

Conceptual boundaries

A guardrail is not a guarantee of safety, truth, legal compliance, or prevention of every attack; its coverage and failure behavior must be evaluated in context.

Provider-neutral example

Before a high-impact account change, a workflow requires authorization, checks the proposed action against an allowlist, records the decision, and routes exceptions to a human reviewer.

Limitations

Controls can be bypassed, misconfigured, overly broad, or overly restrictive; independent testing and monitored operation remain necessary.

Related concepts

Atomic claims and evidence

  1. 1.1NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile
    Source
    NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile
    Source role
    Authoritative source
    Exact locator
    Printed pp. 13-14: direct and indirect prompt injection and downstream consequences
    Supported claim
    NIST identifies direct and indirect prompt injection as risks that can cause generative AI systems to behave in unintended ways and have downstream consequences for connected systems.
    Last verification
    Review due
    Scope limitation
    This identifies a class of risk, not a guarantee that any particular guardrail prevents it.
    1.2OWASP GenAI Security Project, LLM01:2025 Prompt Injection
    Source
    OWASP GenAI Security Project, LLM01:2025 Prompt Injection
    Source role
    Authoritative source
    Exact locator
    LLM01:2025 Prompt Injection risk overview
    Supported claim
    NIST identifies direct and indirect prompt injection as risks that can cause generative AI systems to behave in unintended ways and have downstream consequences for connected systems.
    Last verification
    Review due
    Scope limitation
    This identifies a class of risk, not a guarantee that any particular guardrail prevents it.
  2. 2.1OpenAI Agents SDK, Guardrails
    Source
    OpenAI Agents SDK, Guardrails
    Source role
    Authoritative source
    Exact locator
    Overview and Workflow boundaries: input, output, and tool guardrails
    Supported claim
    OpenAI's Agents SDK documents input, output, and tool guardrails as checks around user input, final output, and custom function-tool invocation.
    Last verification
    Review due
    Scope limitation
    This is SDK-specific control behavior; its workflow boundaries and residual effects mean it is not a general safety guarantee.
    2.2OWASP Cheat Sheet Series, LLM Prompt Injection Prevention
    Source
    OWASP Cheat Sheet Series, LLM Prompt Injection Prevention
    Source role
    Supplementary source
    Exact locator
    Agent-specific defenses: validate tool calls, least privilege, and human approval
    Supported claim
    OpenAI's Agents SDK documents input, output, and tool guardrails as checks around user input, final output, and custom function-tool invocation.
    Last verification
    Review due
    Scope limitation
    This is SDK-specific control behavior; its workflow boundaries and residual effects mean it is not a general safety guarantee.
  3. 3.1NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile
    Source
    NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile
    Source role
    Authoritative source
    Exact locator
    Printed p. 27: known ground truth and varied evaluation methods
    Supported claim
    NIST recommends using known ground truth and varied evaluation methods, including human oversight and automated evaluation, when assessing generative-AI information integrity.
    Last verification
    Review due
    Scope limitation
    Evaluation methods reduce uncertainty but do not guarantee that a deployed system will be safe or correct in every context.