What are Guardrails?

Guardrails are the explicit constraints, validators and policies that bound what an LLM-driven agent can say, fetch or change. They are the safety harness that makes Agentic Workflows shippable, because a non-deterministic model on its own is unsuitable for actions like discount issuance or content publication.

Definition

Guardrails operate at three layers. Input guardrails screen incoming prompts for prompt injection, off-topic queries and PII before they reach the model. Output guardrails validate the model's response against schemas, factuality checks and content filters, often with a smaller classifier model in line. Action guardrails wrap Tool Use calls with policy rules, such as max refund amounts, locale restrictions or rate limits, and they require human approval for irreversible operations. Each guardrail emits structured events that feed back into Eval pipelines, so coverage gaps become visible over time rather than after an incident.

Why it matters

Without Guardrails the worst-case behaviour of an agent is unbounded: it can leak data, hallucinate prices, follow a malicious instruction hidden in user content or burn through token budgets in a loop. Guardrails make the worst case finite and observable, which is what risk and legal teams need before signing off on production rollouts. They also reduce mean-time-to-recovery, because every blocked event is a labelled signal that points to a specific prompt, tool or model version. In a Composable Commerce stack Guardrails sit as a service between the Storefront API and the agent layer, so they can be reused across consumer-facing chat, internal copilots and batch jobs.

Use cases

A pricing agent's write_price tool refuses values outside a percent band of the current price and requires human approval beyond a higher threshold. A content agent's publish tool runs an output classifier for forbidden claims and brand-voice drift before the CMS call. A support chatbot's input guardrail strips embedded instructions from user-supplied text to prevent prompt injection that would otherwise rewrite the agent's role.

Related

Explore Agentic Frontend Management Platform · Composable Digital Experience Platform.