01What a guardrail actually is

A guardrail is a control that constrains an AI application's behavior at runtime — it checks, filters, transforms, or blocks the text going into a model and the text coming back out, measuring each against rules you define. NVIDIA's NeMo Guardrails frames these as "programmable rails" added around a conversational system, not baked into the model itself. That distinction matters: the model is the engine, and guardrails are the safety equipment bolted on around it.

Guardrails are not the same thing as training the model to be safe. Safety can be applied at training time — Anthropic's Constitutional AI, for example, encodes normative principles into how the model behaves — and at runtime, through the input/output checks this lesson is about. Vendor and standards guidance treat these as complementary layers, not substitutes: a well-aligned model still needs runtime checks, because no single layer catches everything.

• Runtime, not retraining: guardrails act while the app is running — on each request and response — so you can change policy without touching the model.
• Around the model: NeMo Guardrails calls them programmable rails placed around a conversational LLM system.
• One layer of many: runtime guardrails sit alongside training-time alignment, human review, and policy — layered, because each catches different failures.

02Two places to check: the way in and the way out

Guardrails fall into two families depending on where in the request they act. Llama Guard, Meta's safeguard model, names this split directly: it runs "prompt classification" on the way in and "response classification" on the way out. Get this mental model and most of the field falls into place.

• Input guardrails protect the model from bad or malicious input — including indirect injection hidden in retrieved documents.
• Output guardrails protect everyone downstream from bad model output — the answer, the user, and any system that consumes it.
• Real systems run both: an input-only filter can be bypassed by content the model itself produces, which is why output and retrieval checks also matter.

03Two ways to decide: rules vs. classifiers

Whichever side of the model a guardrail sits on, it has to make a decision — allow, block, or rewrite. There are two broad ways to make that call, and mature systems layer both.

A useful detail about classifiers: their scores are likelihoods, not verdicts. Perspective API states plainly that its TOXICITY score is a probability between 0 and 1, and you choose the threshold at which to flag content. Llama Guard works differently again — it is an instruction-tuned model that takes a safety taxonomy as part of its prompt, so you can adapt the categories to your own policy rather than retraining. Either way, the lesson is the same: a classifier gives you a number, and someone still has to decide what number means "block".

• Rule-based = explicit and auditable, but brittle. Classifier-based = flexible, but probabilistic.
• Classifier scores are probabilities; the threshold is a human choice with real false-positive / false-negative trade-offs.
• Llama Guard supplies the taxonomy in the prompt, so its categories can be customised to your policy without retraining.

04See it work: a guardrail pipeline

Here is the whole idea in one place. A request flows left to right: through input guardrails (PII detection, prompt-injection filter, topic/policy check), into the model, then through output guardrails (moderation, format/schema validation, groundedness check). Pick an example request, then toggle each guardrail on or off and watch what gets through. This is a teaching model of the concept — the decisions are illustrative, not a real classifier.

• Turn a layer off and watch unsafe content slip through — each guardrail only catches the thing it is built to catch.
• Block vs. redact: some failures stop the request entirely; others (like PII) can be rewritten so the request continues safely.
• This is why guidance from OWASP and the vendors recommends layering: no single rail is complete on its own.

05Check your understanding

06Take it with you & go deeper