What are AI guardrails? Runtime safety controls for generative AI, defined

AI guardrails are controls placed around a generative AI model that inspect prompts, retrieved content, model outputs and proposed agent actions, then block, change or reroute anything that breaks policy before it reaches a user or a downstream system. They work outside the model's own training and can be rule-based or themselves powered by AI.

What guardrails cover

MITRE ATLAS lists them as mitigation AML.M0020, Generative AI Guardrails. It names two families: rule-based controls such as filters, allowlists, regular expressions, schema validation and permission checks, and AI-based ones such as classifiers and model reviewers. Its examples run from input and output moderation to retrieval filtering, secret redaction and validating tool calls before they execute, with human approval for high-impact actions.

OWASP's prompt injection entry, LLM01:2025, includes the same idea among its mitigations: define sensitive categories and build rules for spotting and handling that content on the way in and out.

Where guardrails fall short

A guardrail built on a model inherits model weaknesses. NIST's taxonomy, NIST AI 100-2 E2025, notes that detectors which classify inputs or outputs as harmful can themselves be attacked and may fail at the same moments as the models they watch. The UK National Cyber Security Centre (NCSC) goes further for prompt injection, calling it a residual risk and asking for deterministic safeguards that constrain what the system can do.

Guardrails also decay. ATLAS says they should be evaluated, red-teamed and updated continuously, with their decisions logged. NIST's Generative AI Profile, AI 600-1, asks organizations to review security and safety guardrails regularly, especially when a system runs in novel circumstances.

What it is not

The word has a second, governance meaning. Australia's Voluntary AI Safety Standard, published on 5 September 2024, consists of 10 voluntary guardrails that apply to organizations across the AI supply chain, covering duties such as transparency and accountability. Australia published simpler Guidance for AI Adoption on 21 October 2025, which it says evolves the standard. Those guardrails are management practices, not runtime filters.

Runtime guardrails are also separate from model alignment, the safety behaviour trained into the model, which ATLAS treats as a different mitigation that guardrail failures should feed back into.

Where it appears on cisonews.ai

The prompt injection explainer explains why filters alone are not enough. The regulation tracker covers Australia's Voluntary AI Safety Standard, and the incident record on Storm-2139 describes developers accused of bypassing Azure OpenAI safeguards.

Related terms

Jailbreak, prompt injection, AI red teaming and AI agent.