Guardrails

Guardrails are the constraints that keep an AI agent inside acceptable behavior: what it may say, what it may promise, what actions it may take, and when it must hand off to a human. Some are written as prompt instructions. The important ones are enforced in code.

Why it matters when you are buying or building

There are two tiers, and vendors blur them.

Soft guardrails are prompt rules. "Do not discuss competitors." "Never quote a price." "If asked about legal matters, escalate." These work most of the time. They are not enforcement. A model can be talked past them, and a long conversation dilutes them.

Hard guardrails are code between the agent and the outside world. A tool the agent cannot call unless a condition is true. A database check before a message goes out. A spend cap. These hold regardless of what the model decides.

The rule I use: if a mistake creates legal exposure, costs money, or cannot be undone, it does not get to be a prompt rule. It gets enforced in the layer the model cannot reach.

What I have seen in production

I built an SMS assistant inside a sports-facility company's CRM. Text messaging to consumers in the US is governed by the TCPA, and the penalty for texting someone who never opted in is not a bad review, it is statutory damages. So consent is not a prompt instruction there. It is a gate in the send path: before any outbound message, the code checks the consent record on that contact, and if there is no opt-in the send fails. The agent cannot argue its way around it, because it never touches the send function directly. No exceptions, including for staff who ask nicely. More on that in TCPA compliance for AI SMS.

The other guardrail I now treat as mandatory is the negative capability list. On a receptionist build, the agent told a caller it had blocked their number, which it had no ability to do. Adding an explicit "abilities you do NOT have" block to the system prompt fixed it. That one is a soft guardrail, and it is the right tier because the failure is embarrassment rather than liability. See hallucination.

A short checklist for any build:

• Which actions have real-world side effects, and is each one gated in code?
• What is the escalation path, and can the agent reach it from any state?
• Is there a spend or volume cap so a loop cannot run up a bill overnight?
• Are transcripts reviewable, so you can find out what actually happened?

Guardrails are not about distrusting the model. They are about the same discipline you would apply to any system that can act on a customer's behalf.