Guardrails, Explained: How AI Agents Are Kept From Going Off Script
Guardrails aren't one setting. They're checks placed at different points in an agent's pipeline, because different problems show up in different places.
An agent that only answers questions is easy to forgive. If it gets something wrong, you read the wrong answer and move on. An agent that can send emails, edit files, or move money is a different situation entirely. Once an agent can act, "it gave a weird answer" turns into "it did a weird thing." Guardrails are the infrastructure meant to stop that gap from becoming a real problem.
The layered model
Guardrails aren't one setting you switch on. They're checks placed at different points in an agent's pipeline, because different problems show up in different places.
Input checks
Screen what goes into the agent before it acts on anything.
Output checks
Screen what comes out before a person sees it, catching things like hallucinated facts or leaked sensitive data after the model has already generated a response.
Action and tool boundaries
Limit what the agent is actually allowed to do, not just what it's allowed to say. An agent that can send an email or modify a database needs limits on those actions specifically.
Human checkpoints
Require a person's approval before a specific action goes through, usually reserved for anything higher stakes.
No single layer catches everything, which is the whole reason for having more than one.
The threat this is mostly built to catch
The clearest way to understand why guardrails matter is to look at what they're actually defending against. Prompt injection has been ranked the number one risk on OWASP's Top 10 for LLM Applications for three consecutive editions, most recently reconfirmed in the August 2026 update.
Prompt injection is when hidden instructions, buried in something the agent reads — a webpage, a document, an email — try to override what the agent was actually told to do. There are two versions. Direct injection is when someone types the malicious instruction straight into a conversation. Indirect injection is when it's hidden inside content the agent processes on someone else's behalf, which tends to be the more dangerous version, since the agent has no reason to treat that content as suspicious in the first place.
Why you can't just tell the model to ignore bad instructions
OWASP is direct about this: prompt injection can't be patched away. It comes from a basic feature of how these models work. The model processes instructions and the data it's reading through the same channel, with no built-in way to tell the difference between "an instruction to follow" and "text that's just meant to be read."
A well-worded system prompt reduces the risk. It doesn't remove it.
This is why real implementations layer multiple defences rather than relying on one clever prompt. Input filtering catches some attempts. Output filtering catches others. Restricting what the agent can actually do limits the damage of whatever gets through anyway.
What changes once an agent can take actions
Talking is low stakes. Acting isn't. Once an agent can call tools, the risk shifts to something OWASP categorises separately: excessive agency — an agent having more permission than a given task actually needs.
The practical fix is scoping. An agent handling customer refunds doesn't need access to every system in the business, just the two or three it's actually meant to touch. Narrower permissions mean a successful injection or a bad decision has a smaller blast radius.
The cost of skipping this
Gartner predicted in a July 2024 press release that at least 30% of generative AI projects would be abandoned after proof of concept by the end of 2025. The reasons cited were poor data quality, inadequate risk controls, escalating costs, and unclear business value — not the model failing to work.
Guardrails sit squarely inside that "inadequate risk controls" reason. A project can have a perfectly capable model behind it and still fail, because nobody built the boundaries around it.
A practical way to think about your own agent
A few questions cover most of what matters:
- 1Is anything checking what goes into the agent before it acts?
- 2Is anything checking what comes out before a person sees it?
- 3Does the agent's permission match the task in front of it, or does it have broader access than it needs?
- 4Is there a human checkpoint anywhere the stakes are high enough to need one?
None of this needs a technical background to ask. It just needs knowing that a capable model and a safe system are two different things, and that the second one has to be built on purpose.
Want this in your business?
If building AI agents with input checks, tool boundaries and human approval built into the architecture rather than bolted on afterwards is something you're facing, it's exactly what we build in our Purpose-built app work.
Frequently asked questions
What are guardrails for AI agents?
Guardrails are checks placed at different points in an agent's pipeline: input checks screen what goes in, output checks screen what comes out, tool and action boundaries limit what the agent is allowed to do, and human checkpoints require approval before high-stakes actions. No single layer catches everything, which is why they are used together.
What is prompt injection and why can't it be fixed with a better prompt?
Prompt injection is when hidden instructions inside content the agent reads — a webpage, document or email — try to override what the agent was told to do. It can't be patched away because the model processes instructions and the data it reads through the same channel, with no built-in way to distinguish an instruction to follow from text that is merely meant to be read. A well-worded system prompt reduces the risk but does not remove it.
What is excessive agency in AI agents?
Excessive agency is when an agent has more permission than the task actually needs. The practical fix is scoping: an agent handling customer refunds only needs access to the two or three systems it is meant to touch, so a successful injection or bad decision has a smaller blast radius.
Why do AI projects fail even when the model works?
Gartner predicted in July 2024 that at least 30% of generative AI projects would be abandoned after proof of concept by the end of 2025, citing poor data quality, inadequate risk controls, escalating costs and unclear business value — not model capability. Missing guardrails fall squarely under inadequate risk controls.
How does Codefully do this?
We deliver this as Purpose-built app. A custom AI product built around one core workflow — designed, engineered and owned by you.
