AI guardrails are controls that surround a model or an agent: they check what goes in, filter what comes out and limit what it can do. Permissions are enforced in the code or the tool; filters can also use other models and make mistakes.
A question from the app. Pick an answer.
Your agent must not delete files without asking you. What ensures that?
It steers the agent, but it is text the model reads: a mistake or slipped in text can make it skip the rule.
The tool holds the delete until you say yes, whatever the model decides. That is a guardrail.
It makes fewer mistakes, but it can still delete. As long as the decision rests only with the model, nothing ensures it.
What goes in: before the request reaches the model, a check can mask a card number, stop off topic questions or flag suspicious text, like a prompt injection attempt.
What comes out: before the answer is shown, another check reviews it. If it carries personal data or a forbidden topic, it swaps it for a fixed message or hands it to a person. Sometimes that check is another, smaller model that only classifies.
What it does: in an agent, which tools it has, with which permissions, and which ones need your confirmation. An agent that can delete files, but only after you say yes.
A bank wants a chatbot that answers card questions and never gives investment advice. One check looks at each question: if it is about investing, it replies with a fixed text the bank wrote and offers to connect you with an advisor. Another reviews each answer before it goes out. And the bot has no access to move money: even if someone tricks it, it cannot do it.
No single layer is perfect. Together they reduce the risk, but each one covers different problems.
Writing "never recommend investments" or "do not delete files" in the prompt guides the model, but does not prevent anything. It can skip the instruction by mistake, in a long chat or because of a prompt injection.
To prevent an action, check which permission or control blocks it even if the model tries to do it. Same with data: if the model must never see an API key, do not hand it over; telling it not to show the key is not enough.
Some controls compare the answer against sources to detect hallucinations, but they can still miss errors. And if the guardrails are too strict, they block normal questions and the bot becomes useless. You test them with real cases and adjust.
Models also come trained to refuse certain things. That helps, but it does not know your rules: it has no idea your bank does not give investment advice.