GLOSSARY
Guardrails
Guardrails are technical or organisational controls intended to constrain unwanted inputs, outputs or actions; their effectiveness must be assessed against specific risks.
Controls should address the possible consequence
An AI system might draft a discount proposal without permission to send it. Access rights and a mandatory approval step can enforce that separation. A text filter detecting unsuitable language addresses a different problem. Architecture therefore needs to identify the risk each control actually limits: disclosure, factual mistakes, unauthorised actions or inappropriate content. Combining these under one vague safety label can create confidence while leaving the consequential action insufficiently controlled.
Test edge cases and legitimate work together
A policy engine can check conditions for actions; human approval can cover selected decisions. Binding access limits should be enforced beyond a simple instruction asking the model to behave. Tests need attempted bypasses and legitimate tasks. Excessive false alarms create review work and can encourage users to seek problematic workarounds. Operational evidence should therefore include prevented risks, incorrectly blocked work and remaining gaps. Guardrails form a set of controls whose effectiveness needs examination. Their presence alone does not establish adequate security for the particular use case or justify removing other checks.