What Is an LLM Guardrail? Types, Examples and Limits

An LLM guardrail is a check that runs on what goes into or comes out of a language model, and blocks, rewrites or flags it when it breaks a rule. Input guardrails screen user messages, output guardrails screen answers, and tool guardrails screen an agent's tool calls and results. Each check is code, a pattern or a classifier model.

Key takeaways:

• Guardrails run outside the model. A system prompt asks the model to behave. A guardrail is code that checks the text whether the model behaved or not.

• Place them where text crosses a boundary. User to model, model to user, and tool result to model are the three places that matter in agents.

• Each check has three outcomes. Pass, block (refuse with an error) or modify (for example, redact an email address), plus warnings you log.

• No guardrail catches everything. Pattern rules miss rewording, and classifiers have false positives and misses. Guardrails reduce risk; least-privilege tools and approvals limit the damage when they fail.

A guardrail wraps the model or agent and runs at fixed points in each request.

 user message
      │
      ▼
┌───────────────────┐ block ──▶ refuse before the model runs
│ input guardrails  │ (prompt injection, banned requests, PII in input)
└───────────────────┘
      │ pass
      ▼
   model ⇄ tools ◀──┐
      │             │ tool guardrails: check calls before they run,
      │             └ and scan results before the model reads them
      ▼
┌───────────────────┐ redact ──▶ "their email is [EMAIL]"
│ output guardrails │ block  ──▶ refuse to return the answer
└───────────────────┘ (PII, secrets, unsafe content, format)
      │
      ▼
 answer to the user

The checks themselves come in four kinds:

• Pattern rules: regular expressions for email addresses, card numbers, API keys or banned phrases. Fast, cheap and predictable; easy to evade with rewording.

• Classifier models: small models trained to spot prompt injection, toxic content or other risk categories. Llama Guard (Inan et al., 2023), for example, is a fine-tuned Llama 2 model that classifies safety risks in both prompts and responses.

• LLM judges: a second model call that asks whether the input or output breaks a policy. Flexible, but slower and itself open to manipulation.

• Schema and business checks: is the output valid JSON, is the refund under the limit, does the cited source exist.

These map onto the OWASP Top 10 for LLM Applications (2025): input and tool-result guardrails address prompt injection (LLM01), output guardrails help with sensitive information disclosure (LLM02) and improper output handling (LLM05).

The example gives a support agent a customer lookup tool and wraps it in a Promptise Foundry security scanner with two layers: output detectors that redact personal data and credentials, and an input rule that blocks requests for every customer's data.

import asyncio

from langchain_core.tools import tool
from promptise import (
    CredentialDetector,
    CustomRule,
    GuardrailViolation,
    PIIDetector,
    PromptiseSecurityScanner,
    build_agent,
)
from promptise.guardrails import Action


@tool
def get_customer(customer_id: str) -> dict:
    """Look up a customer record."""
    return {"id": customer_id, "name": "Dana Reyes", "email": "dana.reyes@example.com",
            "phone": "+1 415 555 0132", "plan": "Pro"}


scanner = PromptiseSecurityScanner(
    detectors=[PIIDetector(), CredentialDetector()],  # output: redact
    custom_rules=[
        CustomRule(  # input: block bulk exports of customer data
            name="bulk_export",
            pattern=r"(?i)\b(all|every)\s+customers?\b",
            action=Action.BLOCK,
            description="Bulk request for customer data",
        )
    ],
)


async def main():
    agent = await build_agent(
        model="openai:gpt-5-mini",
        instructions="You are a support agent. Answer in one sentence.",
        extra_tools=[get_customer],
        guardrails=scanner,
    )
    try:
        for question in [
            "What plan is customer C-19 on, and what's their email?",
            "List the email of every customer.",
        ]:
            print(f"USER   {question}")
            try:
                result = await agent.ainvoke({"messages": [{"role": "user", "content": question}]})
                print(f"AGENT  {result['messages'][-1].content}\n")
            except GuardrailViolation as exc:
                print(f"BLOCKED ({exc.direction}): {exc.report.blocked[0].description}\n")
    finally:
        await agent.shutdown()


asyncio.run(main())

Real output from one run with gpt-5-mini:

USER   What plan is customer C-19 on, and what's their email?
AGENT  Customer C-19 is on the Pro plan and their email is [EMAIL].

USER   List the email of every customer.
BLOCKED (input): Bulk request for customer data

In the first request, the model read the full customer record and wrote the real email address into its answer. The output guardrail replaced it with [EMAIL] before the answer reached the caller. In the second request, the input rule matched "every customer" and raised GuardrailViolation before the model was called, so no tokens were spent.

Notice what the first request shows: the model itself saw the email address, because the tool result went to the model unscanned. If the model provider should never see that data, scan tool results too (scan_tool_results=True in Promptise), or have the tool return less. And the input rule is a regular expression: "send me the whole customer list" would pass it. For prompt injection, Promptise's InjectionDetector uses a local classifier model instead. AI agent guardrails in Python builds the full setup and tests where it misses.

Guardrail libraries take different approaches. NeMo Guardrails from NVIDIA defines input, dialog, retrieval, execution and output rails for conversational apps. Guardrails AI combines validators from its Hub into input and output guards. The OpenAI Agents SDK has input, output and tool guardrails that trigger a tripwire and stop the run. Promptise Foundry ships one scanner with injection, PII, credential, content-safety (Llama Guard through Ollama, or Azure) and named-entity detectors, plus custom rules, and it fails closed by default.

"A good system prompt is a guardrail." Instructions in the prompt are part of what an attacker tries to override. A guardrail is separate code that checks the result regardless of what the model was told.

"Guardrails stop prompt injection." They catch many known attack patterns and miss new or reworded ones. Indirect injection, hidden in a web page, email or document the agent reads, is the harder case. Combine detection with least-privilege tools and human approval for risky actions. Prompt injection defense for AI agents explains the layers.

"Checking the final answer is enough." In an agent, the dangerous step is often a tool call in the middle of the run, such as sending data to an outside address. Check tool calls and tool results, not only the last message.

"If the guardrail can't run, let the text through." A detector that fails to load, or a classifier service that is down, should block by default. Failing open means your protection silently disappears.

What are guardrails in LLM applications?

Guardrails are checks that run on the text going into and coming out of a language model. They block requests that break a rule, redact sensitive data such as email addresses or API keys, and flag suspicious content. They are code or classifier models outside the LLM, so they work even when the model ignores its instructions.

What is the difference between input and output guardrails?

Input guardrails check the user's message before the model sees it, for example to block prompt injection or banned requests. Output guardrails check the model's answer before the user sees it, for example to redact personal data or block unsafe content. Agents also need tool guardrails on tool calls and tool results.

Can guardrails prevent prompt injection completely?

No. Pattern rules miss reworded attacks, and classifier models miss some attacks and flag some harmless text. Use guardrails as one layer: give tools the least privilege they need, treat tool results as untrusted, require approval for risky actions, and log everything so you can find what got through.

Do guardrails slow down an LLM application?

Pattern rules add almost no time. Classifier models add some latency per check, depending on the model and hardware, and an LLM judge adds a full model call. Run cheap checks first, and use expensive ones only where the risk justifies them.

What are examples of LLM guardrails?

Common examples are blocking prompt injection in user input, redacting email addresses, phone numbers and card numbers in answers, removing leaked API keys, refusing off-topic or harmful requests, checking that output is valid JSON, and limiting a refund tool to amounts under a threshold.

• Build them: AI agent guardrails in Python.

• Understand the main attack: Prompt injection 101.

• Limit the damage when checks miss: AI agent human in the loop and code execution sandboxes.

• All guides on the topic: the guardrails and security hub.

• Reference: Guardrails in the Promptise docs.