AI guardrails

Guardrails are the rules and checks you put around an AI tool so it stays within bounds. A webshop chatbot with guardrails sticks to questions about orders and returns, and passes a refund request to a person instead of promising a refund itself. Without them, a chatbot can tell customers things your business then has to stand behind, as Air Canada found out in 2024.

Why do they matter?

In February 2024 a Canadian tribunal ruled against Air Canada in Moffatt v. Air Canada. The airline's website chatbot had told a customer that a bereavement discount could be claimed after booking, within 90 days of buying the ticket. The airline's own policy page said such requests were not accepted once the trip had been made. Air Canada argued that it could not be held liable for what its chatbot said. The tribunal found the airline "responsible for all the information on its website", whether it comes "from a static page or a chatbot", and ordered it to pay C$650.88 plus interest and fees.

How do they work?

The OpenAI Cookbook (December 2023) and the NeMo Guardrails toolkit place checks at several points:

• Before the model: reject off-topic questions, detect jailbreak and prompt injection attempts, and mask personal data.
• After the model: check the answer against trusted sources to catch hallucinations, apply brand and content rules, and validate the format, for example a JSON schema.
• Around actions: when an AI agent can use tools, limit its permissions and require human approval for risky steps, as OWASP recommends against prompt injection.

A check can be a fixed rule (a word list, a regular expression, a schema), a classifier model such as Meta's Llama Guard (December 2023), or a second language model that judges the answer. These checks run while the application is in use, separate from the safety training built into the model itself. Ready-made options include the open-source libraries NeMo Guardrails (NVIDIA) and Guardrails AI, and hosted services such as Google Cloud's Model Armor, which screens both prompts and responses.

Where do they fall short?

• No guardrail is watertight. In its 2025 list of risks for LLM applications, OWASP writes that it is "unclear if there are fool-proof methods of prevention for prompt injection". A language model used as a guardrail has the same weaknesses as the model it guards, the OpenAI Cookbook warns, so one injection can get past both.
• Strict guardrails block harmless questions too, which the cookbook calls over-refusals. Each check also adds delay and cost. The cookbook advises tuning each check on a test set, weighing an annoyed customer against a missed attack.

Example

Suppose a webshop runs a support chatbot. Before the model, questions about anything other than orders, delivery and returns get a standard reply, and an order number is only looked up for the customer who is logged in. After the model, an answer about return terms must match the returns page; if it does not, the bot offers the contact form instead. Refunds above a set amount go to a staff member for approval.