TokenPad

Safety

Guardrails

Guardrails are the rules constraining what a model or agent may do, stated in the prompt and — where it matters — enforced outside the model.

Prompt-level guardrails work well against ordinary input and are one layer among several against a deliberate adversary. Grouping them in one block is followed more reliably than scattering the same rules through a prompt.

The guardrails that actually hold are the ones enforced in your own code: narrow tool permissions, confirmation on irreversible actions, and no secrets in a context that untrusted content also occupies.

In practice

A guardrail written into the prompt is a request. A guardrail written into code is a rule. "Never refund more than $50" in a system prompt will hold most of the time and fail on the request that was designed to make it fail; the same limit validated on the tool argument before execution holds every time.

Common questions

Should guardrails be in the prompt or in code?

Both, but the enforcing one is in code. A limit written into a prompt is a request that holds most of the time; the same limit validated on a tool argument before execution holds every time.

What should a guardrail check?

Input length, argument ranges and identifiers before execution, and on the way out anything that reaches a shell, a query or a template. Model output is untrusted input wearing a helpful tone.

Measure it

  • Prompt injectionPrompt injection is an attack where text the application inserts into a prompt — a document, a user upload, a tool result — contains instructions the model then follows.
  • AI agentAn AI agent is a loop in which a model receives a request, decides whether to call a tool, receives the result, and repeats until it can answer.
  • JailbreakA jailbreak is an attempt to make a model bypass its own safety training, usually through role-play framing, mode-switch phrasing or hypothetical scenarios.

More in Safety