Guardrails are the technical controls that enforce your AI policy at run time. They sit around the model, not inside it, because no model can be trusted to police itself. The OWASP Top 10 for LLM Applications (2025 edition) gives a useful checklist of what can go wrong: prompt injection, sensitive information disclosure, supply chain weaknesses, data and model poisoning, improper output handling, excessive agency, system prompt leakage, vector and embedding weaknesses, misinformation and unbounded consumption. This guide organises the matching controls into layers.
Layer 1: input controls
- Authentication and authorisation before any request reaches a model.
- Input screening for known injection patterns, harmful content and out-of-scope topics.
- PII detection and redaction so personal and confidential data does not reach external models unless permitted.
- Untrusted content handling. Treat retrieved documents, web pages and tool outputs as data, never as instructions. Prompt injection can arrive through content, not just the user.
Layer 2: model and prompt controls
- Version-controlled system prompts and pinned model versions.
- Minimal context: give the model only the data the task needs.
- Retrieval with document-level access control so users see only what they are entitled to.
Layer 3: output controls
- Grounding checks that verify claims against retrieved sources, and citations users can inspect.
- Content and policy filters for harmful, off-topic or confidential output.
- Structured output validation. Never pass model output straight into a database, shell or browser. Validate and encode it.
- Disclosure that content is AI generated where users need to know.
Layer 4: agent and tool controls
- Least-privilege tools. Each tool gets the narrowest scope, with read-only by default and separate credentials per agent.
- Sandboxing for code execution and browsing.
- Approval gates for irreversible or high-impact actions such as payments, deletions and external messages.
- Limits. Cap steps, tokens, tool calls and spend per request, user and day to contain runaway loops and unbounded consumption.
- Kill switch. A tested way to disable a model, tool or agent in minutes.
Layer 5: observability and audit
Log prompts, retrieved context, tool calls, decisions and filter outcomes with trace identifiers, with sensitive data masked. Alert on policy violations, injection attempts, cost spikes and quality drops. Logs are also your evidence.
Enforce at a gateway
Put these controls in a central gateway or policy layer so every application inherits them and direct calls to model providers are blocked. See the LLM guardrails architecture and the AI agent safety architecture.
Guardrails need testing
Every filter has false positives and false negatives. Measure both, tune with evidence and red-team the whole stack regularly. Our guide to red-teaming and evaluation explains how.
How EITSAA helps
We help you design and evidence AI governance that matches your risk, from the register and policy through to technical guardrails and audit-ready evidence. Explore AI Governance & Assurance, talk to our team or call 0402 401 584.
This is general guidance, not legal advice. Check current requirements with the relevant authority and take advice on your own position.