Map the dangerous boundaries
List what can go wrong before writing a rule. A customer-support assistant may leak private data, cite the wrong policy, change an account, or send an unapproved message. Each risk belongs at a different boundary.
A minimum guardrail stack
- Validate and classify the input.
- Keep private data in the allowed tenant or workspace.
- Restrict tools and validate their arguments.
- Use an output schema for required fields.
- Check citations or evidence for factual answers.
- Log the request, route, tool calls, result, and approval.
- Keep high-risk actions behind a human gate.
Test the guardrails like product behavior
Use normal requests, malicious instructions inside documents, missing permissions, tool failures, and requests that should be refused. A guardrail that exists only in a prompt is not a complete control.