Guardrails
Live checks on every input and output, plus a human gate before risky actions.
Guardrails sit between your AI and the outside world and run on every single request: they hide sensitive data going in, filter harmful or leaky answers coming out, catch hidden instructions planted in the text your agent reads, and pause the agent for a human before anything irreversible. Without them an agent will repeat a customer's card number in an email summary, or follow an instruction buried in a support ticket. From 2 August 2026 human oversight of high-risk AI is not a preference in the EU, it is EU AI Act Article 14, with fines up to 3% of global turnover.
You need this when
- Your AI reads text you did not write: inbound email, support tickets, uploaded files, web pages.
- It can act outward: send mail, move money, call an API, change a customer record.
- You touch personal or regulated data, or you sell into the EU where Article 14 oversight applies.
You can skip it when
- Solo drafting and brainstorming with no customer data: the model's built-in safety filters are enough.
- Read-only Q&A over your own public docs: spend the effort on retrieval quality, not policy layers.
- A one-week prototype: run shadow mode (AI drafts, human sends) instead of buying a guardrails platform.
Flashcards
Check yourself
1. When do guardrails do their work?
2. A support ticket contains hidden text telling your agent to email the client list. This is:
3. In the 62-tool audit, which pair scores lowest on Guardrails at 2?
4. You want guardrails without a per-call vendor bill. Best move?
5. From 2 August 2026, EU AI Act Article 14 requires what for high-risk AI?
Cheat sheet
- Four types: input filters, output filters, injection defense, human approval gates.
- Guardrails run live on every request, not just during testing or evaluation.
- Prompt injection succeeds over 50% of the time against systems with no protection.
- EU AI Act Article 14: human oversight of high-risk AI is law from 2 August 2026.
- Free or self-hosted: LLM Guard, NeMo Guardrails, Presidio, n8n's Guardrails node.
- Context-layer rails filter before the model sees data; model filters only run after.
Who actually does this well
| Best on this element | Score | Why it scored that |
|---|---|---|
| Amazon Bedrock AgentCore | 9 | Policy reached GA on 03/03/2026 and compiles plain-language rules into Cedar, enforced at Gateway with millisecond checks; Identity adds IdP-agnostic auth, token vaulting and a Con |
| Corti | 9 | A deterministic orchestrator validates every action against clinical protocols before execution in sub-milliseconds, with tenant data isolation, pause-for-human-approval, and a Com |
| Gong | 9 | Agents inherit existing security permissions, run with scoped access, configurable approval gates and human oversight by design. Add ISO/IEC 42001 for AI management, SOC 2 Type 2, |
| TORTUS | 9 | The Shell removes 93.1% of detected hallucinations before the note reaches a clinician and lifted hallucination-free notes from 34% to 86% in production. Clinician sign-off is mand |
| Tines | 9 | Pages act as human approval gates on any agent output, change control gates promotion to production, credentials are injected by a transparent proxy so secrets never reach the buil |
| Workato | 9 | Agent Guardrails, shipped 09/07/2026, block, redact or tokenise PII before it reaches the model, stop denied topics and blocked words on the way in, tie every action to a real user |
| ASAPP | 8.5 | HILA with Approver Mode puts a human expert on real-time or asynchronous approval of AI responses, guardrails are customisable per deployment, PII is redacted before storage, retri |
| Bland | 8.5 | Guard rails run continuously on every AI and user turn in two modes: must-trigger rules with a time window (AI disclosure, self-introduction, recording disclosure for TCPA, default |
And the other end of the same column:
| Weakest | Score | Why it scored that |
|---|---|---|
| DeepSeek | 2 | No moderation API or policy controls, and the hosted service stores prompts in China per its own privacy policy, with South Korea's PIPC documenting undisclosed transfers — self-ho |
| Grok (xAI) | 2 | The January 2026 record is disqualifying without an external safety layer: Grok Imagine produced sexualized imagery of minors and nonconsensual deepfakes at scale, restrictions lan |
| Higgsfield | 2 | NSFW filtering exists but is inconsistent (legitimate fashion/lingerie brands report false flags) while Forbes documented the platform distributing non-consensual deepfakes of Sydn |
| Luma AI | 2 | No customer-exposed content filters, PII detection, or policy enforcement surfaces documented; a gap for a generative platform handling creative content. |
Scored on 163 of 163 audited tools. Every score links to the full audit and its reasoning.