Guardrails
Live checks on every input and output, plus a human gate before risky actions.
Guardrails sit between your AI and the outside world and run on every single request: they hide sensitive data going in, filter harmful or leaky answers coming out, catch hidden instructions planted in the text your agent reads, and pause the agent for a human before anything irreversible. Without them an agent will repeat a customer's card number in an email summary, or follow an instruction buried in a support ticket. From 2 August 2026 human oversight of high-risk AI is not a preference in the EU, it is EU AI Act Article 14, with fines up to 3% of global turnover.
You need this when
- Your AI reads text you did not write: inbound email, support tickets, uploaded files, web pages.
- It can act outward: send mail, move money, call an API, change a customer record.
- You touch personal or regulated data, or you sell into the EU where Article 14 oversight applies.
You can skip it when
- Solo drafting and brainstorming with no customer data: the model's built-in safety filters are enough.
- Read-only Q&A over your own public docs: spend the effort on retrieval quality, not policy layers.
- A one-week prototype: run shadow mode (AI drafts, human sends) instead of buying a guardrails platform.
Flashcards
Check yourself
1. When do guardrails do their work?
2. A support ticket contains hidden text telling your agent to email the client list. This is:
3. In the 62-tool audit, which pair scores lowest on Guardrails at 2?
4. You want guardrails without a per-call vendor bill. Best move?
5. From 2 August 2026, EU AI Act Article 14 requires what for high-risk AI?
Cheat sheet
- Four types: input filters, output filters, injection defense, human approval gates.
- Guardrails run live on every request, not just during testing or evaluation.
- Prompt injection succeeds over 50% of the time against systems with no protection.
- EU AI Act Article 14: human oversight of high-risk AI is law from 2 August 2026.
- Free or self-hosted: LLM Guard, NeMo Guardrails, Presidio, n8n's Guardrails node.
- Context-layer rails filter before the model sees data; model filters only run after.
Who actually does this well
| Best on this element | Score | Why it scored that |
|---|---|---|
| Gong | 9 | Agents inherit existing security permissions, run with scoped access, configurable approval gates and human oversight by design. Add ISO/IEC 42001 for AI management, SOC 2 Type 2, |
| Gemini / Google | 8.5 | Model Armor screens prompt injection, PII leaks and toxic content in real time, on top of configurable safety filters, ADK deterministic guardrails and human-in-the-loop pauses. |
| Microsoft 365 Copilot | 8.5 | Best-in-class enterprise controls: Purview DLP on prompts, sensitivity labels, watermarking for sensitive material, admin-governed environments and approval steps in workflows. |
| Claude / Anthropic | 8 | Fable 5 ships dedicated safety classifiers, streaming-refusal handling is documented, and Managed Agents adds permission policies plus credential vaults — integrators must handle r |
| Cognism | 8 | Compliance is the product: GDPR/CCPA legitimate-interest processing with documented assessments, Do-Not-Call scrubbing across 15+ territories, contact notification within GDPR time |
| Glean | 8 | A dedicated 'Protect' safety line — sensitive-content detection, prompt-injection detection, human-in-the-loop write confirmation — though a May 2026 independent audit found some P |
| Sierra | 8 | Deterministic guardrails plus layered "supervisor" agents for input filtering and output interception are genuinely sophisticated — but the December 2025 Gap.com misconfiguration s |
| Cursor | 7.5 | Cursor 3's preview-then-approve diff gates, scriptable Hooks, sandboxed terminal, model block lists and org-wide privacy mode are real runtime controls; compliance surface is SOC 2 |
And the other end of the same column:
| Weakest | Score | Why it scored that |
|---|---|---|
| DeepSeek | 2 | No moderation API or policy controls, and the hosted service stores prompts in China per its own privacy policy, with South Korea's PIPC documenting undisclosed transfers — self-ho |
| Grok (xAI) | 2 | The January 2026 record is disqualifying without an external safety layer: Grok Imagine produced sexualized imagery of minors and nonconsensual deepfakes at scale, restrictions lan |
| Higgsfield | 2 | NSFW filtering exists but is inconsistent (legitimate fashion/lingerie brands report false flags) while Forbes documented the platform distributing non-consensual deepfakes of Sydn |
| Luma AI | 2 | No customer-exposed content filters, PII detection, or policy enforcement surfaces documented; a gap for a generative platform handling creative content. |
Scored on 62 of 62 audited tools. Every score links to the full audit and its reasoning.