Most "AI safety" isn't the model being safe. It's a second, cheaper, dumber system standing on either side of it, checking what goes in and what comes out.
You've built API gateways before: a request hits the gateway, gets validated and authenticated, then reaches your service, and the response gets checked again on the way back. Guardrails are that exact pattern applied to an LLM call.
1) The input guardrail sits between the user and the model, screening the prompt before the model ever sees it. Mostly for two things: jailbreaks (talking the model out of its own rules) and prompt injection (instructions smuggled inside content the model reads, like a webpage, a PDF, or a support ticket). Prompt injection is LLM01, the top entry on OWASP's Top 10 for LLM apps. Azure's Prompt Shields splits the two: direct (the user attacks you) and indirect (the document does).
2) The output guardrail reads the model's answer before the user does. It's there for what a tool dragged in, and for claims the model made up. Bedrock's contextual grounding check scores a response on grounding (is it supported by the source you handed it) and relevance (does it answer the question), and drops anything under your threshold.
3) For agents, two sides isn't enough. NVIDIA's NeMo Guardrails ships five rail types: input, dialog, retrieval, execution, output. The retrieval rail filters what comes back from your knowledge base; the execution rail gates the tool call itself. That's where agent-shaped risk actually lives.
The guardrail is usually a small model, not your big one. Meta's Llama Guard 4 is 12B, pruned from Llama 4 Scout's mixture-of-experts layers into a dense model, and natively multimodal: it classifies prompts AND responses, and it reads images, so a jailbreak hiding in a screenshot doesn't walk past a text-only filter.
One honest catch: these are classifiers, so they're probabilistic. They lower the odds, they don't hold a boundary. Pair them with architecture. Simon Willison's "lethal trifecta" (private data + untrusted content + a way to send data out) is the useful frame: cut any one leg and the exfiltration path breaks, guardrail or not.
Quick check before you scroll: Your agent calls a database tool, and the result happens to contain a customer's SSN. The LLM includes it in its final answer. Which guardrail should have caught this, and where does it sit in the pipeline?
Full breakdown + the answer: frankduah.me/learnings/2026-08-03-guardrails-input-and-output-safety-filters
The answer
The output guardrail, it runs on the LLM's generated response, after the model produces it but before it's returned to the user, specifically to catch things like leaked PII that slipped through.
New here? I post a bite-size AI / ML concept like this every day, follow me for the daily drop, and it compounds fast. Why I do it: https://lnkd.in/gK8knHDH
#Guardrails #AI #LLM #AIAgents #MachineLearning