Guardrails

Guardrails are the circuit breakers you install before the intern finds the main panel.

The system prompt asks the model to behave. A guardrail does not trust the ask. It is a separate check: bad input never reaches the model, bad output never reaches the user, a forbidden tool never runs. "I told it not to" and "I made sure it couldn't" are different levels of safe.

Both sides of the model

On the way in, you can catch a prompt injection. On the way out, you can block a leaked secret or an off-limits topic. In the middle, you can refuse the work order: no rm, no refunds, no off-menu stack.

This product already has some, even if you never named them. The builder greys out combos that will fight you at 2 a.m. The MCP tools plan before they create. The sandbox and permission scope shrink the blast radius if the intern is confidently wrong. None of that makes the model wiser. It makes the mess smaller.

A chatbot that says something wrong is embarrassing. An agent that can send mail, move money, or write a repo needs hard limits — allow-lists of tools, a second checker, a box that cannot reach the network. The bigger the action, the less you rely on asking nicely.

The first draft of an agent has no breakers. That is how you learn why breakers exist. Put them in before you point it at real users.

What this unlocks

You can give the intern hands without giving them the building. Instructions are a hope. Guardrails are a wall.

Ask it to behave. Build it so it cannot misbehave.