# Guardrails (/academy/guardrails)



Guardrails are the circuit breakers you install *before* the intern finds the main panel.

The [system prompt](/academy/system-prompt) asks the model to behave. A guardrail does not trust the ask. It is a separate check: bad input never reaches the model, bad output never reaches the user, a forbidden tool never runs. "I told it not to" and "I made sure it couldn't" are different levels of safe.

**Both sides of the model**

On the way in, you can catch a [prompt injection](/academy/prompt-injection). On the way out, you can block a leaked [secret](/academy/secret) or an off-limits topic. In the middle, you can refuse the work order: no `rm`, no refunds, no off-menu [stack](/academy/stack).

This product already has some, even if you never named them. The [builder](/builder) greys out combos that will fight you at 2 a.m. The MCP tools plan before they create. The [sandbox](/academy/sandbox) and [permission scope](/academy/permission-scope) shrink the blast radius if the intern is confidently wrong. None of that makes the model wiser. It makes the mess smaller.

A chatbot that says something wrong is embarrassing. An [agent](/academy/agent) that can send mail, move money, or write a repo needs hard limits — allow-lists of tools, a second checker, a box that cannot reach the network. The bigger the action, the less you rely on asking nicely.

The first draft of an agent has no breakers. That is how you learn why breakers exist. Put them in before you point it at real users.

**What this unlocks**

You can give the intern hands without giving them the building. Instructions are a hope. Guardrails are a wall.

Ask it to behave. Build it so it cannot misbehave.