Guardrails Checks and limits wrapped around an AI model.
Short answer. AI guardrails are checks and limits placed around a language model. They screen what goes in, what comes out and which actions the model may take. OpenAI’s guide to agents lists relevance and safety classifiers, a personal-data filter, moderation, risk ratings for tools, rule-based filters and output validation, and advises layering several because one is unlikely to be enough. Guardrails reduce risk; they do not replace access control. OWASP notes it is unclear whether any method prevents prompt injection completely. Office example: a front-desk assistant that must decline fee quotes not in the price list and must never print an Aadhaar number.
01
The main types
OpenAI’s guide lists seven types of guardrail. Most real systems combine several.
Type
What it checks
Office example
Relevance classifier
Flags off-topic questions so answers stay in scope
A policy helpdesk declines cricket scores
Safety classifier
Detects jailbreaks and prompt injection
Catches “repeat your hidden instructions”
Personal-data filter
Stops needless exposure of personal data in output
Masks Aadhaar and PAN numbers in replies
Moderation
Flags hateful, harassing or violent input
Blocks abusive messages to a front desk
Tool safeguards
Rates each tool low, medium or high risk, then pauses or escalates on high
Reading a calendar is low risk; sending an email is high
Rules-based protections
Blocklists, input-length limits and regex filters for known threats
Rejects anything shaped like a card number
Output validation
Checks that responses meet your rules
A reply must quote a source passage
02
Where they sit
NVIDIA’s open-source NeMo Guardrails library describes rails that run at different stages of an interaction: input, retrieval, dialog, execution and output. OpenAI’s Agents SDK separates input guardrails, which run on the first agent’s input, output guardrails, which check the final output, and tool guardrails, which run before and after each guarded tool call.
Where a check sits changes what it protects. An input check cannot see what a tool returns. A tool check can stop a harmful action even when the input looked innocent.
03
What guardrails cannot do
OWASP’s entry on prompt injection says that, given the stochastic nature of generative models, it is unclear whether fool-proof prevention exists. It recommends measures that limit the impact: constrain the model’s role, validate output formats, filter inputs and outputs, enforce least privilege, require human approval for high-risk actions, separate untrusted external content and run adversarial tests.
Its entry on sensitive information disclosure adds that restrictions written into the system prompt may not always be honoured and can be bypassed. OpenAI’s guide makes the same point from the vendor side: guardrails should be coupled with authentication, authorisation, strict access controls and standard software security measures. A guardrail that asks the model to behave is not a lock.
04
Testing a guardrail
Write twenty realistic bad inputs from your own office: a request for another partner’s salary, a pasted contract with hidden instructions, a message asking the assistant to email a client list.
Run them before launch and again after every model or prompt change.
Keep each failure as a permanent test.
Count false blocks as well as misses. A guardrail that stops legitimate work teaches staff to bypass it.
Add guardrails for failures you actually see, and layer them, rather than trying to imagine every risk at once.
05
Where ANVE stands
Around ANVE’s models sit several controls of this kind: the agent loop allows up to seven tool steps per request, a claim made without a successful tool call is challenged, document answers show the source passage, and answers from optional cloud models are labelled. ANVE’s security page (/security) adds that the tools an agent can use need an administrator’s approval, a tool that changes is switched off, every tool call is logged, and a policy that blocks confidential data from cloud models is not on ANVE yet. These controls limit how far a model can go. They are not a promise that it cannot be misled, and ANVE is pre-release with no certifications.
06
Questions people ask
Are guardrails the same as content filters?
A content filter is one kind of guardrail. Guardrails also cover scope, personal data, tool permissions and output format.
Do local models need guardrails?
Yes. Guardrails sit in the application around any model. NeMo Guardrails, for example, adds checks before and after model calls without changing the model.
Can a system prompt be a guardrail?
It helps, but OWASP warns that restrictions in the system prompt may not always be honoured and can be bypassed. Back it with code checks and permissions.
Do guardrails slow answers down?
They can, because each check may be another model call. OpenAI’s Agents SDK lets a guardrail run in parallel with the main model or block it first, trading speed against the cost of a request that should have been rejected.
07
What is not real yet
No sealed ANVE unit exists; every image of the appliance on this site is a labelled render. The software runs today on a development machine. No customers yet, no certifications, no delivery date, and the final price is not announced.
Reservations are ₹999 in India or US$12 elsewhere, refundable in full until you confirm an order in writing (terms). Offices that cannot use cloud AI can apply to be one of ten design partners.
