GLOSSARY

Technical and organisational controls that constrain how an AI system receives inputs, generates outputs, uses data, and takes actions.

Guardrails help organisations reduce harmful outputs, data leakage, unauthorised actions, and policy violations while preserving useful AI capabilities. They also provide evidence that risk treatments are implemented and monitored.

An internal AI assistant can search only approved repositories, masks sensitive fields, blocks unapproved external tools, cites retrieved sources, and requires human approval before sending messages or changing records.

Guardrails reduce risk but do not make AI inherently safe or accurate. Filters can be bypassed, controls can conflict, and overly restrictive policies can make systems unusable. Controls require testing and revision as models and threats change.

Guardrails can operate before, during, or after model inference. They include access controls, input validation, content and policy filters, retrieval restrictions, tool allowlists, approval gates, output verification, rate limits, monitoring, and incident procedures. Effective guardrails are layered around the model and mapped to identified risks rather than relying on a single prompt or classifier.