AI safety controls
AI guardrails: what they are and where to put them
A plain guide for product, security and operations leads who need to put limits around an AI system, with facts taken from Anthropic's and OWASP's own pages as read on 7 November 2026 and no promise that any control stops every attack.
AI guardrails are checks and limits placed around an AI system so it stays within what you intend. Anthropic's documentation lists examples such as screening user input, writing firm system prompts, treating tool content as untrusted and limiting access. OWASP says it is unclear whether fool-proof prevention exists, so layer the controls. Read 7 November 2026.
plain answer
AI guardrails: what are they?
In plain terms, an AI guardrail is a check or limit that sits around a model so the system stays within what you intend. That is our wording, not a formal definition from the sources below.
Anthropic describes jailbreaks and prompt injection as attempts to make Claude ignore its guidelines or your instructions. For what prompt injection is and how it relates to a jailbreak, see our prompt injection guide. Its page says that although Claude is inherently resilient to such attacks, the additional steps it lists strengthen your guardrails. The steps for a user who may be adversarial include screening input with a lightweight model, filtering input for known injection patterns, writing a system prompt that sets boundaries and tells the model how to refuse, and responding to users who repeatedly try to get around the rules.
Source: Anthropic, Mitigate jailbreaks and prompt injections (https://platform.claude.com/docs/en/test-and-evaluate/strengthen-guardrails/mitigate-jailbreaks), read 7 November 2026.
plain answer
Guardrails for AI: where do they go?
A simple way to sort them, in our wording, is before the model, after it, and around anything it can do. Before the model, Anthropic lists screening and validating what users send. After it, OWASP's mitigation list for prompt injection includes input and output filtering and defining and validating expected output formats.
Around actions, both sources point at access. Anthropic says to apply least privilege and to screen tool outputs before the model acts on them. OWASP's list includes enforcing privilege control and least privilege access, and requiring human approval for high-risk actions. For agents, its Excessive Agency entry lists minimizing extensions, minimizing extension permissions, requiring user approval and complete mediation.
Sources: Anthropic, Mitigate jailbreaks and prompt injections, and OWASP, LLM01:2025 Prompt Injection and LLM06:2025 Excessive Agency (URLs in the sources list), read 7 November 2026.
plain answer
Can guardrails stop prompt injection?
They reduce the risk, and the sources are careful not to say more. OWASP defines a prompt injection vulnerability as one that occurs when user prompts alter the model's behavior or output in unintended ways, and states that it is unclear whether there are fool-proof methods of prevention.
Anthropic separates two cases. In direct prompt injection and jailbreaks the user is the adversary. In indirect prompt injection the user is trusted, but the model reads third-party content such as webpages, emails, documents or tool results that carry hostile instructions. Anthropic's answer is to layer measures: keep untrusted content in tool results, state the policy in the system prompt, limit access, screen tool outputs, test with deliberate injection attempts before launch, and keep monitoring outputs afterwards.
Sources: OWASP, LLM01:2025 Prompt Injection (https://genai.owasp.org/llmrisk/llm01-prompt-injection/) and Anthropic, Mitigate jailbreaks and prompt injections, read 7 November 2026.
security
What should a team decide before adding guardrails?
Decide five things in writing. Who owns the system and answers for what it does. What it can reach, and whether each connection only reads or can also change records. Which actions need a named person to approve them. How blocked requests and unusual outputs are logged and who reviews them. How you will test it, which for Anthropic means trying documents, emails and tool outputs that deliberately contain injection attempts before deployment.
These are decisions about people and process as much as software. A filter that nobody reviews, or a permission that nobody owns, is not a guardrail you can rely on.
kriv role
Where Kriv helps
Kriv AI designs and builds governed AI agents and trains the teams who work with them. For guardrails, that means listing what each agent can reach, agreeing which actions need a person's approval, setting up logging and review, and testing the controls with your staff before launch.
Kriv did not write the guidance cited on this page. Anthropic and OWASP describe their own recommendations, and no control described here guarantees that an attack will fail.
limits
What this page could not confirm
This page rests on the four pages listed below, as read on 7 November 2026. None of them gives a formal definition of the term guardrails, so the plain definition above is ours. We did not test any guardrail product, did not read OWASP's full mitigation text beyond the headings and quoted sentences, and did not review any vendor's guardrail feature. Check the current pages before you plan.
Sources
Cited sources
- Anthropic Docs: Mitigate jailbreaks and prompt injections (page shows no date), read 7 November 2026
- OWASP GenAI Security Project: LLM01:2025 Prompt Injection (2025 edition), read 7 November 2026
- OWASP GenAI Security Project: LLM06:2025 Excessive Agency (2025 edition), read 7 November 2026
- OWASP GenAI Security Project: OWASP Top 10 for LLM Applications (2025 edition), read 7 November 2026
Straight answers
Frequently asked questions about AI guardrails: what they are and where to put them
What are AI guardrails?
In plain terms, checks and limits around an AI system, such as screening input, validating output and limiting what the system can access. Anthropic lists such steps as ways to strengthen your guardrails (read 7 November 2026). The sources do not give a formal definition.
Are guardrails for AI the same as a content filter?
No. A filter on input or output is one kind. Anthropic and OWASP also list limiting access with least privilege and requiring human approval for high-risk actions (read 7 November 2026).
Can AI guardrails stop prompt injection completely?
OWASP says it is unclear whether there are fool-proof methods of prevention for prompt injection (read 7 November 2026). Treat guardrails as layers that reduce risk, and test them.
Where should guardrails sit in an AI agent?
Before the model, on what users and tools send in, after it, on what it returns, and around its actions, through limited access and approval for high-risk steps (Anthropic and OWASP, read 7 November 2026).
Can Kriv help us put guardrails around an AI system?
Kriv AI helps teams list what an agent can reach, set approval points, set up logging and review, and test the controls before launch. Kriv does not promise that any control stops every attack.
Talk to the team that would do the work
Bring your requirements to a working session with the person who'll actually deliver.
Book a Discovery Call