Guardrails are the checks around the model that keep a system inside its job. They're ordinary code and configuration, and they work whatever the model happens to do.
On the way in: is the request in scope for this assistant? Does it contain personal or payment data that shouldn't be sent on, or should be masked? Does a document contain instruction-like text that should be flagged?
On the way out: does the reply parse and match the schema? Does it stay within policy (no promises you can't keep, no legal or medical advice if that's out of scope)? Are its claims supported by the sources it cites?
Around actions: this is where guardrails matter most. Allow only listed tools. Check every argument against your own rules, not the model's judgement: a refund can't exceed the amount paid, an email can only go to the customer on the ticket, a delete needs a person's approval. Give each tool the least access it needs.
def allowed(action, args, order):
if action not in {"lookup_order", "issue_refund"}:
return False, "unknown tool"
if action == "issue_refund" and args["amount"] > order["paid"]:
return False, "refund is more than was paid"
if action == "issue_refund" and args["amount"] > 100:
return False, "needs a person's approval"
return True, "ok"
order = {"paid": 45.50}
print(allowed("issue_refund", {"amount": 45.50}, order))
print(allowed("issue_refund", {"amount": 500}, order))
print(allowed("delete_account", {}, order))
Prints
(True, 'ok')
(False, 'refund is more than was paid')
(False, 'unknown tool')
Budgets are guardrails too: a ceiling on steps, tokens, time and money per task and per day, so a bug can't run up a bill overnight.
Log everything an automated system does: the input, each model call, each tool call with its arguments and result, and the final output. When something goes wrong, the log is how you find out what happened and prove what didn't.
Practice
Using allowed from the lesson with order = {"paid": 45.50}, what does this print?
def allowed(action, args, order):
if action not in {"lookup_order", "issue_refund"}:
return False, "unknown tool"
if action == "issue_refund" and args["amount"] > order["paid"]:
return False, "refund is more than was paid"
if action == "issue_refund" and args["amount"] > 100:
return False, "needs a person's approval"
return True, "ok"
print(allowed("issue_refund", {"amount": 20}, {"paid": 45.50})[0])
More info
Quick reference
Input checks
Scope, personal data, suspicious instructions.
Output checks
Schema, policy, supported claims.
Action checks
Allowed tools, argument rules, approvals, least access.