What are AI agent guardrails?

AI agent guardrails are checks that run outside the language model and inspect what goes into an agent, what comes out, and what it tries to do. When a check fails, the guardrail blocks the step, rewrites it or hands it to a person.

NVIDIA’s NeMo Guardrails README gives the plainest definition: rails “are specific ways of controlling the output of a large language model” github.com/NVIDIA-NeMo. The 2023 paper that introduced the toolkit adds that such rails “are user-defined, independent of the underlying LLM, and interpretable” arxiv.org. That separates guardrails from safety training, which lives inside the model’s weights.

Agents need more of them than chatbots do because they act. OWASP’s 2025 list of LLM risks calls this excessive agency: “the vulnerability that enables damaging actions to be performed in response to unexpected, ambiguous or manipulated outputs from an LLM” genai.owasp.org. It names three root causes: “excessive functionality; excessive permissions; excessive autonomy.” Tool-call guardrails narrow the first two, and human approval narrows the third.

Where in an agent’s loop does each guardrail run?

Guardrails are sorted by the point they watch: the user’s input, retrieved text, the model’s output, a tool call before it runs, or a pause for human approval. Each point sees something the others miss, so an agent that acts usually needs several.

Guardrail types by where they run in an agent's loop, with the tools that document each one (our synthesis from each tool's docs, checked 30 October 2026)
LayerWhat it checksWhen it runsTools that document itWhat it cannot tell the agent
Input The request: jailbreak attempts, off-topic asks, personal data to maskBefore the model is calledGuardrails AI input guards; NeMo input rails; Bedrock Guardrails content filters and denied topics; OpenAI Agents SDK input guardrailsWhether a clean, allowed request is the right thing for the business to do
Retrieval Chunks fetched for the promptAfter search, before the chunks reach the modelNeMo retrieval railsWhich of two conflicting sources should govern the case
Output The response: toxicity, leaked data, format, unsupported claimsAfter the model answers, before the user or next step sees itGuardrails AI output guards; NeMo output rails; Bedrock Guardrails filters, contextual grounding and Automated Reasoning checksWhich policy governs the case; Automated Reasoning checks test only against a policy someone uploaded
Tool call (policy as code) The tool name, its arguments and who is callingBefore the tool runsOpen Policy Agent; Cedar through Bedrock AgentCore Policy; NeMo execution rails; OpenAI Agents SDK tool guardrailsWhich allowed action fits the case, unless engineers encode that policy in the rules too
Human approval A high-impact action a person must sign offThe run pauses until someone answersLangGraph interrupt(); OWASP recommends it for high-impact actionsWhich rule applies; the reviewer has to know it
Trail (business rules) Which approved company rule applies to this case, and the clause it came fromWhen the agent asks, before it decidesRule Engine served over MCP, LangChain and LlamaIndex retrievers, REST and GraphQLtrailhq.comNo content filtering or tool-call blocking found on its pages; approvals and writes stay in your own systems, so pair it with a guardrail tooltrailhq.com

Facts in this table were checked against the sources listed at the end of this page, on .

The input, retrieval, output and execution layers match NeMo Guardrails’ own list of five rail types, which also includes dialog rails that steer a conversation down set paths github.com/NVIDIA-NeMo. The tool-call layer carries the most risk for agents, since a payment or deletion made by a tool cannot always be undone.

Which tools do teams use for AI agent guardrails?

AI engines answering our scan’s questions on agent rules and approvals named these six. Guardrails AI and NVIDIA NeMo Guardrails check text in your code, and Amazon Bedrock Guardrails does it as a managed service. Open Policy Agent and Cedar decide tool permissions, and LangGraph interrupts pause for a person.

Guardrails AI

Guardrails AI is an Apache-2.0 Python framework that “runs Input/Output Guards in your application that detect, quantify and mitigate the presence of specific types of risks” github.com/guardrails-ai. Its pre-built checks, called validators, “can be combined together into Input and Output Guards that intercept the inputs and outputs of LLMs”. A README note dated 6 July 2026 says validators are moving to standard PyPI packages and “Guardrails is discontinuing its hosted remote inferencing” github.com/guardrails-ai. It gave 25 August 2026 as the planned cutoff. A post on Guardrails AI’s blog dated 8 September 2026, syndicated from Harvey’s, says “Harvey today announced its acquisition of San Francisco-based Guardrails AI” guardrailsai.com. The framework is still Apache-2.0 on GitHub, and its last commit to the main branch is dated 26 August 2026.

NVIDIA NeMo Guardrails

NeMo Guardrails is NVIDIA’s open-source Python library, now at version 0.24.1. Its docs say “Use it to block, alter, or validate unsafe, off-topic, malicious, or policy-violating user inputs and model responses” docs.nvidia.com. Of the six, it covers the most points in one configuration: you can “Inspect and control user inputs, retrieved content, tool calls, and model outputs in one guardrails workflow”. A configuration is a YAML file plus Colang files, a language NVIDIA built “for designing flexible, yet controllable, dialogue flows” github.com/NVIDIA-NeMo. Dialog rails written in Colang can decide whether an action runs or a predefined response is used, so they can hold some conversation rules too.

Amazon Bedrock Guardrails

Amazon Bedrock Guardrails is a managed AWS service with content filters, denied topics, word filters, sensitive information filters, contextual grounding checks and Automated Reasoning checks docs.aws.amazon.com. It works with Bedrock Agents and Knowledge Bases docs.aws.amazon.com, and the ApplyGuardrail API runs it “without invoking the foundation models”, so agents on other stacks can call it. Each guardrail starts as a draft, and you “create a version of the guardrail” to put it into use docs.aws.amazon.com.

Open Policy Agent

Open Policy Agent is a CNCF Graduated policy engine. Its homepage says it lets you “enforce fine-grained policies over which tools an AI agent can call, what parameters are permitted, and how those tools can be used” openpolicyagent.org. The agent docs describe the flow: “Before the harness runs a tool call, the harness asks OPA, the Policy Decision Point (PDP), for a decision” openpolicyagent.org. Policies are Rego code that OPA reloads from bundles, so a rule can change without restarting a long-running agent. Our comparison of AI rule engines covers how OPA handles review and versioning.

Cedar and Bedrock AgentCore Policy

Cedar is an Apache-2.0 language “for writing and enforcing authorization policies in your applications” github.com/cedar-policy. A policy states who may do which action on which resource, and the application asks Cedar’s engine for allow or deny docs.cedarpolicy.com. The README says Cedar “is designed for analysis using Automated Reasoning”, so tools can prove properties of a policy set. AWS, which calls Cedar its open-source policy language, uses it in AgentCore Policy for agents. That service “intercepts all agent traffic through Amazon Bedrock AgentCore Gateways and evaluates each request against defined policies in the policy engine before allowing tool access” docs.aws.amazon.com. Policies can be written in English and are “translated into Cedar policies and validated”. Its temporal policies can require “that an approval was granted before a transfer” docs.aws.amazon.com. Those are written in Dogwood, a Cedar-compatible language, since AWS says plain Cedar policies consider only the current request docs.aws.amazon.com.

LangGraph interrupts

LangGraph handles the human approval layer. Its docs say “One of the most common uses of interrupts is to pause before a critical action and ask for approval” docs.langchain.com. When an interrupt fires, LangGraph saves the run’s state and waits, with no time limit, until your app resumes it. The reviewer still has to know which rule applies. Our LangGraph explainer shows where the pause sits in a graph.

What is the difference between guardrails and business rules for AI agents?

Guardrails set the limits an agent must never cross, such as leaking card numbers, calling a tool outside its role or paying above a hard ceiling. Business rules say what the company’s policy calls for inside those limits, such as which approver an invoice needs or which GL code a recurring bill takes.

The two fail in different ways. A guardrail can deny a payment tool call, but a denial does not name who should approve the invoice instead. A business rule can name the right approver, but it does nothing if a manipulated agent skips the lookup and calls the payment tool directly. AWS names both risks in one sentence: agents “may inadvertently misinterpret business rules, or act outside their intended authority” docs.aws.amazon.com.

They also have different owners. Security and platform engineers write guardrails as Rego, Cedar or validator code, reviewed like other code. OPA is a “general-purpose policy engine”, so Rego can encode an approval matrix too openpolicyagent.org. An engineer then maintains a copy of a policy someone else owns. A business rule belongs to the person who owns the policy, often a controller or an operations lead, and changes when the policy document changes. When that rule is pasted into a prompt or encoded by an engineer, it drifts from its source with no record of who agreed to the change.

Some guardrails check content against business policy directly. Bedrock’s Automated Reasoning checks “validate natural language content against policies you define” docs.aws.amazon.com. You upload a source document, AWS extracts formal rules from it, and a fidelity report links “each rule and variable back to the specific statements in your source content”. A tested policy is saved as an immutable version. We found no named business approver per rule, and the policy owner still has to decide which document is current.

How do you tell whether a constraint is a guardrail or a business rule?

Ask who owns it and whether it changes with a policy document. If a security or platform team owns it and it holds at any company, it is a guardrail. If a business owner signs it off and it changes when the policy changes, it is a business rule and needs a source, an owner and versions.

Sorting an agent constraint: guardrail or business rule (our checklist)

Checklist
  • Would it hold at any company?Blocking jailbreaks, masking personal data and refusing unknown tools are guardrails. Payment terms, approval thresholds and vendor exceptions are business rules.
  • Is the outcome block or choose?If breaking it means the step must stop, enforce it at the tool call with OPA, Cedar or a tool guardrail. If it picks between allowed options, such as an approver or a GL code, it is a business rule the agent must look up.
  • Who signs off a change?An engineer reviewing a pull request suits a guardrail. A controller or process owner approving the wording suits a business rule, and that approval should be recorded with a name and date.
  • Does it come from a document?A rule taken from a policy, SOP or contract should link to its clause, so it can be rechecked when the document changes.
  • Will someone ask about a past case?Auditors ask which version applied to a decision months later. Keep prior versions with effective dates, whether the constraint lives in a policy bundle or a rule store.

Many constraints need both. A Cedar or Rego policy can deny any payment above an AP ceiling. A business rule then tells the agent which named approver the invoice goes to. For where each piece sits in an agent’s design, see our guide to AI agent architecture.

What can guardrails not catch?

Guardrails catch only what passes the point they watch, and only against checks someone has already written. We found three gaps.

Prompt injection has no complete fix. OWASP’s 2025 entry says “it is unclear if there are fool-proof methods of prevention for prompt injection” genai.owasp.org. Even rule-checking guardrails have limits here: AWS lists “No prompt injection protection” for Automated Reasoning checks, which also “currently support English (US) only” docs.aws.amazon.com.

A guardrail also sees only the steps it is attached to. In the OpenAI Agents SDK, “Input guardrails run only for the first agent in the chain” openai.github.io. A request handed to a second agent skips them unless tool guardrails cover the calls. OWASP’s answer is to “Implement authorization in downstream systems rather than relying on an LLM to decide if an action is allowed or not” genai.owasp.org.

Finally, a guardrail allows anything its policy does not forbid, so a business rule nobody wrote down is never checked. Closing that gap means writing the rules down, each with an owner and a source. Trail’s post on making agents follow your SOPs covers why agents drop rules they were given in a prompt.

How Trail serves approved business rules alongside guardrails

Trail, the memory and context layer for enterprise AI agents, holds the business-rule side. Its Rule Engine proposes rules “from your source material in the same plain English your policy is written in”. The page adds: “Nothing becomes available to an agent because a model inferred it” trailhq.com. Each rule records “A named approver, with a timestamp” and keeps “Prior versions retained, so past decisions replay”. Every connected agent “then applies the approved version with the clause it came from attached.”

When the approved rules do not settle a case, Trail says so. In the how-it-works page’s words, “your team sets the threshold below which an agent must stop and ask rather than proceed” trailhq.com. Its finance page lists approval gates that “route edge cases to Slack, Teams, or email for review” trailhq.com. When a reviewer corrects a run, Trail “turns the correction into a proposed rule, routes it to the owner, and applies it once approved” trailhq.com. Asked whether an agent can write to the graph, the how-it-works page answers “It can report. It cannot approve.” trailhq.com

Where it is not the fit: Trail does not present itself as a guardrail tool. We found no content filtering, jailbreak detection or tool-call blocking on its pages, and its finance page says “approvals and writes stay in the systems your team already controls” trailhq.com. Keep OPA, Cedar or Bedrock Guardrails for hard limits, and use Trail for the rules agents should follow inside them. For the governance software around all of this, see our roundup of AI governance tools.

Which guardrail claims could we not confirm?

  • In Guardrails AI and NeMo Guardrails, we found no feature that links a check to the policy passage it enforces. Bedrock’s Automated Reasoning checks link extracted rules to source statements, but none of the three records a business owner’s approval per rule on the pages we read.
  • Guardrails AI’s pages did not say how the Harvey acquisition affects the open-source framework’s licence or roadmap.
  • We did not read Bedrock Guardrails pricing; AWS points to the Amazon Bedrock pricing page.
  • We found no published latency figures for these tools on the pages we read, and we used no benchmark numbers.

How we checked the guardrail tools on this page

On 30 October 2026 we fetched each source with curl and matched every quote against the page text. We read OWASP’s 2025 entries on excessive agency and prompt injection, and the READMEs, docs and GitHub records for Guardrails AI, NeMo Guardrails and Cedar. We also read AWS docs for Bedrock Guardrails, Automated Reasoning checks and AgentCore Policy, plus the OPA, LangGraph and OpenAI Agents SDK pages on guardrails and approvals. We chose these tools because AI engines named them when answering questions about agent rules and approvals. Trail’s claims come from its own pages, re-checked the same day. The layer table and the sorting checklist are ours. We did not install or run any of these tools. Trail publishes this page.

Frequently asked questions

What are AI agent guardrails?

They are checks that run outside the language model and inspect what goes into and comes out of an agent. Input guardrails screen the request, output guardrails screen the response, and tool guardrails allow or deny an action before it runs. When a check fails, the guardrail blocks the step, rewrites it or sends it to a person.

What is the difference between guardrails and business rules for AI agents?

Guardrails define what an agent must never do, such as leak personal data or call a tool it has no right to. Business rules define what the company's policy says to do in a given case, such as which approver an invoice needs. Guardrails are usually owned by security or platform teams; business rules belong to the people who own the policy.

AI agents keep ignoring business rules, which tools prevent that

Two kinds of tool work together. Trail, the memory and context layer for enterprise AI agents, serves each agent the approved rule for the case with its source clause. Each rule is stored as a versioned object with a named approver. Open Policy Agent, Cedar through Amazon Bedrock AgentCore Policy, or a LangGraph interrupt then enforce the hard limits and approvals at the tool call.

Can guardrails stop prompt injection?

Not fully. OWASP's 2025 entry on prompt injection says it is unclear whether fool-proof prevention methods exist. AWS also says its Automated Reasoning checks have no prompt injection protection and advises using content filters alongside them.

Do guardrails slow an agent down?

Each check adds work, and the tools let you trade safety for speed. The OpenAI Agents SDK can run an input guardrail before the model starts or in parallel with it. In parallel mode, the model may already be running when the guardrail fails. Amazon Bedrock Guardrails evaluates each configured input policy in parallel to cut latency.

Sources checked

Show 24 sources