# AI guardrails explained: what input and output filtering can and cannot do

- **Published:** 2026-07-15
- **Updated:** 2026-10-12
- **Category:** Security & Governance
- **Author:** Sinthetix
- **URL:** https://sinthetix.com/blog/ai-guardrails-input-output-filtering-explained

> Guardrails screen what goes into and out of an AI system. A plain-English guide to the five checkpoints, what the evidence says, and where they fall short.

A language model will answer almost anything it is asked and will say almost anything it can generate. Guardrails are the checks that sit around it so that a business application only accepts appropriate requests and only returns appropriate answers. They are worth understanding before you buy or build an assistant, because they are often described as a complete safety solution and are not one.

**Key takeaways**

- Guardrails are checks placed at specific points in an AI workflow: before the model, on retrieved documents, across a conversation, at tool calls, and after the model responds.
- In Anthropic's published tests, classifier-based filtering cut jailbreak success from 86% to 4.4%, at a cost of 23.7% more compute.
- The UK NCSC warns that prompt injection may never be fully mitigated, so guardrails should reduce risk while deterministic limits on what the system can do carry the load.

## The five checkpoints

NVIDIA's open-source NeMo Guardrails documentation is a useful reference because it names where checks run, using the term "rails" [1][2].

| Checkpoint | When it runs | Typical job |
| --- | --- | --- |
| Input | Before the model is called | Content safety, jailbreak detection, topic control, masking personal data [2] |
| Retrieval | After documents are fetched in a RAG pipeline | Filter or validate retrieved content so the model sees only trusted context [2] |
| Dialog | Across a multi-turn conversation | Keep the exchange on approved flows and policies [2] |
| Execution | At tool or function calls | Validate arguments and results when the system touches external systems [2] |
| Output | After the model responds | Filter, edit or block the answer; remove sensitive data; check facts [2] |

The same documentation notes that input and output rails are the most common [2].

## A concrete example

Imagine an assistant that answers customer questions about orders for a distributor (an illustration, not a case study). An input check stops requests to reveal internal pricing rules or to ignore its instructions. A retrieval check makes sure it only reads current, approved product documents. An execution check confirms that a refund request is for the logged-in customer and under a set limit before the system calls the payments tool. An output check strips any account number that slipped into the reply. Each layer catches something the others might miss.

## What the evidence says

Filtering works, with a price. Anthropic tested a classifier system on 10,000 synthetic jailbreak prompts against Claude 3.5 Sonnet. Without classifiers, 86% of jailbreak attempts succeeded; with them, 4.4% did. The extra refusals on ordinary traffic rose by 0.38%, which was not statistically significant, but compute cost rose 23.7% [3].

**Jailbreak success rate with and without classifier guardrails**

10,000 synthetic jailbreak prompts, Claude 3.5 Sonnet

Unit: %

| Category | Jailbreak success rate |
| --- | --- |
| No classifiers | 86% |
| With classifiers | 4.4% |

*Anthropic automated evaluation, October 2024 model; the system was later put to human red-teaming with mixed results. Source: [3], Anthropic*

Human testing was less clean. In a public demo in February 2025, 339 jailbreakers made over 300,000 chats; one participant found a universal jailbreak and another a borderline one [3]. Good filters raise the cost of an attack, not remove it.

## Where guardrails fall short

The UK National Cyber Security Centre makes the sharpest point. Unlike SQL injection, which can be fixed at the root, large language models have no built-in separation between instructions and data, and the NCSC suggests prompt injection may never be fully mitigated. Its guidance is to reduce likelihood and impact, use deterministic non-LLM safeguards to constrain what the system can do, be wary of deny-lists that attackers can rephrase around, be sceptical of vendors claiming to "stop" prompt injection, and log inputs, outputs and tool calls [4].

False positives are the other cost: a filter that blocks legitimate requests, such as routine code analysis or debugging queries, frustrates users and creates support tickets. A guardrail that is too strict is a support ticket generator.

## What to ask a vendor

- Which of the five checkpoints do you cover, and which are left to us?
- What can the system do if a filter is bypassed? Limits on tools and data access matter more than the filter.
- How do you measure false positives, and can we see logs of blocked requests?

## Practical implication

Use guardrails as one layer, and design the assistant so that its worst-case behavior is acceptable even when a filter fails: narrow tool permissions, spending limits and human approval for irreversible actions.

## Sources

1. [NVIDIA NeMo Guardrails: Overview](https://docs.nvidia.com/nemo/guardrails/latest/about/overview.html), NVIDIA
2. [NVIDIA NeMo Guardrails: Guardrail types](https://docs.nvidia.com/nemo/guardrails/latest/about/rail-types.html), NVIDIA
3. [Constitutional Classifiers: Defending against universal jailbreaks](https://www.anthropic.com/research/constitutional-classifiers), Anthropic, 2025-02-13
4. [Prompt injection is not SQL injection (it may be worse)](https://www.ncsc.gov.uk/blog-post/prompt-injection-is-not-sql-injection), UK National Cyber Security Centre, 2025-12-08

## How Sinthetix helps

An engineering studio for AI agents, automation, and internal tooling. We build the systems that make operators scale.

[Our services](https://sinthetix.com/services) | [Talk to us](https://sinthetix.com/contact)

Sinthetix is an AI engineering studio. We ship agents, automation, and internal tools for operators who need results, not reports. [About Sinthetix](https://sinthetix.com/about)