What are AI agent guardrails? (And why prompts don't count)

What counts as a guardrail

A guardrail is a check that runs outside the model, on a path the agent cannot rewrite. The OpenAI Agents SDK implements this as tripwires: an input, output, or tool guardrail sets tripwire_triggered, the runner raises InputGuardrailTripwireTriggered, and the run halts before the tool call lands. NVIDIA NeMo Guardrails splits the same job across five rails (input, retrieval, dialog, execution, output). Amazon Bedrock Guardrails ships six filter types, including denied topics, sensitive information filters and contextual grounding checks, and can be called through ApplyGuardrail without invoking a model at all.

Approval gates decay into rubber stamps

The gate most teams put the most weight on is the one that erodes fastest. Across 40,000 simulated agent sessions and 409,000 approve or deny decisions, reviewers judged commands at 66.3% accuracy. Scope violations slipped through 35.0% of the time, exfiltration and code execution 33.4%. One benign-looking command, npm run analyze, was approved by 64.7% of reviewers. Treat human approval as a scarce control: spend it on irreversible actions (payment, external email, production write) and let deterministic policy handle the rest.

What to ask for in review

Ask where enforcement runs, not what the system prompt says. Prompt instructions and untrusted tool output share one context window, which is why a detector advertising 95% catch rate is a failing grade by web security standards. Scope is the control that holds: an agent that combines private data access, exposure to untrusted content and a way to send data outward needs one of those three removed, not a classifier bolted on top. Then require an append-only record of every allow, block and escalate decision, because that record is the SOC 2 and ISO 27001 evidence.