# AI guardrail > VI: https://5ac.vn/wiki/guardrail/ · EN: https://5ac.vn/en/wiki/guardrail/ · lang: en · spec_as_of 2026-10-19 (spec no formal spec) · cluster C13 An enforcement mechanism outside the model that monitors and controls AI agent interactions: input and output filters, approval gates, cost ceilings and kill switches. --- ## Definition An AI guardrail is an enforcement mechanism placed outside the large language model: it monitors and controls the agent's interactions — filtering incoming requests, blocking outgoing answers, or stopping an action before it runs. Two research lines back this reading. The position paper *Building Guardrails for Large Language Models* (arXiv:2402.01822) treats guardrails as input and output filters for the model and names Llama Guard, NeMo Guardrails and Guardrails AI as the open-source solutions already in the field. The systematization *SoK: Evaluating Jailbreak Guardrails* (arXiv:2506.10597) defines guardrails as external defense mechanisms that monitor and control LLM interactions, and reports that the field is still fragmented, with no shared taxonomy. The concrete components — identity, permissions, audit logs, sandboxing — already live in the [Agent orchestration](/en/wiki/agent-orchestration/) entry as component clauses, so this entry only says where guardrails sit in the agent's loop and what they trade away. ## Mechanism Guardrails act at four points in the agent's loop: | Where it acts | What it stops | What happens without it | | --- | --- | --- | | Input | harmful or out-of-scope requests | instructions embedded in data reach the model unchallenged | | Between steps | approval gates for high-risk actions, rights by role | the agent sends a bulk email or rewrites order data on its own | | Output | a check of the answer before a customer sees it | a wrong answer leaves the building with nobody reviewing it | | Budget | a cost ceiling, retry limits and a kill switch per workflow | the invoice grows quietly and cannot be traced to a workflow | The trade-off is real: the Security–Efficiency–Utility framework in the SoK paper scores a guardrail on all three at once, so every extra layer of blocking costs speed. 5ac's multi-agent OS piece says the same in one line: a strong agent without guardrails creates risk, a guardrail too rigid destroys speed. Observability rides alongside guardrails in the [Multi-agent OS](/en/wiki/multi-agent-os/) entry — without logs you cannot tell what your blocking layer blocked. ## Application context Three tiers of guardrails by effect, drawn from 5ac's articles: - **Workflow tier — cost control.** 5ac's control-plane checklist demands a cost ceiling, a frequency limit and an alerting rule for every workflow; if you cannot measure cost by workflow, you should not scale yet. - **Action tier — permissions and approval.** The AI agents platform piece requires control over which agent may touch which tool, a log of every action, and an approval gate for high-risk operations. - **System tier — market-level kill switches.** The agentic bank run piece notes that today's guardrails (a walled wallet, prefunding, per-action notifications, an off switch) sit on the account rather than on behavior, and quotes Deputy Governor Sarah Breeden (June 2026) asking for guardrails "analogous to circuit breakers or kill switches." The path for a small business: start at the workflow tier with a cost ceiling and logs, then move to the action tier with approval gates. Without logs, adding guardrails only slows the system down without reducing risk. ## Sources fetched - [AI Agents Platform: Complete Guide for Business (2026)](/en/blog/ai-agents-platform/) — tool access with guardrails, security boundaries between agents — accessed 2026-10-19 - [What Is a Multi-Agent OS? The Enterprise Architecture Behind Reliable AI Agents](/en/blog/what-is-multi-agent-os/) — speed versus control, permissions and approval steps — accessed 2026-10-19 - [The Agentic Bank Run: Why AI Cash Optimization Is One Integration Away](/en/blog/agentic-bank-run-ai-cash-optimization/) — guardrails on the account, circuit breakers at market level — accessed 2026-10-19 - [The Agent Control Plane War Has Begun — Why Vietnamese SMBs Should Choose Open Source Over AI Super Apps](/en/blog/agent-control-plane-war-vietnam-smb/) — cost guardrails: cost ceiling, frequency limit and alerting per workflow — accessed 2026-10-19 - — Building Guardrails for Large Language Models (v2) — verified via arXiv API 2026-10-19 - — SoK: Evaluating Jailbreak Guardrails for Large Language Models (v2) — verified via arXiv API 2026-10-19 ## Related - [Agent orchestration](/en/wiki/agent-orchestration/) - [Multi-agent OS](/en/wiki/multi-agent-os/) - [Agent governance](/en/wiki/agent-governance/) - [AI Agent](/en/wiki/ai-agent/) - [Business automation](/en/wiki/business-automation/)