AI Guardrails
Asking a model to police itself is not a safety boundary. This breaks down the layers a guardrail stack needs, where prompt injection gets in, and why permissions and approvals must live outside the model in deterministic code.
System prompts share one language space with user input, so injection can rewrite judgement; guardrails belong outside the model: inputs checked, context isolated by source, tool calls allowlisted, high-risk actions behind approval. Constitutional Classifiers++ holds the extra compute of jailbreak defence near 1%, OpenAI pushes defence to the action layer. Guardrails stop no attack outright, they confine failure to a permission boundary.
