Guardrails for LLMs are software filters around a language model that check the incoming request and the outgoing response: do they contain an attack, a forbidden topic, personal data, toxic text? For a chatbot this is often enough. For an AI agent it is not: an agent not only writes text but also calls tools, and the danger lies in the action, not the word. Actions are checked by a different mechanism, an action gate.
In brief
- Guardrails check text: the model’s input and output, with rules, classifiers or a second model.
- A second, supervising model errs probabilistically, just like the first: it reads the same text and can be fooled by the same trick.
- An action gate checks the tool call, a finite set of parameters, against a rule, deterministically, without a language model.
- The gate does not judge text: it does not know whether a response is polite or true; it answers only one question: is the action admissible?
- You need both: guardrails for the conversation, a gate for actions.
What are guardrails?
Guardrails are a layer of checks around a language model. Typical tasks:
- on input: detect prompt injection, attempts to “remove restrictions”, requests on forbidden topics, personal data in the request;
- on output: block toxic text, leaks of secrets or personal data, answers outside the permitted topics, the wrong format.
They are implemented in different ways: regular expressions and lists, classifiers, a separate moderator model (for example, Meta’s Llama Guard, a model for classifying requests and responses), programmable dialogue flows (NVIDIA’s NeMo Guardrails). The Russian regulator sets the same tasks: paragraph 61 of FSTEC Order No. 117, now in force, requires AI services in state information systems to define templates or permitted topics for requests and responses and to monitor compliance with them (see the page about Order No. 117, in Russian).
Why does a second, supervising neural network err just like the first?
Because it solves the same problem in the same way: probabilistically, from text.
- The same material. The filter model reads the same request as the main model. An instruction hidden in a document may be addressed to it as well.
- A probabilistic answer. A classifier gives a score with some error. Rephrase, switch the language or the encoding, and the score changes.
- No guarantee of completeness. In its description of risk LLM01:2025, OWASP states directly that “it is unclear if there are fool-proof methods of prevention for prompt injection.”
- The supervisor is no richer than the supervised. By the law of requisite variety (W. Ross Ashby), a regulator must have at least as much variety as the system it controls. A supervising model is usually smaller than the main one and inherits its class of errors.
So guardrails are useful for conversation: they reduce the share of bad answers. But they cannot serve as a guarantee for an action. The attacks themselves are covered on the page about prompt injection.
What does an action gate check, and what does it not?
An action gate sits between the agent and its tools. It intercepts a call, such as “delete the directory /data/backup” or “transfer RUB 1.2 million to recipient X”, and compares its parameters with a rule a human has approved.
It checks:
- whether the tool is admissible for this task;
- whether the parameters are within permitted limits: path, amount, recipient, export volume;
- whether all the facts the rule needs are known. If a required fact has not been observed, admissibility is not proven, and that is a refusal, not a pass.
It does not check:
- the truth or tone of the model’s response;
- the model’s intentions, or whether it “noticed” the trick;
- actions performed bypassing the gate. That is why the gate is placed in the path: the agent must have no route to the systems that avoids it.
| Guardrails | Action gate | |
|---|---|---|
| What it checks | Request and response text | A tool call with its parameters |
| How | Rules, classifiers, a second model | A rule-contract, deterministic check |
| Answer | A probabilistic score | Admissible / inadmissible, with a reason; repeatable |
| Against injection | Catches known techniques | An action the rule forbids does not pass, whatever the wording, where enforce mode is on |
| What it lets through | New attack wordings | Everything the rule allows; errors in the rule itself |
| Where it is needed | Chatbots, assistants, moderation | Agents with access to data, money, code |
What does this look like in practice?
The MITR gate built by the institute checks the admissibility of a call with an SMT solver against a rule-contract written as data. A language model takes no part in the decision. As of 14 October 2026, a decision under a rule takes 0.95 ms (median), a call with an explanation 4.26 ms; rules are defined for 19 classes of actions. A refusal is enforced where enforce mode is on for a class of actions: on that date, for file deletion; for the other classes the agent receives a warning.
The mathematical basis of this approach is formal verification, covered on the page about formal verification of AI. How the gate fits into the overall architecture is described on the IS 3.0 page.
Can guardrails and a gate be combined?
They should be. They work at different levels:
- Input guardrails cut off known attacks and junk before the model starts planning.
- Output guardrails watch the text a person sees: tone, leaks, format.
- The action gate checks every tool call before execution, regardless of what the filters let through.
- The gate’s decision log makes it possible, after an incident, to reconstruct which action was admitted and under which rule.
In such a scheme, a filter error costs an inaccurate answer, not a deleted database.
Frequently asked questions
What are guardrails in the context of LLMs?
They are software barriers around a language model: checks of incoming requests and outgoing responses for attacks, forbidden topics, data leaks and the wrong format. They are implemented with rules, classifiers or a separate moderator model.
Do guardrails protect against prompt injection?
Partly. They catch known techniques, but they work on the same text as the model and make mistakes with some probability; OWASP writes that it is unclear whether fool-proof prevention methods exist. For agents, it is more reliable to also check the action itself.
How does an action gate differ from guardrails?
Guardrails assess the text of the request and the response, usually probabilistically. An action gate checks a specific tool call with its parameters against an approved rule, deterministically and without a language model; its decision is repeatable and explainable.
What is an AI security gateway?
It is a gateway that sits between an AI application or agent and external systems and checks the requests and actions passing through it. What matters is what exactly it checks: only text (then it is a kind of guardrail) or tool calls with parameters (then it is an action gate).
Are guardrails needed if there is an action gate?
Yes. The gate does not judge text: not the tone, not the truthfulness, not a leak in a response to a person. Guardrails cover the conversation, the gate covers actions; together they protect both levels.
Sources
- OWASP Gen AI Security Project, “LLM01:2025 Prompt Injection”: https://genai.owasp.org/llmrisk/llm01-prompt-injection/
- Order of FSTEC of Russia No. 117 of 11 April 2025 (as amended on 8 May 2026), paragraph 61: http://publication.pravo.gov.ru/document/0001202506170011
- ANO Scientific Research Institute of System Synthesis: MITR gate measurements of 14 October 2026
Checked: 16 October 2026