Responsible-AI Guardrails
Ship AI features that stay safe under real-world input with moderation, boundaries, and a human in the loop where it counts.
Guardrails are the checks that keep an AI feature safe, on-topic, and honest when it meets input you never anticipated. They are a product requirement, not a nice-to-have — and they belong on both the way in and the way out.
Moderate inputs and outputs
Screen user input for abuse, and screen model output before it reaches a user or triggers an action. Many providers offer a moderation endpoint; a well-crafted check can also be an LLM call of its own. Decide up front what your app will refuse to do, and enforce it in code, not just in the prompt.
Set explicit boundaries
Tell the model, in the system prompt, what is in and out of scope: the topics it covers, the tone it uses, what it must never claim (medical, legal, or financial advice, for many products), and how to decline. Then verify — a determined user will try to push past a prompt-only boundary, so back it with output checks.
Keep a human in the loop where stakes are high
For consequential decisions — hiring, lending, moderation bans, medical triage — the model assists a person; it does not decide alone. Design the workflow so a human reviews and can override.
Be transparent and log
Tell users they are talking to AI. Log prompts and outputs (minding privacy rules) so you can audit incidents, spot drift, and improve. When the model is uncertain, prefer saying so over guessing.
Example
async function safeReply(userInput) {
// 1. Screen input before spending a full generation on it.
if (await isAbusive(userInput)) {
return { blocked: true, message: "Let's keep it respectful." };
}
const draft = await llm.create({
system: "You are a support assistant. Never give medical, legal, or financial advice. If asked, decline and suggest a professional.",
messages: [{ role: "user", content: userInput }],
});
// 2. Screen OUTPUT in code — the prompt boundary is not enough on its own.
const check = await moderate(draft.text);
if (!check.allowed) {
log("guardrail_block", { userInput, reason: check.reason });
return { blocked: true, message: "I can't help with that here." };
}
// 3. High-stakes actions get a human, not an autonomous model decision.
return { blocked: false, message: draft.text };
}When to use it
- A children's tutoring app runs every AI reply through a content classifier before display and falls back to a safe default message if any category is flagged.
- A finance chatbot detects when the model's reply includes specific financial advice keywords and automatically appends a 'not financial advice' disclaimer.
- An autonomous agent checks that every tool call it attempts is on the pre-approved list and escalates to a human reviewer for anything outside that list.
More examples
Input and output moderation pipeline
Screens both the user message and the model reply through the moderation API, blocking either if flagged.
from openai import OpenAI
client = OpenAI()
def moderate(text: str) -> bool:
return client.moderations.create(input=text).results[0].flagged
def guarded_chat(user_msg: str) -> str:
if moderate(user_msg):
return 'Your message could not be processed.'
reply = client.chat.completions.create(
model='gpt-4o-mini',
messages=[{'role':'user','content':user_msg}]
).choices[0].message.content
if moderate(reply):
return 'The response was filtered for safety.'
return reply
print(guarded_chat('What are some fun science experiments?'))Topic restriction via system prompt
Uses the system prompt to restrict the agent to a specific domain, redirecting off-topic questions gracefully.
from openai import OpenAI
client = OpenAI()
SYSTEM = (
'You are a cooking assistant. '
'Only answer questions about food, recipes, and cooking techniques. '
'If asked about anything else, politely decline and redirect to cooking topics.'
)
for question in ['How do I make pasta carbonara?', 'What is the meaning of life?']:
r = client.chat.completions.create(
model='gpt-4o-mini',
messages=[{'role':'system','content':SYSTEM},
{'role':'user','content':question}]
)
print(f'Q: {question}\nA: {r.choices[0].message.content[:100]}\n')Require human approval for high-stakes actions
Pauses before executing any tool in the HIGH_STAKES set and requires explicit operator approval before continuing.
HIGH_STAKES = {'delete_user', 'process_refund', 'send_bulk_email'}
def guarded_tool_call(tool_name: str, args: dict) -> str:
if tool_name in HIGH_STAKES:
print(f'HIGH-STAKES ACTION: {tool_name}({args})')
approval = input('Operator approval required (yes/no): ').strip().lower()
if approval != 'yes':
return f'Action {tool_name} rejected by operator.'
# Execute the approved action
return f'Executed {tool_name} with {args}'
print(guarded_tool_call('lookup_order', {'order_id': '123'}))
print(guarded_tool_call('process_refund', {'order_id': '123', 'amount': 49.99}))
Discussion