An AI agent guardrail is a runtime-enforced mechanism that validates and monitors how an agent interacts with its environment. It acts as a control set to define risks, identify where to intervene, and dictate responses like blocking execution or alerting admins when safety criteria are breached. These guardrails stop jailbreaks, prompt injection, toxic language, and unauthorized tool use. They also help optimize costs by selectively invoking models.
Guardrails function as interceptors. They evaluate content at specific points in the execution loop to prevent unsafe actions.
Checks usually happen at common intervention points: * User inputs * Tool calls * Tool responses * Final agent outputs
In the OpenAI Agents SDK, guardrails use functions returning a `GuardrailFunctionOutput`. Developers apply `@input_guardrail` or `@output_guardrail` decorators to set execution modes. Blocking runs before the agent to save costs. Parallel runs concurrently for lower latency. The logic evaluates input or output, such as checking for invalid logic. If the function flags an issue by setting `tripwire_triggered` to `true`, the SDK raises an exception to halt execution.
Other systems like CodeBolt and AgentOS use hook-based mechanisms, such as `before_tool_call`. These return verdicts like allow, deny, or sanitize based on custom logic or predefined manifests.
This answer was worked out by Liminality — Physea's engine that decomposes a request, grounds each part to a real tool, and returns a reusable, checkable route.
Connect it over MCP: https://mcp.physea.ai/mcp · physea.ai