05 Feb 2025 AI Engineering5 min read

Guardrails Engineering for LLM Systems

Guardrails for LLM systems in early 2025 are a layered engineering discipline: PII redaction with Presidio, output filtering with Llama Guard 3 and moderation APIs, human approval for irreversible actions, and versioned policies with attack, benign, and regression suites in CI. The key is to measure miss rates and state the limits of every layer.

Why guardrails are an engineering discipline

A system prompt is not a security control; it is merely an instruction to a probabilistic model. In February 2024, Canada's Civil Resolution Tribunal held Air Canada liable for a bereavement discount invented by its support chatbot. The airline's argument that the chatbot was "a separate legal entity" failed, and it paid CA$812.02 in damages and fees. The broader lesson is sober: you remain responsible for output delivered under your domain.

The OWASP Top 10 for LLM Applications, revised in November 2024, ranks prompt injection first (LLM01:2025) and sensitive information disclosure second (LLM02:2025). Neither has a model-level fix; system-prompt restrictions "may not always be honored" is OWASP's own wording. Guardrails engineering treats this as a systems problem: deterministic controls arranged around a probabilistic component. This article describes the patterns, with their limits stated.

Untrusted input arrives — treat it as data, not instructions. 1/4

Layered policies instead of one big filter

No single filter is sufficient. A moderation classifier does not detect personal data. A regular expression does not understand paraphrase. A human reviewer cannot scale to every request. A layered approach accounts for these known miss rates and arranges the controls so that their gaps do not overlap. Five layers cover most systems we build:

Two rules make layering effective. First, every layer fails closed: if the PII service is unreachable, the request stops instead of merely raising a warning. Second, the layers remain independent; the output filter does not inherit the input filter's verdict without checking again. This design does not eliminate risk, but it divides an open-ended failure surface into a small set of measurable, testable miss rates.

Layer	Purpose	Typical mechanism	Known limitation
Input policy	Reject disallowed requests before inference	Moderation classifier on the prompt	Misses novel phrasing and indirect injection
PII boundary	Pseudonymize personal data in both directions	Pattern matching plus NER (e.g. Presidio)	Recall below 100% on free text
Output filter	Check generated content against policy	Safety classifier plus deterministic rules	Blind to factual errors
Action gate	Hold consequential tool calls	Allowlists and human approval queues	Approval fatigue
Audit trail	Reconstruct every decision later	Structured logs of all verdicts	Detects only after the fact

PII redaction at the trust boundary

Personal data should be pseudonymized before it crosses the trust boundary to a model API and re-identified only inside the trusted zone. Microsoft Presidio, open-sourced in 2019, is a solid baseline: pattern recognizers for structured identifiers such as IBANs, credit card and phone numbers, NER models for names and addresses, and custom recognizers for domain identifiers such as insurance or patient numbers.

Be honest about recall. No detector finds every identifier in free text; German compound nouns and contextual identification — "the patient from the Hamburg branch with the rare diagnosis" — defeat pattern matching entirely. Redaction reduces exposure. It does not by itself produce anonymous data in the GDPR sense; treat redacted text as pseudonymized, keep the mapping table out of the logs, and record what was replaced.

Output filtering with classifiers

Filtering the model's answer is a different task from filtering the user's question, and it needs its own layer. Two releases defined the 2024 baseline. Meta's Llama Guard 3 (July 2024), an 8B classifier fine-tuned from Llama 3.1, labels prompts and responses against 14 hazard categories aligned with the MLCommons taxonomy; a 1B variant (September 2024) runs on modest hardware. OpenAI's omni-moderation model (September 2024) classifies text and images across 13 categories with calibrated probability scores, free of charge.

Their scope must remain explicit. These classifiers detect policy violations such as hate or self-harm content, but not factual errors, invented prices, or subtly wrong professional advice. Those require deterministic checks: schema validation for structured output, URL allowlists, and claim verification against source documents. A safety classifier that lets a hallucinated discount through has not malfunctioned; it has performed its narrower job exactly as specified.

Human approval for consequential actions

Agentic systems turn text generation into action: sending mail, changing records, issuing refunds. We classify every tool by reversibility and blast radius. Read-only tools run freely. Reversible writes run with structured logging. Irreversible or externally visible actions — payments, deletions, outbound communication — require explicit human approval before execution, not after.

Regulation points the same way. Article 14 of the EU AI Act (Regulation 2024/1689, in force since 1 August 2024) requires effective human oversight for high-risk systems. Design approval against fatigue: a reviewer who confirms 200 requests per day is a click, not a control. Keep approval queues short, present the diff rather than the transcript, and escalate only genuine decisions.

Guardrails as code with tests

A policy that lives in a wiki is not a guardrail. We version policies in the repository next to the application code: machine-readable rules, reviewed in pull requests, deployed like any other artifact. NVIDIA NeMo Guardrails (open source since April 2023) and the Guardrails AI validator framework support this style; a thin in-house layer over classifier APIs works as well.

Only tests make the miss rates visible. We maintain three suites: attack cases from prompt-injection corpora and PII probes that must be blocked; benign cases that must pass, because over-blocking is also a defect; and regression cases distilled from production incidents. Every policy change runs all three suites in CI, and a falling block rate fails the build. Without that evidence, a guardrail change remains a guess.

Measure in production too. Log every verdict — layer, rule, score, action — as a structured event. Sample blocked and passed traffic weekly and label it manually; the gap between offline test performance and production performance tells you when your corpora have gone stale. Test suites age faster than code.

Outlook from January 2025

Two days after this article appears, on 2 February 2025, the first obligations of the EU AI Act apply: prohibited practices and AI literacy. Codes of practice for general-purpose models are due later in 2025. We expect guardrails to move from an optional layer to an audited one, with ISO/IEC 42001:2023 as the surrounding management standard.

Technically, we expect three developments: smaller guard models cheap enough to screen every request locally; shared hazard taxonomies such as MLCommons replacing vendor-specific category lists; and guardrail test suites becoming contractual deliverables, much like penetration tests today. One forecast seems especially robust: prompt injection will not be solved in 2025. Systems must therefore be designed to contain the weakness, not to assume it will disappear.