03 · AI safety and guardrails¶
The practical layer that sits around a model: checks on what goes in, what comes out, and what actions it takes. This module is the "defense" companion to 04 · LLM security, which covers the attacks. Read them in either order.
You'll be able to: explain and design input, output and action guardrails, handle personal data properly, choose between guardrail tools, and use a gateway to control cost and access.
| # | Note | Level | Time |
|---|---|---|---|
| 1 | What are guardrails? | Beginner | 10 min |
| 2 | Jailbreaks | Beginner | 10 min |
| 3 | PII and privacy | Beginner | 12 min |
| 4 | Guardrail frameworks compared | Intermediate | 12 min |
| 5 | LLM gateways | Intermediate | 12 min |
Defense layers¶
No single control stops every attack. Each layer below reduces specific OWASP risks, and together they make a fooled model much less dangerous.
flowchart TB
L1[1 · Design: least agency, narrow tools, no secrets in prompts] --> L2
L2[2 · Access: tenant filters, scoped credentials, user-level permissions] --> L3
L3[3 · Gateway: keys, budgets, rate limits, logging] --> L4
L4[4 · Input guardrails: size, PII masking, injection and jailbreak detection] --> L5
L5[5 · Output guardrails: content safety, PII and secret scanning, schema, grounding] --> L6
L6[6 · Action guardrails: policy checks in tools, human approval] --> L7
L7[7 · Monitoring and evals: traces, alerts, red-team tests every release]| Layer | Main OWASP 2026 risks reduced |
|---|---|
| 1 · Design | LLM03 Excessive agency, LLM08 Hidden context exposure |
| 2 · Access | LLM02 Sensitive info disclosure, LLM09 Vector weaknesses |
| 3 · Gateway | LLM06 Unbounded consumption |
| 4 · Input guardrails | LLM01 Prompt injection, LLM02, LLM06 |
| 5 · Output guardrails | LLM10 Improper output handling, LLM07 Misinformation, LLM02 |
| 6 · Action guardrails | LLM03, ASI02 and ASI09 |
| 7 · Monitoring and evals | All of them, by catching what the other layers miss |
Supply-chain and poisoning risks (LLM04, LLM05) are handled mostly outside the request path: in your build pipeline, dependency choices and data-ingestion process.
Project: P4 · Guardrailed support agent builds layers 3 to 6 and tests each one.
Next: 04 · LLM security