What are AI guardrails?

By Dylan Bailey, Certified Claude Expert · Updated 4 August 2026 · 5 min read

"Guardrails" gets used loosely enough to mean almost nothing. It's worth being precise, because the guardrails that protect a business are mostly not the ones people picture.

Four layers, weakest to strongest

1. Model behaviour. What the provider trained in — refusing harmful requests, resisting manipulation. Genuinely valuable, and entirely generic. It has no idea what your business considers acceptable.

2. Instructions. Your system prompt: never quote prices, always flag uncertainty, never give legal advice. Useful and free, but it's the softest layer — instructions can drop out of a long conversation or be undermined by text the model reads.

3. Access limits. What the assistant can actually reach. This is where instructions become structural: an assistant that was never granted the finance folder cannot be talked into opening it, no matter what anyone types.

4. Approval gates. What requires a human before it happens. The strongest layer, because it doesn't depend on the AI behaving correctly at all.

Most discussion focuses on layer two. Most protection comes from layers three and four.

The line that matters most

Draw it between producing and doing.

• Producing — drafting, summarising, analysing, suggesting. If it's wrong, a person reads it and it goes no further. Safe to automate freely.
• Doing — sending, paying, publishing, deleting, committing. If it's wrong, it has already happened.

Nearly every AI incident worth reading about crossed that line without anyone deciding to. Keeping a person on the "doing" side is the highest-value guardrail available, and it costs almost nothing.

An Australian small-business example

A Melbourne wholesaler sets up an assistant to answer stock enquiries: read the inventory system, draft a reply, send it.

It works well until a customer asks about an item whose record is mid-update. The assistant reads a partial figure, drafts a confident reply promising stock that isn't there, and sends it — because sending was automated.

The same setup with drafts held for review would have produced a wrong draft someone corrected in ten seconds. Identical AI behaviour, entirely different outcome, and the only difference was where the approval sat.

Setting them without strangling it

• Scope access to the task. An assistant handling maintenance requests needs that inbox, not the whole mail system.
• Automate producing, gate doing. The simplest rule that covers most risk.
• Make refusal explicit. Tell it what to do when unsure — say so and stop, rather than guess.
• Keep a record of actions. If an assistant does things, you want to know what it did.
• Test the edges. Try to make it misbehave. Untested guardrails are assumptions.
• Don't over-gate. If routine work needs approval, people stop using the system — and you've traded a small risk for no benefit.

The useful reframe

Guardrails aren't about distrusting AI. They're the same discipline you'd apply to a capable new starter: clear scope, access to what the job needs, and someone checking the things that can't be undone.

Nobody would call that distrust. It's just how you let someone get on with work without betting the business on them never having a bad day.