05 Feb 2025 AI Engineering 5 min read

Guardrails Engineering for LLM Systems

How we build guardrails for LLM systems as of early 2025: layered policies with known miss rates, PII redaction with Presidio, output filtering with Llama Guard 3 and moderation APIs, human approval gates for irreversible actions, and guardrails versioned as code with attack, benign, and regression test suites in CI.

Why guardrails are an engineering discipline

A system prompt is not a security control. It is a request. In February 2024, Canada's Civil Resolution Tribunal held Air Canada liable for a bereavement discount its support chatbot had invented; the airline's argument that the chatbot was "a separate legal entity" failed, and it paid CA$812.02 in damages and fees. The lesson generalizes: whatever a model emits under your domain, you own.

The OWASP Top 10 for LLM Applications, revised in November 2024, ranks prompt injection first (LLM01:2025) and sensitive information disclosure second (LLM02:2025). Neither has a model-level fix; system-prompt restrictions "may not always be honored" is OWASP's own wording. Guardrails engineering treats this as a systems problem: deterministic controls arranged around a probabilistic component. This article describes the patterns, with their limits stated.

Untrusted input arrives — treat it as data, not instructions. 1/4

Layered policies instead of one big filter

No single filter suffices. A moderation classifier does not see personal data. A regular expression does not understand paraphrase. A human reviewer does not scale to every request. Layering accepts that each control has a known miss rate and arranges the controls so that their misses do not coincide. Five layers cover most systems we build:

Two rules make layering work. First, every layer fails closed: if the PII service is unreachable, the request stops; it does not proceed with a warning. Second, layers stay independent: the output filter must not trust the input filter's verdict. Layering does not eliminate risk. It converts an unbounded failure surface into a small set of measurable and testable miss rates.

Layer	Purpose	Typical mechanism	Known limitation
Input policy	Reject disallowed requests before inference	Moderation classifier on the prompt	Misses novel phrasing and indirect injection
PII boundary	Pseudonymize personal data in both directions	Pattern matching plus NER (e.g. Presidio)	Recall below 100% on free text
Output filter	Check generated content against policy	Safety classifier plus deterministic rules	Blind to factual errors
Action gate	Hold consequential tool calls	Allowlists and human approval queues	Approval fatigue
Audit trail	Reconstruct every decision later	Structured logs of all verdicts	Detects only after the fact

PII redaction at the trust boundary

Personal data should be pseudonymized before it crosses the trust boundary to a model API and re-identified only inside the trusted zone. Microsoft Presidio, open-sourced in 2019, is a solid baseline: pattern recognizers for structured identifiers such as IBANs, credit card and phone numbers, NER models for names and addresses, and custom recognizers for domain identifiers such as insurance or patient numbers.

Be honest about recall. No detector finds every identifier in free text; German compound nouns and contextual identification — "the patient from the Hamburg branch with the rare diagnosis" — defeat pattern matching entirely. Redaction reduces exposure. It does not by itself produce anonymous data in the GDPR sense; treat redacted text as pseudonymized, keep the mapping table out of the logs, and record what was replaced.

Output filtering with classifiers

Filtering the model's answer is a different task from filtering the user's question, and it needs its own layer. Two releases defined the 2024 baseline. Meta's Llama Guard 3 (July 2024), an 8B classifier fine-tuned from Llama 3.1, labels prompts and responses against 14 hazard categories aligned with the MLCommons taxonomy; a 1B variant (September 2024) runs on modest hardware. OpenAI's omni-moderation model (September 2024) classifies text and images across 13 categories with calibrated probability scores, free of charge.

Scope this honestly: these classifiers detect policy violations such as hate or self-harm content. They do not detect factual errors, invented prices, or subtly wrong professional advice. For those you need deterministic checks: schema validation of structured output, allowlists for URLs, and claim checks against a source document. A safety classifier that passes a hallucinated discount has worked exactly as designed.

Human approval for consequential actions

Agentic systems turn text generation into action: sending mail, changing records, issuing refunds. We classify every tool by reversibility and blast radius. Read-only tools run freely. Reversible writes run with structured logging. Irreversible or externally visible actions — payments, deletions, outbound communication — require explicit human approval before execution, not after.

Regulation points the same way. Article 14 of the EU AI Act (Regulation 2024/1689, in force since 1 August 2024) requires effective human oversight for high-risk systems. Design approval against fatigue: a reviewer who confirms 200 requests per day is a click, not a control. Keep approval queues short, present the diff rather than the transcript, and escalate only genuine decisions.

Guardrails as code with tests

A policy that lives in a wiki is not a guardrail. We version policies in the repository next to the application code: machine-readable rules, reviewed in pull requests, deployed like any other artifact. NVIDIA NeMo Guardrails (open source since April 2023) and the Guardrails AI validator framework support this style; a thin in-house layer over classifier APIs works as well.

Tests make the miss rate visible. We maintain three suites: attack cases that must be blocked, drawn from prompt-injection corpora and PII probes; benign cases that must pass, because over-blocking is also a defect; and regression cases distilled from production incidents. Every policy change runs all three in CI. A block rate that drops fails the build. Without tests, a guardrail change is a guess.

Measure in production too. Log every verdict — layer, rule, score, action — as a structured event. Sample blocked and passed traffic weekly and label it manually; the gap between offline test performance and production performance tells you when your corpora have gone stale. Test suites age faster than code.

Outlook from January 2025

Two days after this article appears, on 2 February 2025, the first obligations of the EU AI Act apply: prohibited practices and AI literacy. Codes of practice for general-purpose models are due later in 2025. We expect guardrails to move from an optional layer to an audited one, with ISO/IEC 42001:2023 as the surrounding management standard.

Technically, we expect three developments: smaller guard models cheap enough to screen every request locally; shared hazard taxonomies such as MLCommons replacing vendor-specific category lists; and guardrail test suites becoming a contractual deliverable, the way penetration tests are today. One prediction we make with confidence: prompt injection will not be solved in 2025. Systems designed on the assumption that it will be are the ones that will make the news.