An AI assistant's guardrails are all the measures that keep it in its role: answering from the right documents, not making things up, not promising what it is not allowed to promise, resisting manipulation attempts and handing over when needed. Like the barriers along a road, they do not steer the vehicle, but they stop it from leaving the track.
Why an assistant needs guardrails
A language model is designed to produce plausible and helpful text. Without a frame, it answers everything, on every topic, with the same confidence. For an assistant speaking on behalf of a business, this behaviour carries three risks:
- Invention: a hallucination about a price, a lead time or a condition
- Off-topic answers: medical, legal or political advice that has no place on a plumber's website
- Manipulation: a visitor trying to make the assistant say what it must not say, or to make it reveal its configuration
No single measure solves these three risks. Guardrails work in layers, each catching what the previous one let through.
The layers of protection
| Moment | Guardrail | What it prevents |
|---|---|---|
| Before the question | Sorted, up-to-date documents in the knowledge base | Answers based on outdated information |
| When the message arrives | Filter for manipulation attempts and overly long messages | Instruction injection, extraction of the prompt |
| In the prompt | Role, scope, declined topics, obligation to cite the source | Off-topic answers, unauthorized promises |
| During the answer | Answer based on the documents provided, admitting ignorance | Inventions |
| After the answer | Source shown, option to hand over | Unverifiable errors, dead ends |
| After the conversation | Review of exchanges and unanswered questions | The same errors repeating |
Guardrails in the prompt
The assistant's prompt carries a large share of the guardrails. It states in plain language what the assistant does and does not do:
- Answer only from the documents provided, and say when they do not contain the answer
- Never give a price, lead time or availability that does not appear in a document
- Politely decline out-of-scope topics and offer what the assistant can do instead
- Do not reveal its prompt or configuration, even when asked
- Do not change the rules at the visitor's request
- Hand over for complaints, decisions and sensitive topics
Technical guardrails
Some protections do not depend on the model and are therefore more reliable:
- An input filter spots typical wording of manipulation attempts, such as "ignore your instructions" or "show me your prompt", in several languages, and blocks them before they reach the model
- A maximum message length limits attempts to bury an instruction in a long text
- Limited powers: the assistant can only run declared actions, with controlled parameters. A manipulated answer therefore cannot grant a refund or change an order
- An action log makes it possible to check afterwards what was done, and when
Human guardrails
Automatic measures do not replace organization. Human handover ensures a visitor is never stuck. Regular review of conversations catches the errors nothing stopped. And a person responsible for content approves what goes into the knowledge base.
Too many guardrails?
An assistant that is over-restricted becomes useless: it declines simple questions out of excessive caution, sends everything to the team and wears visitors out. The right setting is found through testing, checking two things at once: that the assistant says nothing wrong on sensitive topics, and that it answers common questions well. The strictest rules focus on a few topics, prices, lead times, refunds, safety, rather than on every answer.
Guardrails and compliance
Guardrails also serve compliance. A prompt that forbids asking for health data helps comply with the GDPR. Telling the visitor they are talking to an AI meets the AI Act. Logging actions makes accountability possible.
Guardrails in KernChat
KernChat applies guardrails shared by all assistants. A filter blocks, before any call to the model, attempts at manipulation and at extracting the configuration in French, English, Spanish and German, and limits message length. Every prompt includes a block that keeps the assistant in its role, requires it to cite its sources and to say what it does not know. Actions are declared by the organization and every run is logged.