AI guardrails are the technical and procedural limits placed around an AI system so that it only receives, produces and does what its owner has authorized, whatever the underlying model generates.
AI guardrails exist because a language model's output is probabilistic: the same input can produce a different answer, and a manipulated input can produce a harmful one. The OWASP Top 10 for LLM Applications 2025 names the resulting risk Excessive Agency (LLM06): damaging actions taken in response to unexpected, ambiguous or manipulated model outputs, caused by excessive functionality, permissions or autonomy.
AI guardrails operate at three levels:
- Input guardrails: check what reaches the model, for example a document whose hidden text tries to give instructions, the pattern behind prompt injection
- Output guardrails: validate what comes back, such as a required format, an amount within a plausible range, a VAT number that exists, or a total equal to the sum of its lines
- Action guardrails: limit what an agent can trigger, with minimum permissions and human approval for irreversible actions such as a payment
In finance, the strongest AI guardrails are deterministic rules applied after the model, because a rule cannot be persuaded. A model reads the invoice; a rule then checks that the IBAN matches the supplier master data and that the amount matches the purchase order. The model proposes, the rule verifies.
Phacet agents run inside guardrails set by the finance team. Every extracted value is checked against reference data, each agent can only act within its scope, and payments or bank detail changes always go through human-in-the-loop approval. Guardrails are what make a model usable in production, and a golden dataset is how their effect is measured before each change. The wider framework they belong to is AI governance.
