Allowlist / Denylist
Explicit lists of permitted (allow) or forbidden (deny) tools, domains, commands, or data patterns. Allowlisting (default-deny) is the stronger posture for agentic systems.
Canary token / Honeytoken
A planted, fake-but-monitored credential, file, or data string that should never be legitimately accessed. If an agent touches or exfiltrates it, you get a high-signal alert that something has gone wrong.
Circuit breaker / Kill switch
A control that halts an agent automatically (or on demand) when it breaches a threshold — too many actions, anomalous behaviour, repeated failures — limiting damage from a runaway or compromised agent.
Constitutional AI
A training-and-alignment approach where a model is guided by an explicit set of principles ("a constitution") used to critique and revise its own outputs, reducing reliance on case-by-case human labelling. A model-layer guardrail rather than a runtime one.
Content filter / Moderation
Classifiers or rules that screen inputs and outputs for prohibited content (toxicity, PII, malware, policy violations). One layer of an input/output guardrail.
Grounding
Constraining an agent's responses to verifiable source data (e.g. retrieved documents, known records) to reduce fabrication and keep behaviour anchored to authorised information.
Guardrail
Any control that constrains what an agent can receive, do, or produce so it stays within authorised, safe behaviour. Guardrails span the input, the model, the tools, and the output.
Input guardrail
A check applied to data entering the agent — user prompts, retrieved documents, tool results, inter-agent messages — to detect injection attempts, malicious payloads, or out-of-policy requests before they influence the agent.
Output guardrail
A check applied to what the agent produces or attempts to do — validating tool calls, filtering sensitive data, blocking unsafe commands — before the action executes or the response is returned.
Policy engine / Policy-as-code
A centralised, machine-readable rule set (e.g. authorisation policies) evaluated at runtime to decide whether a given agent action is allowed. Decouples guardrail logic from the agent itself and makes it auditable.
Rate limiting / Throttling
Caps on how often or how much an agent can act (requests, tokens, tool calls, spend) within a window. A direct mitigation for unbounded consumption and denial-of-wallet.
Refusal
The model's trained behaviour of declining a request that violates its policies. A baseline safety control, but one that can be eroded by jailbreaks and so should not be relied on alone.
Schema / Structured-output validation
Enforcing that an agent's output or tool call conforms to a strict, expected format before it is acted on. Stops malformed or injected instructions from reaching downstream systems.
