GUARDRAILS · FOUR BOUNDARIES
Layered guardrails: compare one check with four boundaries
Five conversations carry defects at the request, a tool call, a tool result and the response; compare one request check with four boundaries.
Your experiment
A support agent can refund, look up orders, search help articles and export customer lists. Four conversations each carry one defect at a different point, and one benign request uses the word ignore. Start with a keyword request check only, then switch method and add the other three boundaries.
Play replays the computed run over sixty inspection seconds; Next event steps, Restart rewinds, Speed changes the pace and Inspection time scrubs. Any input change recomputes the run and rewinds it without autoplay.
Event trace
Computed data
Final metrics
Decision model with idealised checks: each boundary always catches the defect it is designed for and nothing else; the keyword rule blocks any request containing ignore. Real classifiers and filters have error rates, so the point is coverage, not perfection. No model, tool or customer data is used.
Defects appear at four places
A support agent can refund, look up orders, search help articles and export customer lists. G1 is a direct injection in the user request; G2 hides an instruction to call the export tool inside a retrieved help article; G3 is an order record that contains another customer’s phone number; G4 is a draft reply that repeats a card number from memory; G5 is a benign request that happens to say ignore. With the opening keyword request check alone, G1 is stopped, G5 is wrongly blocked, and G2, G3 and G4 all get through: HARM GOT THROUGH, 1 of 4 stopped.
A better request check is still one check
Request check method applies only while the request check is on. Choose Trained classifier: G5 is no longer blocked, but the same three harms get through, because none of them is in the user’s request. G2 arrives through retrieval, G3 through a tool result and G4 is written by the model. No amount of precision on the request can see them.
Add the other three boundaries
Check Tool-call policy and the bulk export in G2 needs an approved ticket. Check Tool-result filter and fields of other customers are removed from G3 before the model sees them. Check Response check and the card number in G4 is masked. With all four boundaries and the classifier: ALL BOUNDARIES HELD, 4 of 4 stopped and no false block. Each layer covers a place the others cannot see.
Removing the first layer
Clear Request check with the other three on: 3 of 4 are stopped, and G1’s injected refund request reaches the refund tool, because the tool-call policy here only governs exports. Layers are not redundant copies; each one is specific to the actions and data at its point in the loop.
Reading the run and its limits
Play, Next event, Restart, Speed and Inspection time step through each conversation and the summary across sixty seconds; the table records where each defect appears and what stopped it. The checks are idealised: each catches exactly the defect it is built for. Real guardrails have false positives and misses, so measure each layer on labelled cases.