AI guardrails

A language model will try to answer anything, in any tone, for anyone. For a business assistant that is a liability: it may wander off-topic, promise a refund it has no authority to give, reveal another customer's data, follow instructions planted in a web page, or produce offensive content when provoked.

The OWASP Top 10 for LLM applications lists the main risks, including prompt injection, sensitive information disclosure, excessive agency (an agent allowed to do more than it should) and misinformation. NIST's Generative AI Profile (AI 600-1) frames the same issues from a risk-management angle.

Input controls filter what reaches the model: moderation of abusive messages, spam limits, detection of sensitive data. Instruction-level controls define scope and behaviour: the assistant's role, topics to decline, commitments it may not make without evidence. Tool-level controls limit what the agent can do: read-only access, actions restricted to the signed-in customer's own records, confirmation before anything irreversible. Output controls check the answer before it is sent.

The strongest guardrails are enforced in code, not in the prompt. “Only show the customer their own orders” is reliable when the order tool itself filters by the verified customer; it is fragile when it is only a sentence in the instructions.

Two failure modes are common. Over-blocking: an assistant so restricted that it refuses reasonable questions, which drives customers away just as surely as a wrong answer. Prompt-only rules: limits written in the system prompt that a determined user can talk the model out of.

Guardrails also need monitoring. Moderation logs, refused requests and escalations show whether the limits are in the right place.

AI SmartTalk combines several layers. Built-in policies keep the assistant to its role, decline off-topic requests and claimed authority, treat retrieved text as data rather than instructions, and require evidence before commitments. Order tools only return the signed-in customer's own orders, after an email verification code. Optional moderation with relaxed, moderate or strict presets screens abusive messages and keeps an audit log, and spam limits and bans protect the channels. When the assistant should stop, it hands the conversation to the team.