Guardrail

A guardrail is a rule that limits an AI system’s access, actions, or freedom to act without approval. In a service firm, the useful controls usually sit in account settings and workflow steps, not inside the model. OWASP names three root causes of excessive agency: too much functionality, too many permissions, and too much autonomy. Those become practical questions for an owner: what can the tool do, what can it reach, and what can it do without asking? In 2024, a British Columbia tribunal ordered Air Canada to pay $812.02 after its chatbot gave a passenger a wrong bereavement-fare answer. You do not need to build an AI platform to set a guardrail. Start with the account that could send, delete, publish, or move money.

What AI guardrails look like in a service firm

Your first guardrails are usually permissions and approval steps. A prompt can ask an agent to behave well. An account setting can limit what the agent is able to reach.

Ask three questions. What can it do? What can it reach? What can it do without asking? They are the business version of OWASP’s root causes, excessive functionality, excessive permissions, and excessive autonomy.

Permissions often spread farther than the task needs. OWASP gives the example of a tool that only reads a record while its account can also update and delete it. In a service firm, the same mistake is giving an assistant the whole shared drive because choosing one folder takes longer. The task needs templates. The account can see client files, payroll, and old contracts.

Autonomy is easier to test. An agent that drafts a client reply and leaves it queued has not sent anything. The same agent with send permission can publish the message. The model did not change. The setting did.

Source choice can also limit what the system says. Tie answers to an approved policy or record when the firm already has one. That gives the system a place to quote instead of asking it to compose a rule.

You own what the bot says

A company remains responsible for information its chatbot gives customers. One British Columbia ruling makes the point, although its legal reach is narrow.

In Moffatt v. Air Canada, decided 14 February 2024, a passenger asked about bereavement fares after their grandmother died. The website chatbot said a claim could be made retroactively within 90 days. The linked policy said the opposite. The passenger booked, applied, and was refused.

Air Canada argued that it should not be held responsible for the chatbot’s answer. The tribunal member wrote:

In effect, Air Canada suggests the chatbot is a separate legal entity that is responsible for its own actions. This is a remarkable submission. While a chatbot has an interactive component, it is still just a part of Air Canada’s website. It should be obvious to Air Canada that it is responsible for all the information on its website. It makes no difference whether the information comes from a static page or a chatbot.

The ruling also rejected the idea that correct information elsewhere on the website fixed the wrong answer. A service firm should expect a client to rely on the answer it receives.

Keep the legal claim small. The British Columbia Civil Resolution Tribunal is a small-claims body. The order was in Canadian dollars and totaled $812.02, including $650.88 in damages. It does not bind anyone outside that setting. The practical lesson is still clear: a correct services page does not cancel a wrong chatbot answer.

Guardrail, human review, or eval

These controls answer different questions.

A guardrail acts before an action. A person reviews during the work. An eval checks quality after the work. Review uses attention on every item, while a permission can hold at any volume.

Control	When it acts	What it answers	What it costs
Guardrail	Before	Was this action allowed?	One setting, once
Human in the loop	During	Is this particular item right?	Attention per item
Eval	After	Is quality holding over time?	A written standard, run on a schedule

Before you hand over work, ask whether it can be checked and whether it can be undone. A guardrail makes the second condition real. A queued draft can be withdrawn. Sent email cannot.

Many firms have not written these rules. In McKinsey’s 2023 global survey, only 21% of respondents who reported AI adoption said their organization had policies for employees’ use of generative AI. The one-page AI policy makes the decision visible: what may run alone, what needs approval, and who owns the account.

What guardrails cannot do

Guardrails do not make prompt injection impossible. OWASP ranks prompt injection as the number one risk in AI applications and says it is unclear whether fool-proof prevention exists.

The attack can arrive inside normal work. A client attachment, email, or web page can contain instructions that the agent was asked to read. The agent may not tell the client’s content from instructions hidden in the file.

Plan for that boundary. Decide how far a bad instruction can travel. An agent limited to a templates folder may produce a bad draft. An agent with the shared drive and send permission can expose records or contact a client. The permission decision limits the reach of the failure.

A guardrail also cannot judge quality. It can confirm that an action was allowed. It cannot tell whether the report has the right numbers. A system can have tight permissions and still send a polished, wrong answer.

Where this sits on the Delivery Model Ladder

Guardrails become structural at Stage 2, Augmented, on the Delivery Model Ladder. That stage is the first where a system acts on its own. Set the limits before that work begins. The move toward Stage 3 depends on scoring the output, which a guardrail does not do.

A firm that cannot say what its agents may not touch has not crossed the Production Gap. It has tools running without a clear stopping point, much like the shadow AI use it may already have, except the connected tool can act on the firm’s behalf.

Across the 150+ franchise units I track, roughly 80% still run chatbots, 15% run workflows on triggers, and 5% run autonomous agents. Those figures describe that network. The 5% can answer the access question: what is this agent not allowed to touch?

Quick answers

Do I need guardrails if we only use ChatGPT and Copilot? Yes. Ask the same three questions. Whatever those tools can reach through your accounts is already part of the control boundary, whether you set it deliberately or inherited the default.

What is the difference between a guardrail and human review? A guardrail holds without a person. Use a person where judgment is needed or volume is low. Use a guardrail where the rule about access or reversibility is knowable in advance.

Who owns guardrails in a firm our size? The person who owns the account or workflow. This starts in the admin panel. A committee can advise, but it should not leave the setting without an owner.

What is the first guardrail to set? Cover the action you could not take back: money leaving, an email sending, a record deleting, or a client receiving a message. Add more as you learn what the work actually needs.