Guardrail

A guardrail is a rule that limits what an AI system can reach, what it can do, or what it can do without approval. For a business, the first useful controls are often in account settings and workflow steps, not inside the model.

An agent that drafts a client reply doesn’t need permission to send it. Taking away that permission means the draft can wait for a person, instead of relying only on an instruction that says “don’t send.”

I would start with the accounts that could send, delete, publish, or move money, because that’s where a wrong action can leave the firm before someone checks it.

What AI guardrails look like in a business

Ask what the tool can do, what it can reach, and what it can do without asking. Those are the business version of OWASP’s three root causes of excessive agency, excessive functionality, excessive permissions, and excessive autonomy.

OWASP gives the example of a tool that only needs to read a record while its account can also update and delete it. The permission is wider than the task, so a mistake has more room to cause damage.

In your firm, that could be an assistant given the whole shared drive because choosing one folder takes longer. It needs templates, but the account can also see client files, payroll, and old contracts.

Or compare a client reply left in a queue with one the agent can send directly. The model can stay exactly the same while the account setting changes what the failure could cost.

You can also tie answers to an approved policy or record when one exists. That gives the system evidence to use instead of asking it to make up a rule, though you still need to check whether its answer follows the source.

You own what the bot says

Don’t plan on the chatbot taking responsibility away from your company. One British Columbia ruling makes the practical risk clear, even though it doesn’t establish the law everywhere your firm may work.

In Moffatt v. Air Canada, decided 14 February 2024, a passenger asked about bereavement fares after their grandmother died. The website chatbot said they could claim retroactively within 90 days, while the linked policy said the opposite.

The passenger booked, applied, and was refused. Air Canada argued it shouldn’t be held responsible for the chatbot’s answer, and the tribunal member wrote:

In effect, Air Canada suggests the chatbot is a separate legal entity that is responsible for its own actions. This is a remarkable submission. While a chatbot has an interactive component, it is still just a part of Air Canada’s website. It should be obvious to Air Canada that it is responsible for all the information on its website. It makes no difference whether the information comes from a static page or a chatbot.

The ruling also rejected the idea that correct information elsewhere on the site fixed the wrong answer. The British Columbia Civil Resolution Tribunal, a small-claims body, ordered a total of $812.02 Canadian dollars, including $650.88 in damages.

Keep that legal scope with the example, it doesn’t settle liability outside that setting. For an owner, I would take the narrower lesson seriously, a correct services page doesn’t undo the wrong answer your chatbot gave a client.

Guardrail, human review, or eval

These controls do different jobs. An action guardrail asks whether the system may do something before it happens, a person reviews a particular item, and an eval scores work against a standard.

A permission can hold without someone approving every item, while human review needs attention on each one. But setting the permission isn’t the end of owning it, someone still needs to keep the allowed access matched to the work.

Before handing over a task, ask whether it can be checked and whether it can be undone. Keeping an email as a queued draft preserves a chance to stop it, whereas once it has been sent you cannot count on taking it back.

McKinsey’s 2023 global survey found that only 21% of respondents reporting AI adoption said their organization had policies for employees’ use of generative AI. That’s a finding from that survey, not a current count of firms with no controls.

A one-page AI policy makes your own decisions visible, what can run alone, what needs approval, and who owns the account. Then the account settings need to match what the policy says.

What guardrails cannot do

Guardrails don’t make prompt injection impossible. OWASP lists prompt injection as its number one risk in AI applications and says it is unclear whether fool-proof prevention exists.

The instruction can arrive in something the agent was asked to read, a client attachment, email, or web page. The model may treat an instruction hidden in that material as something it should follow.

So plan for how far a bad instruction could get. An agent limited to templates may produce a bad draft, while one with the whole shared drive and send permission could expose records or contact a client.

That’s what the permission decision controls. It doesn’t prove that an allowed report has the right numbers, and a system with tight permissions can still produce a polished, wrong answer.

Where this sits on the Delivery Model Ladder

Guardrails become part of the workflow at Stage 2, Augmented, on the Delivery Model Ladder, where the system begins acting without someone directing every step. Set its limits before that work starts.

Moving toward Stage 3 also needs output scoring, because allowed work and correct work are different checks. Permissions don’t replace the second one.

A firm that can’t say what its agents may not touch still has a problem inside the Production Gap. The uncertainty resembles shadow AI use, except now the connected tool can act on the firm’s behalf.

Across the 150+ franchise units I track, roughly 80% still run chatbots, 15% run workflows on triggers, and 5% run autonomous agents. Those figures describe that network, and in the agent-running group the firms can answer what each agent isn’t allowed to touch.

Quick answers

Do I need guardrails if we only use ChatGPT and Copilot? Yes, check what those tools can do through your accounts. The permissions already exist, whether you chose them deliberately or kept the defaults.

What is the difference between a guardrail and human review? Use a person where you need judgment, and an enforced rule where you already know what access or action is allowed. Low-volume work can also be practical to review by hand.

Who owns guardrails in a firm our size? Start with whoever owns the account or workflow. Other people can advise, but somebody needs to own the actual setting.

What is the first guardrail to set? Cover an action you couldn’t easily take back, money leaving, an email sending, a record being deleted, or a client receiving a message. Add the other limits as you learn what the work needs.