Production AI Safety Guardrails Built for Your Threat Model

Your AI Application Is One Bad Output Away from a Lawsuit

Air Canada's chatbot promised bereavement fare refunds that contradicted company policy. A Canadian court held the airline liable. A Chevrolet dealership's chatbot agreed to sell a Tahoe for one dollar after a prompt injection attack. DPD's delivery bot was jailbroken into producing profanity, racking up 800,000 views in 24 hours. These are not hypotheticals. They are production incidents from companies that shipped AI without adequate safety layers.

The AI Incident Database logged 108 new incidents between November 2025 and January 2026 alone. Stanford's 2026 AI Index reports that 62% of organizations cite security and risk as the primary blocker to scaling agentic AI, outranking technical limitations by 24 percentage points. The gap between "works in the demo" and "safe in production" is where most AI deployments stall. We build the safety infrastructure that closes that gap.

What Production Guardrails Actually Look Like

A production guardrail stack is not one tool. It is a layered architecture where each layer catches what the others miss, and no single layer's failure compromises the system. We design and build these stacks from five independent layers:

Input screening. Prompt injection detection using fine-tuned classifiers (not regex). The best open-source detectors achieve F1 scores around 0.91, but production-grade detection requires continuous retraining against new attack patterns. We deploy hybrid detection: a fast classifier handles high-throughput scanning on untrusted input, with uncertain cases routed to a reasoning-based LLM backstop. Canary token monitoring catches injection attempts that evade both layers.

Content classification. Safety classifiers that evaluate inputs and outputs against configurable taxonomies. Llama Guard 3, ShieldGemma, and Qwen3Guard each cover different risk categories with different accuracy profiles. The critical finding from 2025-2026 benchmarks: Llama Guard achieves 97-99% accuracy on benign inputs but detects only 4.5-21.8% of adversarial content. The best overall performer (Qwen3Guard-8B at 85.3%) drops to 33.8% on novel prompts not derived from public datasets. Off-the-shelf classifiers are a baseline, not a complete defense. We select, combine, and augment them based on your specific threat model.

Policy enforcement. Runtime rules that constrain what the AI can say, commit to, or execute. This is where the Air Canada and Chevrolet failures lived: the models could generate any output, including contractual commitments and pricing decisions, with nothing between generation and the user. We implement deterministic policy engines that evaluate every output against your business rules before it reaches any downstream consumer. Pricing commitments, legal language, authorization scope, data disclosure boundaries: each defined as a machine-evaluable rule, not a prompt instruction.

Output validation. PII redaction, toxicity filtering, factual consistency checks, and domain-specific constraint verification. PII detection is a useful example of why layering matters: regex-based detection achieves roughly 65% recall, leaking up to 35% of sensitive data. NER-based detection reaches 94-96% F1 on standard entities but fails on novel formats and adversarial obfuscation. We run both, with regex handling structured patterns (credit cards, SSNs, phone numbers) and ML models catching context-dependent entities (names, addresses, freeform identifiers), calibrated to your false-positive tolerance.

Agentic safety. For AI systems that use tools, execute code, or call APIs, output filtering is insufficient. The guardrail must intervene before execution, not after. We build planning-stage validation that inspects tool calls, parameter values, and execution plans before any action fires. Risk-tiered approval routes low-risk actions through automatically, flags medium-risk for logging, and requires human authorization for high-risk operations like database writes, financial transactions, or external communications.

The False Positive Problem Nobody Talks About

Stacking safety classifiers sounds like good engineering until you do the math. If each guard achieves 90% accuracy and you run five of them, the probability that all five are correct on a given request drops to 59%. That means 41% of legitimate requests get incorrectly flagged. Your users stop trusting the system. Your support team drowns in escalations. Your safety investment becomes a UX liability.

We solve this through tiered architecture, not brute-force stacking. Fast rule-based checks (microsecond latency) handle obvious violations. ML classifiers (50-200ms) handle nuanced content. LLM-as-judge (seconds) handles only the ambiguous edge cases that cheaper layers cannot resolve. Each layer has calibrated confidence thresholds. A request only escalates to a more expensive layer when the previous layer's confidence falls below its threshold. This keeps total guardrail overhead under 200ms for 90%+ of requests while maintaining high detection rates on genuine threats.

Why Off-the-Shelf Guardrails Are Necessary but Not Sufficient

The guardrails market is fragmented across open-source frameworks, managed platforms, and cloud provider features. Guardrails AI provides composable validators with 50+ pre-built checks. NeMo Guardrails offers Colang-based dialog policy management. AWS Bedrock Guardrails works across model providers with PII redaction and Automated Reasoning checks. Lakera Guard delivers sub-50ms prompt injection detection across 100+ languages. Each solves a piece of the puzzle. None solves it end to end.

Production teams in 2026 commonly run NeMo Guardrails for conversation management and Guardrails AI for output validation in the same system. That integration is custom work. The cloud providers offer strong baseline coverage but limited customization for domain-specific policies. Multimodal guardrails (image, audio, video inputs) are barely tooled, despite attacks achieving 75-82% success rates through simple image transformations across frontier models. The gap between what platforms provide and what production safety requires is where our work lives.

Regulatory Pressure Is Real and the Standards Are Not Ready

The EU AI Act's high-risk provisions take full effect August 2, 2026. CEN/CENELEC JTC 21 is developing the harmonised technical standards that define what "appropriate risk mitigation" means for high-risk AI systems, but they missed their original August 2025 deadline and are now targeting Q4 2026. The standards that will determine compliance do not yet exist.

NIST AI RMF 1.0 and the Generative AI Profile (AI-600-1) specify guardrails including content filters as expected controls. OWASP's 2025 Top 10 for LLM Applications added System Prompt Leakage and Vector/Embedding Weaknesses as new categories, reflecting threats that most enterprise security teams have not yet instrumented for. Organizations that wait for final standards before building safety architecture will be scrambling against a deadline with no lead time. We design guardrail architectures that are defensible against current regulatory frameworks and adaptable to standards still in draft.

What We Deliver

Every engagement starts with a threat model specific to your application, your data, and your regulatory exposure. We do not sell a platform. We build a guardrail architecture that integrates best-of-breed tools (open-source and managed) into a coherent stack designed for your latency budget, your false-positive tolerance, and your compliance requirements.

Deliverables include: a layered guardrail architecture with measured latency budgets per layer; prompt injection defense with hybrid detection (classifier + LLM backstop + canary monitoring); PII redaction pipelines calibrated to your entity types and false-positive tolerance; policy enforcement rules derived from your business constraints, not generic templates; agentic safety controls for tool use, code execution, and API calls; adversarial test suites that attempt to bypass each layer using current attack techniques (PAIR, GCG, indirect injection, multimodal injection); guardrail observability with drift detection, classifier degradation alerting, and incident-triggered retraining pipelines; and regulatory mapping to EU AI Act, NIST AI RMF, and OWASP LLM Top 10 controls.

We also deliver the honest assessment: which risks your existing platform guardrails already cover, which gaps require custom work, and which threats are better addressed by architecture changes upstream (data governance, model selection, access controls) rather than more safety layers on top.