Skip to main content

LLM Guardrails

Engineering patterns for constraining LLM behavior in production AI systems — input sanitization, output validation, revert-on-failure, and advisory isolation.

5 min read·Intermediate·Concept·Jul 26, 2026
ai systemsllm

LLM Guardrails

What Was Built​

This article synthesizes LLM guardrail patterns from three production systems: A2A Brainstorm (coherence audits with guarded micro-fixes and revert-on-failure), MD-AME (Prompt Firewall + Gemini safety classifier on every topic and script), and edge-polymarket-agent (AI advisor isolated from the execution critical path).

The Problem​

LLMs hallucinate, contradict themselves, inject unsafe content, and produce malformed output. In production systems, you cannot trust raw LLM responses. You need layers that sanitize inputs, validate outputs, reject or revert bad results, and isolate advisory AI from actions that have real-world consequences.

Why This Problem Is Difficult​

  1. Over-correction — fixing one issue can break unrelated content.
  2. False positives — overly aggressive filters block valid output.
  3. Latency — safety classifiers add API calls per item.
  4. Advisory creep — LLM suggestions slowly become execution dependencies.
  5. Non-determinism — the same guardrail must handle variable LLM output shapes.

Beginner Mental Model​

Guardrails are airport security checkpoints, not the destination. Every item passes through inspection before proceeding. If inspection fails, the item is rejected or sent back — it does not get a "mostly okay" stamp. Advisory AI is like a travel guide: useful suggestions, but never allowed to fly the plane.

Requirements and Constraints​

Guardrail typeA2A BrainstormMD-AMEPolymarket agent
Input sanitizationJSON extraction tolerancePrompt Firewall (sanitize_trend_input)N/A (structured market data)
Output validationCoherence audit + guardrailsSafety classifier on topics/scriptsProbability hard gate
Revert on failureMicro-fix revert if validation failsContentSafetyRejection HALTBlock trade, no fallback
Advisory isolationN/AN/AAI advisor read-only, failure-isolated
Audit trailSession state in PostgreSQLsafety_audit_logs immutable trailAllocation audit log
Credential safety*_CREDENTIAL_REF env refs onlyMaster Key Crypto, zero-loggingEnv-only secrets

Architecture Overview​

Execution Flow​

Input guardrails (MD-AME Prompt Firewall)​

  1. Truncate input to maximum length.
  2. Strip injection phrases, HTML tags, and LLM role tokens.
  3. Pass sanitized input to downstream processing.

Output guardrails (MD-AME Safety Classifier)​

  1. Evaluate topic or script against dimension's safety_profile.
  2. Write result to immutable safety_audit_logs.
  3. Reject item if classifier returns unsafe; pipeline skips or HALTs.

Coherence guardrails (A2A Brainstorm)​

  1. Generate document section-by-section.
  2. Run coherence audit across all sections.
  3. Apply micro-fixes for contradictions.
  4. Validate each fix; revert if validation fails.

Advisory isolation (Polymarket)​

  1. AI advisor produces read-only recommendations with required insight structure.
  2. Execution path never awaits advisor response.
  3. Advisor failure is logged but does not block trades.

Important Components​

ComponentResponsibility
Prompt FirewallInput sanitization before LLM or DB write
Safety classifierOutput evaluation against policy profiles
Coherence auditCross-section contradiction detection
Guardrail revertUndo micro-fixes that fail validation
Hard gateBlock downstream action without valid prerequisite
Advisory layerSuggestions only — no execution side effects
Audit logImmutable trail of safety decisions

Simplified Implementation Examples​

Input sanitization (simplified):

# simplified — md-ame Prompt Firewall pattern
def sanitize_trend_input(raw: str) -> str:
    text = truncate(raw, MAX_TREND_INPUT_LENGTH)
    text = strip_html_tags(text)
    text = remove_injection_phrases(text)
    text = remove_role_tokens(text)
    return text

Guarded micro-fix with revert (simplified):

// simplified — a2a-brainstormer coherence pattern
fix := proposeMicroFix(sections, contradiction)
patched := applyFix(sections, fix)
if !validateDocument(patched) {
    return sections // revert — original preserved
}
return patched

Advisory isolation (simplified):

# simplified — polymarket pattern: advisor never blocks execution
try:
    insight = ai_advisor.suggest(context)  # read-only
    log_advisory(insight)
except AdvisorError as e:
    log_warning("advisor_unavailable", error=str(e))
    # execution continues without advisor input

Reliability and Idempotency​

  • Fail safe defaults: MD-AME HALTs on voice failure; polymarket blocks without probability.
  • Immutable audit logs: Safety decisions are append-only for post-incident review.
  • No silent fallback: Missing API keys disable agents, not switch to weaker models silently.
  • Bounded fix scope: Coherence micro-fixes are small edits, not full regeneration.

Failure Modes​

FailureBehaviour
Safety classifier API downTopic/script rejected; logged to audit
Coherence fix makes things worseAutomatic revert to pre-fix state
Prompt injection attemptStripped by firewall; may be rejected entirely
AI advisor timeoutExecution proceeds without advisory input
Over-aggressive filterFalse rejections logged; tune safety_profile per dimension

Trade-offs and Rejected Alternatives​

ChoiceWhyRejected alternative
Classifier per itemCatches unsafe content earlyTrust LLM self-moderation
Micro-fixes not regenerationPreserves good content; cheaperRegenerate entire document
HALT on voice failureQuality over availabilityPublish video without audio
Advisory isolationExecution reliabilityLLM in trade decision path
Immutable audit logsAccountabilityOverwrite safety decisions

Testing​

  • A2A Brainstorm: coherence_test.go, aigen_test.go for audit and revert paths
  • MD-AME: Unit tests with mock classifiers; integration tests for safety rejection flow
  • Polymarket: Tests verify execution proceeds when advisor fails

Operations and Observability​

  • Review safety_audit_logs for rejection patterns and false positive rates
  • Monitor classifier API latency — adds 2 Gemini calls per video in MD-AME
  • Track advisor availability separately from execution success rate

Lessons Learned​

  1. Guardrails are architecture, not prompts — "please be safe" in a system prompt is not a guardrail.
  2. Revert is as important as fix — always validate and undo failed corrections.
  3. Isolate advisory AI — LLM latency and failures must not block critical paths.
  4. Audit everything — safety decisions need immutable logs for tuning and compliance.

Sources​