F2 · Layered guardrails

Principle

Several checks stack up: relevance and safety classifiers (jailbreak, injection), personal-data filters, moderation, tool risk rating, rules, output validation. They apply to the input, to tool calls, to tool responses and to the output. None is perfect; stacking them is what lowers the risk.

The problem it solves

An agent can receive an off-topic or booby-trapped request, expose personal data or call a dangerous tool.

When to use it

• Any agent exposed to users or to outside content: this is the minimum baseline.
• Alongside the security-by-design patterns (G), which constrain the architecture instead of detecting.

When to avoid it

• As the only defence when the agent combines private data, untrusted content and an outbound channel: detectors are probabilistic. Constrain the architecture (G4, G6).
• In place of authentication and access control: guardrails add to them, they do not replace them.

Common pitfalls

The anti-patterns that misuse this pattern, best established first. Each sheet describes the symptoms, the public incidents and the remedies.

Security and permissions

• AP63 · Security policy left to the prompt — The “don’t touch production” rule only lives in the prompt; nothing enforces it when a tool is called.
• AP58 · Probabilistic guardrail as the only barrier — An injection filter or classifier serves as the boundary, with no architectural constraint behind it.

Oversight, operations and governance

• AP84 · One-way harness — Rules that are never checked, or alerts that never change the rules: the harness does not learn.

All anti-patterns

Synonyms by vendor

• Guardrails (OpenAI, Microsoft)
• Multimodal Guardrails (CSIRO Data61)

Neighbouring patterns

• G6 · Rule of Two
• G4 · Dual LLM (and CaMeL)
• F1 · Human in the loop

Sources

• A practical guide to building agents — OpenAI, 2025-04-17
• AI agent orchestration patterns — Microsoft, Azure Architecture Center, 2026-02-12
• The lethal trifecta for AI agents: private data, untrusted content, and external communication — Simon Willison, 2025-06-16