Guardrails screen what an AI system says or does against things that should never happen. Governance is wider: it decides what each agent is authorised to do, enforces that authority at the moment of action, and records every decision so it can be defended. Guardrails are one part. Treat them as the whole and authority goes undecided.
What do guardrails actually do?
The word covers a family of checks. Input filters scan requests for prompt injection or banned topics. Output filters scan responses for offensive language, personal data or claims the business does not want made. Topic restrictions keep a support bot from giving medical advice. Format validators check that a response matches an expected structure. Our explainer on what guardrails are in AI sets out the types.
All of them share a design. They look at a piece of content and decide whether it passes. They are good at catching categories of bad output: a toxic sentence, an exposed card number, an off-topic answer. They are useful, and every serious deployment should have them.
Why does a guardrail not answer the governance question?
Governance starts with a question guardrails never ask: what is this agent allowed to do? A guardrail knows that some outputs are bad for everyone. It does not know that this agent may issue refunds up to 500 for this customer, that it has been certified to draft complaint responses but not to send them, or that a particular fact it is relying on came from an unverified email.
Consider an agent that proposes a refund of 2,000 to a customer whose complaint it has read. The message is polite, accurate and contains no sensitive data. Every output filter passes it. Whether the refund should happen depends on the agent's authority, the customer's limit, the strength of the evidence and whether a person needs to approve it. None of that is a content question.
This is the core gap. Guardrails judge content. Governance judges authority. An agent can produce perfectly clean content while taking an action it had no right to take.
What does governance do that guardrails do not?
Governance has three jobs, and guardrails touch only part of the second.
| Job | What it involves | Do guardrails do it? |
|---|---|---|
| Decide authority | Set each agent's role, capabilities, depth and limits; name who owns them; base them on evidence | No |
| Enforce at the moment of action | Check each proposed action against every bound, and the lowest one wins | Partly: they check content against fixed rules |
| Record and prove | File every verdict, naming the bound that decided it, in a record nobody can edit | Rarely, and usually as a blocked-content log |
The first job is the most often skipped. Many organisations deploy an agent with guardrails switched on and consider it governed, without ever writing down what the agent is allowed to do. Our explainer on what AI agent governance is covers the full scope.
Where do guardrails belong in a governed system?
Inside it, as one bound among several. Every action an agent proposes should meet its role scope, its certificate, the sources it relies on, the customer's own limits and the platform's guardrails. Guardrails are the last of these: the rules that apply to every agent, at every depth, for every customer, regardless of anything else.
In that position they do something precise. They mark the floor below which nothing goes, such as never reversing a settled payment, never disclosing another customer's data, never acting on an instruction found inside a document. Above the floor, the other bounds decide. A system that has only the floor has no way to say that one agent may do more than another, or that one customer wants tighter limits than another.
A register of the platform-level rules, what each blocks and why, is a useful artefact in its own right; a platform guardrails register template shows one way to lay it out. It should sit alongside a separate record of each agent's authority, not replace it.
Why do teams confuse the two?
Partly vocabulary. "Guardrails" has become a catch-all word in product marketing for anything that makes AI safer, so it is easy to believe a product with guardrails is a governed product.
Partly convenience. Guardrails can be switched on in an afternoon. Governance needs decisions from people who own processes, risk and customers, and those decisions take longer.
And partly measurement. Guardrail dashboards show impressive numbers: thousands of blocked prompts, filtered outputs, flagged topics. Those numbers feel like evidence of control. They are evidence that some bad content was stopped. They say nothing about whether the actions that went through were authorised.
How would you know whether you have governance or only guardrails?
Ask four questions of any live agent. Can you list, in business terms, every capability it has and the depth at which it may use each? Can you name the person accountable for it? For any action it took last month, can you say which bound would have stopped it and why none did? If it had tried to exceed its authority, would the record show the attempt and the bound that refused it?
If the answers come from the guardrail configuration, they will be about content. If they come from a governance layer, they will be about authority. Our guide to measuring AI agent governance turns these into ongoing measures.
What is the cost of building governance rather than stopping at guardrails?
Governance costs time from the business, not only from engineering. Someone has to define capabilities, set depth on evidence, name owners, agree customer limits and review the record. Guardrails can be bought and configured; governance has to be decided.
Stopping at guardrails costs more in the end, because the first serious incident will be an action that passed every content check and should never have been taken. At that point you will need the decisions you skipped and the record you never kept. Keep your guardrails. Then build the authority layer around them, as described in our guide to agent governance as a bound, not a model.
Where Pryme fits
In Pryme, platform guardrails are the fifth of five bounds every action meets, alongside role scope, certificate, sources and the customer's own limits. The lowest bound wins and the verdict names it. Actions refused at the platform floor for every agent are withheld, which is a platform decision, while customers narrow authority through their own limits.
Questions people ask
Are guardrails still worth having if you have a governance layer?
Yes. They catch categories of harm that apply to everyone, such as data leakage or injected instructions, and they act as a backstop if another bound is set wrongly. They work best as one bound among several.
Can guardrails be tuned per customer?
Some can, but tuning content filters per customer tends to blur the line between platform rules and customer limits. Keep platform guardrails universal and put customer-specific choices in the customer's own limits, where they can be owned and recorded.
Do regulators expect guardrails?
Regulators generally expect firms to manage risk, show accountability and treat customers fairly, without prescribing a specific technique. Guardrails help with some risks, but they will not show who authorised an agent to act or why an action was allowed.