Input Guardrails

What it is

The check that runs between a request arriving and any model being invoked, deciding whether that request proceeds as written, proceeds in a modified form, or does not proceed at all. It is the only point in the path where a verdict is reached before a single token has been generated, which makes it the cheapest place to say no and the least informed place to decide. What it judges is a stated intention, not an outcome.

What an input check cannot know

At this point the system holds the caller's identity, the submitted material, and whatever it already knows about the session. It does not hold the answer, the passages that will be retrieved, the tools the model will choose, or the values it will pass to them. Every question that depends on those is unanswerable here and belongs to a later check with different evidence and a different cost of being wrong. A gate placed before generation that tries to predict what the generation will contain is guessing about a distribution it has never observed.

Why it matters

This is the one place where refusing costs nothing beyond the check itself: no inference is billed, no partial response has been shown, nothing has acted. That makes it the natural home for everything that can be decided from the request alone, and it is also the only checkpoint that can repair rather than veto — strip control characters, drop an attachment, narrow a requested scope — because nothing downstream has yet committed to the original form. Everything pushed past it is paid for in tokens, latency, and sometimes in effects that cannot be recalled.

Key decisions

• What counts as the input: the user's typed turn alone, or everything about to be placed in front of the model, including uploads, transcripts, pasted documents, and prior tool results. The narrow definition is cheaper and is the reason most bypasses work.
• Whether the verdict may include a transformation. Quietly rewriting a request is more useful to the user and less honest with them: they are answered, but not about what they asked.
• Where the gate sits relative to authentication and quota. An unauthenticated request that is still scored turns the checker into a free classifier for anyone who wants to probe it.
• The latency budget, which is spent in full before time to first token and is therefore entirely visible; nothing downstream can hide it behind a streaming response.
• Whether the individual checks run concurrently and stop at the first refusal, or all complete so that the record carries every reason the request was rejected.
• How much a refusal explains. Naming the rule lets an honest user repair the request and lets a dishonest one iterate against a gradient.
• Whether rejected material is retained for review, given that it is by definition the content someone has just judged unsafe to process.

Failure modes

• The gate reads the message field while the product also accepts images, files, and pasted documents that are concatenated into the prompt after the verdict has already been returned.
• Each turn is scored in isolation, and the request that matters is assembled across six exchanges, none of which is individually remarkable.
• The threshold was chosen on a curated set with a near-balanced label distribution and deployed against traffic three orders of magnitude cleaner, so false positives outnumber real ones from the first hour.
• Canonicalisation happens after matching rather than before it, so a substituted homoglyph or an inserted zero-width character defeats a rule that would have caught the plain text.
• The guard model is invoked with the submitted text inside its own instructions, and a caller who works that out starts writing for the guard rather than for the product.
• Refusals return quickly and accepted requests return slowly, so response time alone tells a prober which of their variants got through.
• Rejections are dropped without a record, and the only trace of a sustained campaign is an unexplained dip in accepted volume.
• A threshold or model change lifts the rejection rate across one locale, and nobody sees it because the rate is only ever monitored in aggregate.

Related capabilities

• Output Guardrails — the checkpoint that has the answer this one was forced to guess about
• Jailbreak Detection — the specific judgement most often mounted here
• PII Detection and Masking — the transformation this checkpoint can apply instead of refusing
• Fail-closed Behavior — what the request does when this check returns nothing
• Prompt Injection Defense — the construction rules that decide what admitted material is allowed to do

Applies: Production readiness · Design questions