Output Guardrails

What it is

The checkpoint standing between a generated response and whoever or whatever receives it. Its subject is the placement and the delivery contract rather than any particular judgement: when inspection happens relative to streaming, what evidence the inspecting code is given, and what the system does with text it has already produced and may already have partly sent. The individual classifications applied here — harm categories, personal data, confidential material, unsupported claims — are capabilities in their own right; this one is the mounting they hang on.

Why it matters

Everything judged at this point was written by the deployed system, so a violation found here is not an attack that got through but a defect the product created. That changes what the remedy can be: the system may sample again, rewrite, or withhold, and it is answerable for the result in a way it is not for what a user typed. It is also the last moment anything can be stopped before it becomes externally visible — posted to a shared channel, parsed by a downstream service, or rendered in a browser that will fetch whatever the markup instructs it to fetch.

Key decisions

• Whether the response is buffered until a verdict exists or streamed and inspected as it goes. Buffering trades away the one interaction property users notice most; incremental inspection requires a client that can withdraw what it has already shown.
• What the inspecting code receives besides the text: the request, the retrieved passages, the tool results, the system's own instructions. A check given only the final string cannot evaluate most of what is worth evaluating.
• What a block actually produces — a fixed refusal, a regeneration and how many attempts are allowed, a redacted version, or an escalation. A second sample from the same context very often reproduces the same violation.
• Whether the response is treated as data or as a document. Escaping, markup sanitisation, and link and image policy are decided by the receiving surface, not by the model.
• Whether the same operating points apply to a response shown to one person and a response written to a shared channel, an exported file, or an email with external recipients.
• What is retained when a response is withheld. The generated text is the only evidence of the defect and simultaneously the thing you least want to store.
• Which other emissions count as output: intermediate reasoning, plan summaries, tool arguments, and titles are all displayed, and are usually checked by nothing.

Failure modes

• Tokens stream to the browser while the inspection runs on the completed text, and the verdict lands after the reader has finished the paragraph it would have removed.
• The text passes every content classifier while the rendered markdown contains an image whose URL carries the conversation, so displaying the answer is what exfiltrates it.
• A violation triggers regeneration, the second sample violates identically, and the retry loop consumes the latency budget before returning the generic message it could have returned at once.
• The refusal restates what it is refusing in enough detail to deliver the content it withheld.
• Structured responses are validated for schema conformance and nothing inspects the values, so a perfectly well-formed object instructs a downstream system to do something indefensible.
• Enforcement lives in the chat surface, and the same generation reaches a webhook, a bulk export, and a scheduled job through code paths that were never wired to it.
• Operating points tuned for a consumer surface are inherited by an API product whose customers build on raw text, and legitimate responses arrive mangled by a redaction they cannot disable.
• The check is applied to the final assistant message only, while the product also renders the model's intermediate steps, where the same violation is plainly visible.

Related capabilities

• Input Guardrails — the earlier checkpoint deciding without the evidence this one has
• Content Moderation — the harm taxonomy most often evaluated at this point
• Data Leakage Prevention — the recipient-dependent judgement that also belongs on egress
• Hallucination Detection — a judgement about the response that no classifier of harm will make
• Policy Enforcement — the house rules whose required additions and prohibitions land here

Applies: Production readiness · Design questions