Guardrails and Prompt-Injection Defense

Ask an AI Engineer candidate "how do you keep this system safe?" and the weak answer is a sentence: "I'd add a system prompt telling it not to do X." The strong answer is an architecture: guardrails are a pipeline wrapped around the model — input filters before it, output filters after it, and a permission model that bounds what the model's decisions are allowed to cause — not an instruction the model chooses to follow. This distinction is the single most reliable signal interviewers use to separate people who have shipped an LLM system from people who have only prompted one, because it is the exact place where "the model can be persuaded" stops mattering: a persuaded model that has no authority to leak data or execute a refund cannot cause the failure, no matter how good the persuasion was.

This subject is the standalone deep-dive on that topic. case-study-customer-support-assistant and case-study-coding-agent both include a guardrails section because every real system needs one, but here the goal is to go one level deeper than either: precisely how prompt injection works and why it resists the fixes people reach for first, what each defense-in-depth layer actually does and does not catch, what a guardrail fundamentally cannot promise against an adaptive attacker, and how to reason about the latency and dollar cost of the pipeline instead of treating safety as free. llm-application-system-design covers the same pipeline in compressed form as one section of a larger system; treat this as the expansion, and tool-and-function-calling as the sibling subject for the tool-scoping half of the defense.

The throughline to hold onto for the rest of this subject: the model is a component, not a boundary. Every input the model sees — a user message, a retrieved chunk, a web page, a tool result, a file — is a place an attacker can plant instructions, and every output the model produces is a place a mistake or a successful attack can surface. Guardrails are the code that sits on both sides of that component and does not trust it.