A guardrail is an enforceable check that can allow, deny, or rewrite a model hop before it lands. Internals: intercept, evaluate facts, fail closed. Java samples for input and tool rails.
What
An enforceable check on a hop: input, tool call, or output. Returns allow, deny, or rewrite.
Not
A polite system prompt, a second LLM as the only gate, or logs after the leak.
Inside
Intercept the hop, pack facts, run deterministic policy first, then apply the verdict and audit.
Fail
Hang or unknown tool means deny. Rewrite caps limits. Deny never reaches the tool.
Code
Java predicates on the host, before the client ships. Same shape as an ACS Guardian.
Turn
Search can run with a cap. send_email is not on the allowlist, so the user sees the block.