Safe AI needs guardrails at three levels: instruction, query, and response. Most systems have half of one.
A tribunal just held an airline liable for its chatbot's answer. A layered guardrail blueprint — and where PII, revenue and sensitive data must be stopped.
🛡️ Safe AI needs guardrails at three levels: instruction, query, and response. Most systems have half of one.
Last week a Canadian tribunal ordered Air Canada to compensate a passenger after its website chatbot invented a refund policy. The airline's defence — that it "cannot be held liable for information provided by the chatbot" — was rejected in terms every enterprise should frame on a wall: the chatbot is just part of your website. Its output is your output.
That ruling converts guardrails from an engineering nicety into a balance-sheet item. So here is the layered blueprint I hold every system to — because the most common failure I see is a team with one long system prompt believing they have a safety architecture:
Level 1 — Instruction (the system prompt). Role, scope, tone, refusal rules, "answer only from provided sources." Necessary — this is where you shape behaviour. But be clear about what it is: a request honoured by a probabilistic system, negotiable by any sufficiently creative user or poisoned document. The instruction level sets intent. It enforces nothing. A rule that would cost you money if ignored once cannot live only here.
Level 2 — Query level: filter before the LLM ever sees it. This is the most underbuilt layer in enterprise AI, and the logic for it is airtight — whatever never reaches the model can never be leaked, logged, echoed back, or sent to an external API. Before inference:
PII masking inbound. Users paste what users paste — customer names, phone numbers, ID numbers inside a "quick question." Detect and mask before the prompt is assembled, so personal data never enters the model call, the trace logs, or a vendor's infrastructure.
Sensitive-data screening. Revenue figures, pricing, deal values, unreleased financials — if your policy says this data class does not go to an LLM, the enforcement point is here, not in a prompt asking the model to be discreet about what it has already been handed.
Entitlement check. Is this user allowed to ask this? A junior analyst querying company-wide revenue should be stopped by an authorisation rule at the gate — identity-based, deterministic — not by hoping the model declines.
Scope and injection screening. Off-topic requests and known manipulation patterns get routed to a refusal by a cheap classifier, saving the expensive model for legitimate work. Filtering here is a cost control and a safety control in the same line of code.
Level 3 — Response level: inspect before the user sees it. The Air Canada layer. Even a well-instructed, well-fed model produces output that needs checking:
Outbound DLP. Scan responses for PII, client names, financial figures that should not surface for this user — because retrieval mistakes happen, and the last gate before the screen is the one that counts.
Groundedness check. Does every claim trace to a retrieved source? Uncited answers get blocked or flagged, not shipped.
Commitment screening. For customer-facing systems: does the response state a policy, a price, a promise? Those either match a verified source or route to a human. That single rule is the difference between a helpful bot and a tribunal appearance.
And the layers most teams miss entirely:
The retrieval layer (between 2 and 3, and arguably the most powerful of all): the model cannot leak a document that retrieval never handed it. Document-level permissions enforced at search time — every query trimmed to what this user may see, sensitive collections excluded from indexes by default. Access control at retrieval beats any amount of output filtering, because it removes the hazard instead of catching it.
The action layer, as systems gain tools: allowlisted capabilities, agent permissions capped at the user's own, irreversible actions behind human confirmation.
The evidence layer: every block, mask and refusal logged. When someone asks "how do you know your AI is safe," the answer is this audit trail — not an assurance.
One principle ties all of it together: you cannot filter what you have not classified. Every layer above enforces rules about data — which fields are PII, which figures are restricted, which documents are confidential. If your organisation's data classification is vague, your guardrails inherit that vagueness at every level simultaneously. Guardrail projects that stall are usually data-governance gaps wearing an AI costume.
The uncomfortable question to take to your team this week: for your customer- or employee-facing AI, walk one sensitive query through the pipeline on a whiteboard — where exactly would it be caught? If every arrow ends at "the prompt tells it not to," you have politeness, not protection. The airline had politeness.
Reading: https://www.cbc.ca/news/canada/british-columbia/air-canada-chatbot-lawsuit-1.7116416 https://www.americanbar.org/groups/business_law/resources/business-law-today/2024-february/bc-tribunal-confirms-companies-remain-liable-information-provided-ai-chatbot/