What are AI guardrails? Explained with an office mailroom

Anthropic's new Claude Fable 5.2 and Mythos 5.2 are the same AI model; the main difference is the guardrails around them, so here is what guardrails are.

In one sentence: AI guardrails are checks placed around an AI model that look at what goes in and what comes out, and block or change anything that breaks the rules, before it reaches the model or the person.

The everyday picture

Picture a large office with one very clever expert on the top floor. The expert can answer almost any letter. But nobody writes to the expert directly. Every letter goes through the mailroom first.

The mailroom clerk opens each incoming letter and checks it against a short list of rules. Letters that ask for something forbidden never go upstairs. The sender gets a polite standard note instead. When the expert writes a reply, it comes back down through the mailroom too. The clerk checks it before it is posted, and can black out private details or hold the reply back.

The expert is the AI model. The mailroom checks are the guardrails. The expert does not change. What changes is what is allowed through the door.

How it works, step by step

1. A person sends a request (a letter arrives). This is the prompt typed into a chatbot or sent by an app.
2. An input guardrail checks it first (the clerk reads the incoming letter). Amazon's documentation for its Bedrock Guardrails service describes this: if the request breaks a rule, a set "blocked message" goes back and the model's work is thrown away.
3. If it passes, the model does the work (the expert writes a reply). The model itself knows nothing about the mailroom.
4. An output guardrail checks the answer (the clerk reads the reply before posting). It can replace the answer with a blocked message, or hide sensitive details such as personal information.
5. The rules are set by whoever runs the system (the office manager writes the clerk's list). Typical rules cover harmful content, banned topics, specific words and private data.

Where the picture stops

• A real clerk reads with judgement. Modern guardrails are often small AI models themselves, called classifiers, trained to spot whole categories of risky text. They judge meaning, not just keywords, but they still make mistakes both ways: some harmful requests slip through and some harmless ones get blocked.
• In the office, the expert and the mailroom are clearly separate. With AI, some safety behaviour is also built into the model during training, so not every protection is a separate checkpoint you can see or switch off.
• A mailroom check costs a few minutes. AI checks cost computing power. In Anthropic's published research on its "Constitutional Classifiers", the guarded system needed 23.7% more compute than the unguarded model.

Why it matters for your business

• Less risk. Guardrails catch harmful requests and leaked private data that the model alone might let through. In Anthropic's own automated test of 10,000 attack prompts, success fell from 86% without its classifiers to 4.4% with them.
• Who gets access. Strong guardrails are why a powerful model can be sold to everyone. Anthropic says Fable's cyber and biology safeguards are what allow it to be offered to all users, while Mythos, with fewer safeguards, needs an application.
• Blocked legitimate work. Guardrails can stop real jobs. Anthropic warns Fable 5.2's safeguards "will block most cybersecurity-related tasks". Security teams need to plan for that.
• Your own rules. Services such as Amazon Bedrock Guardrails let you add your own topics and filters, for example keeping a support bot off legal or medical advice.

An example

Imagine a 30-person travel agency that adds an AI assistant to its website. It sets an input guardrail to turn away questions about anything other than bookings, and an output guardrail that hides passport and card numbers. A customer pastes their card number into the chat by mistake. The output check masks it in the reply, so it is never shown back on screen. The model is the same one any company could buy; the agency's mailroom rules make it fit their business.

Frequently asked questions

Are guardrails the same as a system prompt?

No. A system prompt is instructions given to the model, which it usually follows but can be talked out of. A guardrail is a separate check on the way in or out that blocks text whatever the model wanted to do.

Can guardrails be bypassed?

Sometimes. People try tricks called jailbreaks to sneak requests past them. Good guardrails stop most attempts, but not all: in Anthropic's public challenge in 2025, one participant found a way past its classifiers. Keep human approval for risky actions.

Do guardrails make AI refuse too much?

They can. Tuning them is a balance between catching harm and blocking normal work. Anthropic says Fable 5.2's safeguards are as strong as the previous version's but "produce fewer unnecessary blocks".

Can I add my own guardrails?

Yes. Cloud AI services such as Amazon Bedrock offer configurable guardrails with content filters, denied topics, word filters and sensitive information filters, which you set for your own app.

Related explainers

• What is a system prompt? Explained with a day-one job description
• What is prompt injection? Explained with a forged note in the in-tray
• What is human-in-the-loop? Explained with a manager signing cheques
• What is an LLM? Explained with a new hire who read the whole library

The DevDrift builds AI automation with approvals and audit trails: see how.

Sources

• Anthropic: Introducing Claude Fable 5.2 and Claude Mythos 5.2 (9 November 2026)
• Amazon Web Services: How Amazon Bedrock Guardrails works
• Anthropic: Constitutional Classifiers: Defending against universal jailbreaks