Alignment training shapes how a model behaves in general. Guardrails enforce what a specific deployment allows, and they run outside the model where you can inspect and change them.
Input guardrails sit in front of the model. They screen for prompt injection, for requests the product will not serve, and for personal data that should be redacted before it reaches a third-party API. Output guardrails sit behind it, checking for policy violations, leaked system instructions, unsupported claims, or answers that stray outside the approved domain.
Implementations range widely. Regular expressions catch account numbers. A classifier scores toxicity. A second model checks whether the answer is actually grounded in the retrieved documents. Many teams run several in sequence and log every trigger.
The design question worth settling early is what happens when a rail fires. Blocking outright is safe and frustrating. Rewriting is smoother and can hide real failures. Routing to a human is accurate and does not scale. Pick per rail, and write down the reason, because auditors and incident reviews will both ask.