Module 3 of 6 · 30 minutes

Guardrails and safety in production

Every production LLM system needs guardrails around the model. This module shows the layers and how to implement them.

Learning objectives

Design layered guardrails for inputs, outputs and actions
Redact personal data and understand its limits
Configure content moderation for your audience
Validate structured outputs
Fail gracefully and test safety continuously

3.1 Defence in depth

No single control makes an LLM application safe. Production systems layer guardrails around the model:

Stage	Guardrails
Before the model (input)	Authentication, rate limits, input length limits, prompt-injection and jailbreak detection, PII redaction, topic filters
Around the model	A clear system prompt, least-privilege tools, retrieval with permission checks
After the model (output)	Content moderation, PII and secret detection, format validation, groundedness checks, policy checks
Around actions	Business rules in code, human approval for risky actions

Layered guardrails: checks before and after the model, with a safe path whenever something is blocked.

3.2 Redacting personal data

Python · simple pattern-based redaction (a starting point, not a complete solution)import re

PATTERNS = {
    "EMAIL": r"[\w.+-]+@[\w-]+\.[\w.-]+",
    "UK_PHONE": r"(?:\+44\s?|0)7\d{3}\s?\d{6}",
    "CARD": r"\b(?:\d[ -]?){13,16}\b",
}

def redact(text):
    for label, pattern in PATTERNS.items():
        text = re.sub(pattern, f"[{label}]", text)
    return text

print(redact("Email jo@example.com or call 07700 900123"))
# -> Email [EMAIL] or call [UK_PHONE]

Pattern matching misses a lot (names, addresses). Production systems combine patterns with dedicated PII-detection services or models — and minimise what data reaches the model in the first place.

3.3 Content moderation

Major providers and clouds offer moderation and safety classifiers for harmful content categories, and platforms such as Amazon Bedrock, Azure AI Content Safety and Google Cloud offer configurable guardrail services. Configure thresholds for your audience — a children's education service needs stricter settings than an internal coding assistant.

3.4 Validating structured output

Python · validate before you trust# !pip install pydantic
from pydantic import BaseModel, ValidationError
from typing import Literal

class Triage(BaseModel):
    category: Literal["BILLING", "DELIVERY", "PRODUCT", "OTHER"]
    urgent: bool
    summary: str

def parse_triage(raw_json):
    try:
        return Triage.model_validate_json(raw_json)
    except ValidationError:
        return None          # retry once, then route to a human

3.5 Graceful failure

A helpful fallback message when the model fails, times out or a guardrail blocks
Human hand-off for sensitive topics or repeated failures
No raw error messages or stack traces shown to users
Fail closed for risky actions: if a check can't run, don't act

3.6 Safety test suites

Keep a red-team suite — injection attempts, jailbreaks, requests for personal data, harmful content prompts, off-topic abuse — and run it with every release alongside quality evals. See the AI Security & Safety course for attack techniques and OWASP's Top 10 for LLM applications.

Key takeaways

Guard inputs, the model's context, outputs and actions.
Pattern-based redaction is a start; combine with dedicated detection and data minimisation.
Moderation thresholds depend on the audience.
Validate structured outputs before using them.
Fail closed for risky actions; run a red-team suite every release.