What is Guardrails?

A prompt is guidance; a guardrail is enforcement. The distinction matters because never send email without asking, written in a system prompt, is a suggestion the model can be talked out of, while a rule in your code that refuses the send call unless a human approved it cannot be. Guardrails come in layers: validating what goes in, checking what comes out, restricting which tools are reachable, capping how many steps or tokens a run can burn, and gating the actions that can't be undone.

Velaris puts its guardrails in the runtime rather than the prompt. Every tool carries a tier — read, write or destructive — and destructive tools require an explicit human approval before they execute, enforced outside the model's reach. Credentials are scoped per run, so even a compromised or misled agent is bounded by what that run's token can touch. This is the practical answer to prompt injection: assume the model can be persuaded, and make sure persuasion isn't enough to cause damage.