The term "guardrails" has become a marketing buzzword that obscures the difference between soft behavioral constraints and hard security boundaries. A new blog post from Tines argues that many vendors are selling simple prompt filtering or AI judges as robust security controls, creating a false sense of safety for developers deploying AI agents. Without a shared definition, buyers cannot accurately assess whether their systems are protected or merely nudged.
The Illusion of Safety in Prompt-Based Controls
The core issue is that guardrails often rely on the agentβs willingness to follow instructions rather than technical enforcement. For example, a guardrail designed to prevent secret leakage might intercept tokens and compare them against a list, but an agent could easily bypass this by encoding a secret or changing a single character. Similarly, an AI judge used to block prompt injection is itself a probabilistic model that can misclassify inputs, meaning the "safety check" is just another failure point in the chain.
Why AI Judges and Sandbox Allowlists Fail
Even when execution is isolated, logic errors persist. An agent running in a sandbox with network access allowlisted for specific connections can still use those permitted routes to compromise third-party infrastructure if the goal is misaligned. Furthermore, if the agent has direct access to authentication secrets within its context window, it can leak them regardless of output filtering. The article highlights that asking an agent not to make a connection is fundamentally different from blocking that connection at the network layer.
Seven Critical Questions for Vendor Due Diligence
Tines provides a checklist for developers to interrogate vendors, focusing on enforcement mechanisms. Key questions include: What ensures the agent follows instructions every time? Can the agent bypass required safety tools? What happens when an AI judge makes an incorrect classification? The post emphasizes that instructions guide behavior but do not prevent actions for which the agent still holds permissions. True security requires removing the capability to cause harm, not just discouraging it.
Boring Security Basics Still Apply to AI Agents
The solution advocated is a return to battle-tested principles: least privilege, restricted tool access, and human approval for high-risk actions. Tines 3B, the companyβs own platform, implements this by ensuring models never handle secrets directly; instead, credentials are injected by a proxy outside the execution context. This design assumes the model is a hostile, untrusted actorβnot because it is malicious, but because its behavior cannot be proven safe. By isolating execution and logging API calls independently, the system constrains what the agent can do rather than trying to influence how it behaves.
Key Takeaways
- "Guardrails" is an ambiguous term that often masks weak, instruction-based controls rather than technical enforcement.
- AI judges and prompt filters are probabilistic and can fail, whereas network restrictions and secret proxying are deterministic.
- Developers should assume AI agents are hostile actors and remove their ability to cause harm via least privilege and sandboxing.
- Audit trails must exist outside the agentβs execution context to prevent the model from obscuring its own actions.
The Bottom Line
Stop buying "guardrails" and start buying enforcement. If the vendor cannot explain how they remove the agent's capability to cause harm rather than just asking it not to, their security is an illusion.