AI guardrails in production: an engineering guide mapped to OWASP and NIST

The OWASP Top 10 for LLM applications lists prompt injection first, followed by risks such as sensitive information disclosure, improper output handling and excessive agency ^[1]. NIST's generative AI profile (AI 600-1) maps similar risks, including confabulation and information security, to actions under its AI Risk Management Framework ^[2].

Greshake and colleagues showed that instructions hidden in web pages, emails or documents that an LLM reads can take over its behaviour: indirect prompt injection ^[3]. Any system that retrieves content or reads email is exposed. Treat retrieved text as data, never as instructions, and limit what the model can do with it.

• Input: classify requests for policy violations and injection attempts; classifiers such as Llama Guard are built for this ^[4].
• Context: retrieve only from approved sources and strip instructions from retrieved content.
• Tools: give each agent the minimum permissions; require approval for actions that send, pay or delete.
• Output: check answers against sources, block sensitive data and validate structured output before it is used.
• People: route low-confidence or high-impact responses to a person.

The Air Canada chatbot told a customer he could claim a bereavement fare after travel, contradicting the airline's own policy page; the tribunal ordered the airline to pay the difference ^[5]. A customer-facing assistant should answer policy questions only from the current policy text, cite it, and hand off when the policy does not cover the case.

Before launch, run a red-team set: injection attempts, requests for other customers' data, policy edge cases and off-topic requests. After launch, log prompts, retrieved context, tool calls and outputs, review samples weekly, and add every incident to the test set.

Found this useful?

Share the key finding on X.