Guardrails

Parent: Agentic.

Guardrails enforce allow/deny before side effects: PII filters, topic blocks, tool firewalls, jailbreak detection. Under Agentic they sit on the model/tool path. They complement IAM (who) and Structured Output (shape) — guardrails decide whether the content/action is permitted.

Technically compare rule packs vs ML classifiers, sync vs async checks, and whether blocks are attributable in logs. Failure modes: guardrails that only wrap the happy demo path, false confidence from regex-only filters, and blocks that vanish when a new framework bypasses the gateway.

Members: NeMo Guardrails, Guardrails AI, LLM Guard, Headroom, Presidio, GLiNER. Prefer programmable rails when policy is complex; prefer library filters when you need embeddable checks next to the call site. For PII detect→anonymize, prefer Presidio (operators + image/structured) with GLiNER / nvidia/gliner-PII as the open-type NER backend — see technologies/_source/presidio-gliner-landscape.md.

Features such as Autonomy Levels and Agent Supply Chain Integrity remind you: guardrails are controls, not a substitute for human authority on irreversible acts.

Inline members for audit: Guardrails AI NeMo Guardrails LLM Guard Headroom Presidio GLiNER. Features: See ≠ may-act Autonomy Levels Agent Supply Chain Integrity. Related terms referenced: IAM, Structured Output, LLM Gateway.

For this research catalog the acceptance test is boring and strict: after wiring the pack, can a second person replay the same scenario and get the same measurable outcome? If not, the page is still a brochure. Document the scenario, the expected number, and the log line that proves it. That habit is what separates a deepened taxonomy cell from a landscape screenshot.

Also record what you refused: tools not connected, corpora not ingested, metrics not collected. Refusals keep the cell honest when marketing pages claim universality. A taxonomy essay that only lists winners teaches less than one that names the skip conditions next to the install path.

Keep the essay technical enough that an engineer can argue install order — and short enough that a reader finishes it before opening the right-rail member list. Prefer primary docs and repo evidence over landscape blurbs when the right-rail packs disagree.

Operational discipline for this cell: name the install artifact, the health check, and the rollback. Prefer one golden path documented against a member pack in the right rail over five half-wired demos. When packs disagree, believe the primary repository README and a failing test you can re-run — not the landscape one-liner. Measure latency, cost, and error rate on a frozen scenario before declaring the subcategory “covered.” If you cannot point at a log line that proves the scenario, the essay is unfinished even when the word count clears the audit floor.

Cross-link greedily but honestly: every taxonomy wikilink should change a reader’s next click, and every pack slug should resolve to a real pack. Do not invent members to decorate the prose. Prefer fewer true links over many decorative ones. Keep Monday-shaped typing out of the runtime story; observation and ledger remain senior to any agent UI that retypes reality.