ANSWER

Guardrails are the rules, controls, and safety mechanisms that ensure an AI feature behaves within acceptable boundaries—even when users try to push it, inputs are messy, or the system is uncertain.

Think of guardrails as the difference between:

• “AI that can do things”
  and
• “AI we can responsibly operate in production.”

Guardrails typically include

Behavior guardrails

• prohibited actions
• prohibited content
• allowed outputs

Data guardrails

• what data can/can’t be accessed or used
• retention rules
• residency or compliance constraints

Decision guardrails

• risk tiering (low/medium/high)
• decision rights (when the agent can act)
• human review requirements

Operational guardrails

• monitoring and alerts
• rate limiting / throttling
• rollback / kill switch criteria
• audit logs

Why BAs should care

Guardrails are often the “missing requirements” that prevent:

• reputational damage,
• compliance issues,
• security incidents,
• and runaway automation.

A BA helps turn vague stakeholder concerns (“this feels risky”) into specific, testable requirements (“this must never happen; if it happens, stop and alert”).