Pattern: Runtime Guardrail

Layer 04 · Runtime Controls & Observability In the chapter 05 catalogue

One working control on the engineering side of AI governance.

Summary: Place input and output guardrails on the model or agent’s runtime path that enforce its Policy Card on every live request and emit a decision to telemetry and to the circuit breaker. The guardrail is where a policy written in layer 01 and a threshold tested in layer 03 become an action taken on a real call, not a claim about one.

Objectives

Enforce policy at the point of action, on inputs and outputs no eval anticipated, and make each enforcement a structured event the assurance and incident layers can consume.

Target users

AI governance engineer, ML engineer, security engineer, platform team.

Impacted stakeholders

Users, model owners, affected persons, incident responders, auditors.

Relevant principles

Give every control teeth; instrument the build to produce its own proof.

Context

An agent or model in production, acting on live inputs, whose Policy Card and eval thresholds exist but have no runtime enforcement point, so a rule proven in CI is unguarded the moment the system meets an input no test covered.

Problem

Policies and evals are point-in-time; the system then meets prompt injection, unsafe outputs and tool calls no one reviewed. A guardrail that only logs is observability mistaken for control: the system watches itself fail in high resolution. Without an enforcement point that can block and emit, the runtime is the gap between a tested control and an uncontrolled action.

Solution

Put a guardrail on both sides of the model/agent path. The input guardrail screens prompts and retrieved context for injection and policy-violating requests before they reach the model; the output guardrail screens generations and tool calls for unsafe content, data leakage and out-of-scope actions before they take effect. Enforce the same Policy Card evaluated in CI¹, so the runtime decision and the pipeline decision share one rule. On every call emit a structured event, {agent, direction (input/output), rule_id, decision (allow/block/redact), timestamp}, to the assurance store (Continuous Assurance Telemetry) and, on a defined breach, signal the circuit breaker (Kill Switch / Circuit Breaker). Guardrail frameworks realise this as a category; the OWASP Agent Control Standard names the runtime-control surface². This is distinct from the kill switch: the guardrail decides one call at a time and stays in the request path; the breaker withdraws the agent’s autonomy wholesale when the guardrail’s signals cross a threshold.

Consequences

The tested control holds on live traffic and every enforcement leaves evidence; the guardrail is also the sensor the breaker and the incident pipeline read. The cost is per-call latency, false positives to tune, and keeping the runtime rule in sync with the Policy Card and eval thresholds.

Related patterns

Policy Card; Kill Switch / Circuit Breaker; Agent Identity & Scoped Credentials; Continuous Assurance Telemetry; Human-in-the-loop Gate; Eval Gate in CI.

Maps to: EU AI Act Art. 14, Art. 15 · ISO/IEC 42001 · NIST AI RMF (Manage) · OWASP Agentic ASI02/ASI03 · Layer 04 Runtime Controls & Observability.

Threat IDs follow the OWASP Top 10 for Agentic Applications 2026 ³ and function labels the NIST AI RMF⁴. Mappings are illustrative, not a claim of conformity.

Sources

1. [1] Policy Cards: machine-readable, deployment-layer governance artefacts for AI agents, linked to enforcement and audit pipelines (arXiv 2510.24383). 2025-10. https://arxiv.org/abs/2510.24383 (verified: primary)
2. [2] OWASP GenAI Security Project unveils the Agent Control Standard (ACS) and 2026 Top 10 for LLM Applications. OWASP GenAI Security Project. 2026-09-01. https://genai.owasp.org/2026/09/01/owasp-genai-security-project-unveils-2026-top-10-for-llm-applications-new-agent-control-standard-and-sponsors-as-community-tops-30000-members/ (verified: primary)
3. [3] Top 10 for Agentic Applications 2026 (ASI IDs). OWASP GenAI Security Project. 2025-12-09. https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/ (verified: primary)
4. [4] AI Risk Management Framework (AI RMF 1.0; Govern, Map, Measure, Manage). NIST. 2023-01-26. https://www.nist.gov/itl/ai-risk-management-framework (verified: primary)