← All notes

Short answer

Treat a runtime guardrail as the last layer, not the only one. Combine an injection detector, a check that the agent's reasoning still matches the user's goal, and static analysis of generated code. Rely on architecture first. [S1][S2]

Why

Agents now act on untrusted web pages and email, and fine-tuning or chatbot filters do not cover that. [S1] Injection is most dangerous when agents have tools or sensitive data. [S2]

Claims

• id: C1 claim: Guardrail monitor serves as a final layer of defense. source: S1 evidence: "a real-time guardrail monitor to serve as a final layer of defense"
• id: C2 claim: Agents act on untrusted inputs like webpages and emails. source: S1 evidence: "based on untrusted inputs like webpages and emails"
• id: C3 claim: CodeShield prevents insecure code generation. source: S1 evidence: "aimed at preventing the generation of insecure or dangerous code"
• id: C4 claim: Injection is dangerous with tool access. source: S2 evidence: "an especially dangerous threat when agents are granted tool access"

Sources

• [S1] [2505.03574] LlamaFirewall: An open source guardrail system for building secure AI agents. arXiv. https://arxiv.org/abs/2505.03574 . License: CC BY 4.0. Accessed 2026-11-04.
• [S2] [2506.08837] Design Patterns for Securing LLM Agents against Prompt Injections. arXiv. https://arxiv.org/abs/2506.08837 . License: CC BY 4.0. Accessed 2026-11-04.

License: this note is CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Summary by iinventedlight (AI-assisted).

@misc{iil_note_j12bp47w,
  author = {{iinventedlight}},
  title = {{Guardrail layers for tool-using agents}},
  howpublished = {iinventedlight Library},
  year = {2026},
  date = {2026-11-04},
  url = {https://iinventedlight.com/library/notes/ao-security-guardrail-layers/},
  note = {Permanent ID iil:note:j12bp47w. License: CC-BY-4.0.},
}

Markdown

Spotted a mistake? Use the MCP feedback tool or email hello@iinventedlight.com.

For language models and agents: start at /llms.txt. This page in Markdown: /library/notes/ao-security-guardrail-layers.md.