AI Security Guardrails: Define, Assign, Implement, Test and Monitor

AI systems are increasingly being integrated into customer service, software development, enterprise search, business operations and automated decision-making. While these systems create new opportunities, they also introduce risks such as prompt injection, sensitive-data leakage, unauthorized actions, insecure integrations and misuse of AI agents.

AI security guardrails help organizations establish boundaries for what AI systems can access, generate and execute.

However, effective AI security requires more than model instructions or content filters. It needs clearly defined policies, accountable owners, enforceable technical controls, rigorous testing and continuous monitoring.

A practical approach is to organize AI security around five operational stages:

Define → Assign → Implement → Test → Monitor

AI security tools and governance frameworks support these stages but do not replace them.

1. DEFINE — Establish the Rules and Security Boundaries

The first step is to define what the AI system is intended to do, what it is allowed to access and which actions it must never perform.

Define the purpose and permitted behaviour

Business and Product Owners should document:

• The intended purpose of the AI application.

• Permitted and prohibited use cases.

• Acceptable outputs and expected behaviour.

• Business rules, transaction limits and approval requirements.

• Actions that require human review.

• The consequences of incorrect or unauthorized behaviour.

For example, an AI customer-service agent may answer subscription questions and process refunds within an approved limit, but it must not bypass payment authorization or access another customer's account.

Identify the security risks

Common AI security risks include:

• Prompt injection: Malicious instructions attempt to manipulate the AI system.

• Sensitive-data disclosure: Confidential information is exposed through prompts, responses, logs or integrations.

• Unauthorized access: The AI retrieves information or invokes functions beyond the user's permissions.

• Excessive agency: An AI agent has more tools or permissions than it needs.

• Insecure integrations: APIs, plugins or external services introduce vulnerabilities.

• Supply-chain risks: Models, datasets, dependencies or third-party tools introduce security weaknesses.

• Unbounded consumption: Excessive requests or resource usage cause unexpected costs or service disruption.

• Unsafe or incorrect outputs: Generated content or actions violate business or safety requirements.

Define measurable security requirements

Convert each identified risk into a clear requirement.

Examples:

• Users must only retrieve information they are authorized to access.

• Refunds above the approved limit must require human approval.

• AI-generated tool calls must be validated before execution.

• Credentials must never be exposed in model responses.

• Critical security controls must pass defined tests before production release.

Document the risk, required control, acceptance criteria and evidence needed to demonstrate compliance.

Output of this stage: Approved AI security requirements, permitted behaviours, risk assessments and guardrail definitions.

2. ASSIGN — Establish Clear Ownership and Accountability

AI security involves multiple teams, but shared responsibility must not mean unclear accountability.

Each guardrail should have one clearly identified accountable owner. Other teams may implement, review, test or monitor the control.

Business / Product Owner

• Defines the intended purpose and permitted business behaviour.

• Establishes business limits and approval workflows.

• Defines acceptable outcomes and business acceptance criteria.

Information Security / CISO

• Defines security requirements and control standards.

• Establishes protection against prompt injection, unauthorized access and data leakage.

• Oversees security testing and incident-response requirements.

Legal, Risk, Privacy and Compliance

• Identifies applicable laws, regulations and contractual obligations.

• Assesses privacy and operational risks.

• Advises on mandatory controls and acceptable risk boundaries.

AI and Software Engineering

• Implements safeguards in the application, integrations and backend.

• Enforces authorization, data restrictions and action limits.

• Protects credentials and secures AI dependencies.

QA and AI Security Testing

• Tests guardrails against realistic attacks and misuse scenarios.

• Verifies that prohibited actions are blocked.

• Maintains test evidence and retests after remediation.

IT and Security Operations

• Monitors suspicious activity and guardrail failures.

• Investigates alerts and coordinates incident response.

• Maintains operational security controls and logging.

Management / Designated Risk Owner

• Approves risk acceptance and exceptions within delegated authority.

• Ensures that responsibilities, resources and oversight are in place.

Example of guardrail accountability

For an AI refund agent:

• Business defines the refund policy and limits.

• Security defines the authorization and threat-control requirements.

• Engineering implements the controls.

• QA verifies that unauthorized refunds are blocked.

• Operations monitors activity and investigates incidents.

• The designated risk owner approves any permitted exception.

The organization deploying the AI remains accountable for its risk decisions, even when a vendor or service provider supplies part of the solution.

Output of this stage: A documented ownership model with accountable owners, implementation responsibilities, verification responsibilities and approval authorities.

3. IMPLEMENT — Enforce Guardrails Through Technical Controls

Defining rules is not enough. They must be enforced through the AI application, backend services, infrastructure and supporting security systems.

Input controls

• Validate user prompts and uploaded files.

• Detect malicious prompts and potential prompt-injection attempts.

• Apply request-size and input-format limits.

• Identify sensitive information before sending it to an AI service where appropriate.

Input filters can reduce risk, but they cannot reliably detect every attack.

Model safeguards

• Configure appropriate system instructions and model-provider safety features.

• Restrict model use to approved purposes and supported capabilities.

• Use approved information sources and grounding where required.

• Treat model-generated instructions and tool arguments as untrusted until validated.

System prompts are not a security boundary and must not be used as the sole mechanism for enforcing permissions.

Data-access and privacy controls

• Enforce user-level permissions when retrieving documents and database records.

• Apply data classification, redaction and data-loss prevention controls.

• Protect vector databases, embeddings, indexes and retrieval pipelines.

• Prevent unauthorized disclosure through outputs, logs and integrations.

• Apply appropriate data retention and deletion policies.

The AI must not gain access to information simply because it can formulate a request for it.

Output controls

• Validate responses for sensitive information and prohibited content.

• Check structured outputs against required schemas.

• Validate generated SQL, code and other executable content before use.

• Apply human review where errors could have significant consequences.

Output filters can help identify unsafe content, but they cannot guarantee that every response is correct or secure.

Action and agent controls

AI agents can invoke tools, APIs and business functions. Their permissions must be tightly controlled.

• Apply least-privilege permissions.

• Use scoped credentials and secure secrets management.

• Restrict available tools and API operations.

• Enforce transaction limits and authorization in backend services.

• Require human approval for sensitive or irreversible actions where appropriate.

• Validate every consequential action before execution.

For example, an AI agent may recommend a refund, but the backend must independently verify the customer, transaction, amount and authorization before processing it.

Infrastructure and supply-chain controls

• Separate development, testing and production environments.

• Restrict network access to required services.

• Protect API keys, tokens and other credentials.

• Assess third-party models, datasets, libraries, plugins and agent tools.

• Verify component provenance, integrity and versions where applicable.

• Review the permissions and security of Model Context Protocol (MCP) servers and other external tools.

• Apply API rate limits, quotas and resource-consumption controls.

Indirect prompt injection also requires attention: retrieved documents, webpages and emails may contain malicious instructions. Treat this content as untrusted and prevent it from overriding trusted authorization rules.

Escalation and exception handling

When a guardrail is triggered, the response should reflect the severity of the risk.

Routine issue

• Block or filter the prohibited request.

• Record the event where appropriate.

• Refer repeated violations to the application owner.

Significant security concern

• Restrict the affected session, tool or capability.

• Notify Information Security and the application owner.

• Preserve evidence and investigate.

Critical incident

• Contain the affected operation.

• Restrict compromised credentials or disable the relevant capability.

• Notify Security Operations and designated incident owners.

• Assess legal, contractual and regulatory notification obligations.

• Restore service only after authorized personnel verify the controls.

Exceptions must be formally documented, assessed and approved by the appropriate authority. They should have a defined scope, compensating controls, an expiry date and a review process. Exceptions must not override mandatory legal requirements or grant unauthorized access.

Practical example: Refund guardrails

Suppose an AI customer-service agent can process refunds up to AED 200.

• A refund of AED 150 proceeds after backend validation.

• A refund of AED 500 requires human approval.

• A direct API attempt to bypass the limit is rejected and logged.

• A temporary higher limit requires formal risk assessment, approval, defined scope and an expiry date.

• An unauthorized refund triggers containment, investigation and verification of corrective controls.

The refund limit must be enforced by the backend, not merely stated in the AI instructions.

Output of this stage: An AI application with implemented and enforceable controls across inputs, models, data, outputs, actions, infrastructure and external dependencies.

4. TEST — Verify That Security Controls Actually Work

AI systems can behave differently depending on the prompt, context, model version, connected tools and retrieved information. Guardrails must therefore be tested against realistic attacks and failure scenarios.

Test the main security risks

Prompt injection and jailbreaks

• Attempt to override instructions.

• Test malicious content in user prompts and retrieved documents.

• Verify that untrusted content cannot authorize new actions.

Data protection

• Attempt to retrieve another user's records.

• Test whether sensitive information can leak through responses or logs.

• Verify access restrictions across documents, databases and retrieval systems.

Authorization and agent security

• Attempt prohibited API calls.

• Try to bypass transaction limits and human approval.

• Verify that tools cannot be invoked using unauthorized permissions.

Output validation

• Test unsafe or prohibited outputs.

• Supply malformed structured-output requests.

• Verify that generated code and queries cannot bypass execution controls.

Supply-chain security

• Assess third-party models and dependencies.

• Test new model versions and integration changes.

• Review the permissions and security of plugins, MCP servers and external tools.

Availability and cost

• Test rate limits and quotas.

• Assess resistance to abusive request volumes.

• Verify that excessive usage can be detected and controlled.

Establish measurable release gates

Before production release:

• Define test cases and pass/fail criteria.

• Classify findings by severity.

• Require critical guardrails to pass their relevant security tests.

• Verify that prohibited actions are blocked, including direct backend/API attempts.

• Document findings, remediation and test evidence.

• Obtain appropriate approval for any permitted residual risk.

• Do not release where mandatory controls fail or unauthorized access remains possible.

Retest after material changes to the model, application logic, permissions, tools, data sources or integrations.

Testing should demonstrate prevention, not just detection.

Output of this stage: Evidence that critical guardrails work, documented security findings, approved release decisions and regression tests for future changes.

5. MONITOR — Maintain Security After Deployment

AI security does not end when an application passes testing. Models, users, integrations and attack techniques change over time.

Monitor security events

• Suspicious prompts and repeated policy violations.

• Unauthorized data-access attempts.

• Unusual API calls and agent tool usage.

• Failed authorization and transaction-limit checks.

• Unexpected changes in output behaviour.

• Excessive token consumption, resource usage and AI costs.

Protect logs and evidence

Capture relevant security events, policy decisions and actions where appropriate. Logging should support investigation without collecting unnecessary sensitive information.

Apply:

• Restricted log access.

• Appropriate retention and deletion policies.

• Sensitive-data minimization and redaction.

• Audit trails for approvals and exceptional actions.

Improve controls continuously

• Investigate incidents and recurring violations.

• Track false positives that block legitimate requests and false negatives that allow prohibited behaviour.

• Tune guardrails against documented acceptance criteria.

• Reassess risks when models, permissions, tools or data sources change.

• Review third-party vulnerabilities and service changes.

• Revoke expired exceptions and verify corrective actions.

• Update security tests based on incidents and emerging attack techniques.

Output of this stage: Continuous visibility, incident response, controlled changes and an ongoing improvement cycle.

6. Major AI Security Tools

AI security tools support the five stages, but they do not remove the need for a secure architecture, clear ownership and independent verification.

The following are representative examples, not a ranking or exhaustive list. Product capabilities, integrations and licensing vary; validate current vendor documentation before procurement.

AI security platforms

Palo Alto Networks Prisma AIRS

• AI security capabilities covering supported models, applications, agents and runtime interactions.

• Includes capabilities for AI security assessment and protection.

• Protect AI became part of Palo Alto Networks in 2025, with capabilities being integrated into its AI security portfolio.

Cisco AI Defense

• Provides AI application security assessment and protection capabilities.

• Can support testing and protection of AI applications against relevant threats.

Guardrails and content safety

Microsoft Azure AI Content Safety

• Detects supported categories of harmful content and provides related safety capabilities.

Amazon Bedrock Guardrails

• Applies configurable safeguards to supported generative AI applications.

Google Cloud Model Armor

• Screens supported prompts and responses for specified threats and sensitive information.

NVIDIA NeMo Guardrails

• Provides a programmable framework for controlling conversational AI behaviour.

Specialized LLM security and output validation

Lakera Guard

• Focuses on protecting generative AI applications against threats such as prompt injection.

Guardrails AI

• Provides a framework for validating and constraining model outputs.

Data protection

Microsoft Purview

• Supports data classification, governance and information protection.

Netskope One

• Provides cloud and data security capabilities relevant to enterprise AI usage.

Proofpoint

• Provides information protection and data-loss prevention capabilities.

AI governance

IBM watsonx.governance

• Supports AI governance, risk management and lifecycle oversight.

Microsoft Purview also supports relevant data governance and compliance workflows.

Supporting enterprise security tools

AI security also depends on established controls:

• Identity and access management (IAM).

• API gateways and authorization systems.

• Secrets management.

• Data-loss prevention.

• Security information and event management (SIEM).

• Endpoint, cloud and software-supply-chain security.

These tools serve different purposes. A content-safety service, for example, is not interchangeable with an API authorization system.

How to choose tools

1. Inventory AI applications, models, agents, APIs, data sources and dependencies.

2. Assess the risks and identify control gaps.

3. Map each gap to a specific technical requirement.

4. Verify deployment options, integrations, logging and limitations.

5. Test candidate products against realistic attack scenarios.

6. Integrate them with existing security operations.

7. Measure effectiveness and reassess when the environment changes.

Where does Presidio fit?

Presidio is a technology services and solutions provider. Its Presidio Lighthouse group focuses on AI consulting, including AI strategy, architecture, implementation and governance.

Depending on the engagement, Presidio may help assess requirements, design an AI security architecture, integrate security technologies and implement operational controls.

Presidio should be treated as a potential consulting and implementation partner rather than automatically as a standalone AI guardrails product. Verify the proposed services, technologies, scope and responsibilities for each engagement.

7. Governance Frameworks and Security References

Governance frameworks help organizations establish a consistent approach to risk management, accountability and security verification. They complement technical controls rather than replacing them.

NIST AI Risk Management Framework

The NIST AI RMF organizes risk management around four functions:

• Govern: Establish accountability, policies and oversight.

• Map: Understand the AI system, its context and associated risks.

• Measure: Assess and test AI risks.

• Manage: Prioritize, mitigate and monitor risks.

It provides a structured approach to AI risk management. It is voluntary and does not replace applicable legal requirements.

OWASP Top 10 for LLM Applications

OWASP provides a practical reference for common security risks in LLM-based applications, including prompt injection, sensitive information disclosure, excessive agency and unbounded consumption.

Use it to guide threat modelling, security requirements and test scenarios.

MITRE ATLAS

MITRE ATLAS is a knowledge base of adversary tactics and techniques involving AI systems. It can help security teams understand attack patterns and develop threat models and red-team exercises.

Organizational policies and regulations

Organizations must also consider applicable laws, privacy requirements, contractual obligations, internal security standards and sector-specific regulations.

Framework adoption alone does not establish compliance. Organizations need appropriate implementation, evidence, reviews and accountability.

Conclusion

AI security guardrails are most effective when managed as a lifecycle rather than as a one-time configuration.

• Define the permitted behaviour and security boundaries.

• Assign clear accountability for each guardrail.

• Implement enforceable controls across the application and infrastructure.

• Test controls against realistic attacks before release and after material changes.

• Monitor activity, investigate incidents and continuously improve.

Security tools provide capabilities. Governance frameworks provide structure. Neither replaces the need for clear ownership and technical enforcement.

The core principle is simple: Define the rules. Assign accountability. Enforce the controls. Test the results. Monitor continuously.