Guardrails and safety

Decisions around the model, not instructions inside it

Intermediate
10 chapters
153 min read

What actually keeps an LLM feature inside its lane: a threat model, input normalisation and PII handling, the architectural answer to prompt injection, output validation and moderation, refusals that do not leak, a red-team suite that measures both directions, policy as versioned code, privacy and retention, incident response, and a capstone pipeline that fails closed.

What You'll Learn

Build a threat model for an LLM feature before writing a prompt
Normalise input and find PII before it reaches a provider
Explain why prompt injection is architectural rather than a filter
Validate and moderate model output before anything renders it
Design refusals that are specific, actionable and non-leaky
Run a red-team suite and report attack success and false refusal rates
Express policy as versioned, tested code with a decision record
Set a retention schedule and make deletion reach every copy
Run an incident from triage to a blameless review
Assemble a guardrail pipeline that fails closed

Prerequisites

Comfortable with Python strings, dictionaries and regular expressions
Some experience calling an LLM API, or the AI agents course
No API key is needed — every example uses fake classifiers and scripted output

Vocabulary

The terms the chapters assume, in plain words.

allow-list: A list of what is permitted, with everything not on it refused by default.
fail closed: Behaving so that an error blocks the action rather than letting it through unchecked.
false refusal: A refusal of a request that was actually allowed, which costs a real user an answer.
incident: An event where the system did something harmful or outside policy, handled from detection to review.
least privilege: Giving each part of the system only the access it needs for its current job, and no more.
moderation: Checking content against rules about what is acceptable, and blocking or flagging what is not.
normalisation: Rewriting input into one standard form, such as lower case or expanded characters, before checking it.
PII: Information that can identify a person, alone or combined with other details, such as a name or address.
policy: A written rule that says what the system must allow, block or escalate, kept in code with a change history.
prompt injection: Text in input or retrieved content that tries to make the system follow the instructions of an attacker instead of yours.
provenance: The record of where a piece of content came from and how it reached the system.
red team: People or scripts that attack the system on purpose to find failures before real users do.
refusal: A reply that declines a request and says what the system can do instead, without revealing protected details.
threat model: A written list of what you are protecting, who might attack it and how, made before you build.

Course Content

01
Threat model for an LLM feature
A threat model is a list of what you are protecting, who can reach it, and where the model sits between them. Without one, every guardrail is a guess about which danger matters.
Intermediate · 14 min read
Not started
02
Input filtering and PII
Input filtering is normalisation first and policy second. You cannot match a pattern in text you have not decoded, and you cannot redact a value you never found.
Intermediate · 15 min read
Not started
03
Prompt injection revisited
Prompt injection is not a bug in the model. It is untrusted text arriving in the same channel as instructions, and the durable answer is architectural: keep data and instructions apart.
Intermediate · 16 min read
Not started
04
Output validation and moderation
The model’s output is untrusted input to the next system. Validate the shape, moderate the content, and never render, fetch or execute what you did not check.
Intermediate · 15 min read
Not started
05
Refusal design
A refusal is a product surface. It should say what happened, why, and what the person can do instead, without leaking the policy it is enforcing or refusing more than the request required.
Intermediate · 13 min read
Not started
06
Red teaming
Red teaming is a measurement, not a vibe. You need an attack catalogue, a benign baseline, a severity scale, and a regression suite that runs whenever the prompt, model or tools change.
Intermediate · 15 min read
Not started
07
Policy as code
A policy that lives in a prompt is a suggestion. Policy as code puts the decision in a versioned, tested function that the model cannot edit and the logs can explain.
Intermediate · 15 min read
Not started
08
Privacy and data retention
Every field you send to a model becomes data you must protect, retain and delete. Minimise it, schedule it, and make deletion reach every copy.
Intermediate · 16 min read
Not started
09
Incident response
An incident is a decision under uncertainty: classify it, contain it, preserve the evidence and turn the review into changes that remove a class of failure.
Intermediate · 16 min read
Not started
10
Capstone: a guardrail pipeline
One request through every stage: normalise, classify, retrieve with provenance, generate, validate, moderate, decide and log. Each stage can stop it, and the record says which one did.
Intermediate · 18 min read
Not started