Guardrails

A guardrail must produce the same output for the same input every time, operating as a rule-based system rather than a probabilistic one. This is critical for legal compliance where ambiguity is unacceptable.

• Regex Patterns: Scans for privileged information like Social Security Numbers or attorney-client labels.
• Keyword Blocklists: Prevents the model from outputting specific prohibited terms.
• Schema Validation: Ensures structured outputs (JSON) conform to a strict contract before delivery.

Guardrails must operate on both the user's prompt and the model's generated response. Input guardrails sanitize the request, while output guardrails catch hallucinations or policy violations before they reach the user.

• Input Rail: Detects and neutralizes a prompt injection attempt before it reaches the model's context window.
• Output Rail: Validates that generated case citations exist in a ground-truth database, enforcing citation fidelity.

The guardrail layer must function as a separate, non-negotiable service that does not rely on the language model's self-critique. A model cannot be trusted to guard itself.

• External API Call: An output rail queries a legal database to verify a cited statute before the text is streamed to the user.
• Heuristic Filter: A secondary, smaller model (or regex engine) classifies the output for policy violations, acting as an adversarial auditor.

When a guardrail encounters an ambiguous or unverifiable state, it must default to a safe, restrictive action rather than allowing potentially harmful content through. This is the principle of fail-closed design.

• Default Refusal: If a citation checker cannot confirm a reference, the output is blocked with a 'citation not found' error instead of being displayed.
• Session Termination: A detected jailbreaking attempt triggers an immediate halt to the interaction and a log of the adversarial input.

Effective guardrails are not one-size-fits-all. They dynamically adapt their strictness based on the user's role, the data's classification, and the specific legal task being performed.

• Role-Based Access: A paralegal's query might be blocked from accessing sealed documents that a judge's query could retrieve.
• Jurisdictional Rules: The guardrail applies the specific statutory interpretation rules of a target jurisdiction (e.g., GDPR vs. CCPA) based on the document's metadata.

Every action a guardrail takes—whether passing, blocking, or redacting content—must be logged with a full audit trail. This provides the transparency required for enterprise governance and debugging.

• Decision Logs: Records the specific rule that triggered a block, the input that caused it, and the timestamp.
• Drift Monitoring: Tracks the rate of guardrail activations over time to detect prompt drift or new attack patterns against the system.