Guardrails that work: classifiers, policies and moderation in production

Seven layers, not one filter

Each layer catches a different failure; together they cover what no single model can.

Layers 5 and 7 do not depend on any model being right, which is why they hold when the others fail. The UK's NCSC says the same about prompt injection: treat it as a residual risk and limit its impact with deterministic, non-LLM controls.

The guard models available in September 2026

Note that “guard model” covers different jobs. Prompt Guard 2 and Prompt Shields look for attacks in inputs, ShieldGemma 2 moderates images, NeMo Guardrails orchestrates other models and the rest judge content against a policy. Every card also lists limits, from English-only evaluation to weaker reliability on obfuscated inputs.

Policy-as-prompt classifiers help in Spanish and French

Classic guard models bake a fixed taxonomy into their weights, such as Llama Guard 4's 14 hazard categories. Policy-as-prompt classifiers (gpt-oss-safeguard, Shieldstral and Granite Guardian's “bring your own criteria” mode) read your policy as plain-language input at inference time, next to the content being judged. Changing the policy means editing text, not collecting labeled data and retraining.

The legal or compliance team that owns the policy can write it in the language of the business, with its own examples: what counts as financial advice for a Colombian bank, or as a medical claim for a French insurer. One model applies it across products, and every change is versioned and reviewable.

Two cautions. Accuracy depends on wording: Google warns that ShieldGemma 2 is “highly sensitive” to how safety principles are described. And reasoning costs money: gpt-oss-safeguard offers low, medium and high effort, and Granite Guardian 4.1 a thinking and a non-thinking mode, so the usual design is a cascade: a fast single-pass classifier first, the reasoning judge only for flagged or ambiguous content.

Measure on your own labeled set

Vendor numbers say a model is plausible; only your data says it works.

Build the set from real traffic, in each language: clearly allowed requests, clearly disallowed ones and, above all, the borderline cases where over-refusal lives. Public benchmarks help seed it (XSTest and OR-Bench for over-refusal, SORRY-Bench for unsafe requests), but they are mostly in English and do not know your policy.

Vendor figures show the trade-offs. Meta reports 97.5% recall at a 1% false-positive rate for Prompt Guard 2 86M. Anthropic's first Constitutional Classifiers cut jailbreak success from 86% to 4.4% in its tests, at 23.7% more compute and 0.38 points more refusals; the 2026 cascade brought over-refusal to about 0.05% and overhead to roughly 1%. Useful references, but none measures your policy in your languages: that is the job of your own evals.

What jailbreak research shows

Four results, described at the conceptual level only.

• Many-shot jailbreaking (Anthropic, 2024) fills a long context with fake dialogues in which an assistant complies. Harmful answers rise with the number of examples, and larger models proved more susceptible. Training the model to resist only delayed the effect; classifying and rewriting the prompt first cut attack success from 61% to 2% in one internal test.
• Best-of-N (2024) resends a request with random surface variations until one gets through, with no access to the model's internals. With enough attempts, the authors report 89% success on GPT-4o and 78% on Claude 3.5 Sonnet, and it also got past defenses such as circuit breakers.
• Crescendo (Microsoft, 2024) escalates over several turns, each harmless on its own: 98% success against GPT-4 and 100% against Gemini Pro in its authors' tests.
• Bug bounties show what layering buys. In Anthropic's February 2025 challenge, 339 researchers sent over 300,000 messages and one found a universal jailbreak. Against the 2026 system, some 198,000 attempts had found none by January 2026, with rewards of up to $35,000.

The lesson: long context beats a single safety-trained model, repeated sampling beats a single static classifier, and multi-turn escalation beats per-message filtering. Classify whole conversations, rate-limit, watch for bursts of near-identical retries and keep layers that do not depend on any model.

Two reference architectures

A customer chatbot mostly risks bad answers; an internal agent mostly risks bad actions.

For agents, no classifier replaces capability limits: an agent that cannot send email cannot be tricked into leaking data by email. More patterns in prompt injection and agent security and AI agents in production.

What it means for companies in Colombia and Europe

Languages. Check each guard model's coverage against your real traffic: Llama Guard 4 and Shieldstral list Spanish and French, Qwen3Guard claims 119 languages, and Granite Guardian 4.1 and ShieldGemma 2 were trained on English data. Measure in Colombian Spanish and in French, with slang, typos and mixed languages, not on translated benchmarks.

Data residency. Most open guard models ship under Apache 2.0 and run on your own infrastructure, so screened content never leaves it. Their logs hold the most sensitive text in your system: in Colombia they fall under Ley 1581 de 2012, in the EU under the GDPR, with retention and access rules to match.

Regulation. In the EU, Article 50 of the AI Act has required since August 2, 2026 that people be told they are interacting with an AI system. From December 2, 2026, an image or video generator that can foreseeably and reproducibly produce non-consensual intimate images or child abuse material needs safeguards that reliably prevent it, or falls under the new prohibitions: there, guardrails become a legal requirement. Details in our 2026 regulatory map.

Launch checklist

1. Write the policy: scope, definitions, allowed and disallowed examples per language, owner and version.
2. Build a labeled set from real traffic, borderline cases included, in every language you serve.
3. Choose guard models on measured errors, latency and cost, not on vendor tables.
4. Put a light input classifier first and treat all retrieved content as untrusted.
5. Classify outputs against the same policy, with a defined action per verdict: allow, rewrite, block or hand off.
6. Give agent tools least privilege and require confirmation for irreversible actions.
7. Log inputs, outputs, verdicts and model versions under a retention policy; alert on retry bursts and escalating conversations.
8. Red-team before launch, multi-turn and many-attempt attacks included, and again after every model or policy change.
9. Review refusals and blocks weekly and feed the errors back into the labeled set.