Notifications
Clear all
Topic starter
23/06/2026 9:20 pm
TL;DR: Static guardrails use fixed rules, regex, blocklists, and hard-coded checks to control AI inputs, tool outputs, reasoning, and final responses, according to ZioSec. They remain fast and auditable, but the article shows they struggle with oblique language and prompt injection, so static controls alone do not close the context gap.
NHIMG editorial — based on content published by ZioSec: Static Guardrails in AI, Part 1
By the numbers:
- While 71% of IT teams have been advised on AI agent data access, only 47% of compliance teams, 39% of legal teams, and 34% of executives have the same visibility.
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
Questions worth separating out
Q: How should security teams use static guardrails for AI agents?
A: Use static guardrails as a first-pass control for known bad inputs, prohibited outputs, and obvious data leakage.
Q: Why do static guardrails fail against prompt injection in agentic systems?
A: They fail because prompt injection often depends on meaning, sequencing, or social engineering rather than a simple forbidden string.
Q: What do security teams get wrong about AI guardrails?
A: The common mistake is treating text filters as if they were the full governance layer.
Practitioner guidance
- Map guardrails to trust boundaries Document where input, reasoning, tool use, and output are separately controlled so no single rule engine is treated as the entire safety model.
- Add controls for context-sensitive abuse Test prompts that use indirect wording, social engineering, or multi-step instruction chaining rather than only obvious blocked phrases.
- Restrict tool authority separately from content safety Limit which tools an agent can call, what data each tool can return, and which actions require a stronger approval path than a text filter can provide.
What's in the full article
ZioSec's full blog covers the operational detail this post intentionally leaves for the source:
- Code-level examples of regex, allowlist, and hard-coded policy checks for AI inputs and outputs
- Placement guidance for pre-agent, tool-boundary, reasoning-time, and post-agent controls
- Practical examples of where static guardrails stop and dynamic guardrails must take over
- Implementation context for teams building agentic applications with compliance requirements
👉 Read ZioSec’s analysis of static guardrails for AI agent safety →
Static guardrails for AI agents: are your controls keeping up?
Explore further
25/06/2026 2:35 am
Static guardrails are necessary, but they are not an identity control. They can block known strings and known bad patterns, but they do not govern who or what the agent is allowed to become mid-session. For AI agents, the security question shifts from content filtering to runtime authority, tool boundaries, and data access scope. Practitioners should treat static rules as a hygiene layer, not as the governance model.
A few things that frame the scale:
- 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so, according to AI Agents: The New Attack Surface report.
- Only 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials, according to AI Agents: The New Attack Surface report.
A question worth separating out:
Q: How can organisations tell whether guardrails are actually working?
A: Measure more than block counts. Look for reduced leakage of sensitive fields, fewer successful prompt-injection attempts, lower rates of unauthorised tool calls, and clear evidence that unsafe outputs are stopped before delivery. If the agent still reaches restricted data or actions, the guardrails are only creating an appearance of control.
👉 Read our full editorial: Static guardrails in AI expose the context gap in agentic systems
