The defining property of a guardrail is that it holds when the model is wrong. An instruction in a system prompt asking a model not to exceed a refund limit is a preference; a server-side check that rejects the call is a control. This distinction is the single most common gap between agent demos and agent deployments, and it is invisible until something goes wrong.
Guardrails also need to survive manipulation. Content returned by a tool — a support ticket, a web page, a document — can contain text aimed at the model, so tool output should be treated as untrusted data rather than instructions. An agent that is talked into calling a destructive tool still cannot call one that was never exposed to it.