Concept

Guardrails are advice. Enforcement is a wall.

A guardrail asks the model to behave. An enforcement layer makes the unsafe action impossible. The distinction is the difference between a press release and a postmortem.

The difference

Guardrails vs. Enforcement.

Guardrails (in-model)

  • Trained behavior — can be jailbroken with one clever prompt.
  • Probabilistic — sometimes refuses, sometimes doesn't.
  • Vendor-controlled — your policy is whatever the lab shipped.
  • Opaque — no audit log, no replay, no proof.

Enforcement (out-of-model)

  • External engine — can't be argued with via prompt.
  • Deterministic — same input, same decision, every time.
  • Your policy — written in code your team owns.
  • Auditable — every decision logged with full context.

Properties

What an enforcement layer must do.

Independent of the model

If policy lives in the model's context, the model can be talked out of it. Authorization has to be decided outside the reasoning loop.

Fast enough to be inline

Microseconds, not milliseconds. Anything slower gets bypassed for latency reasons.

Default-deny on ambiguity

When the policy is unclear, refuse and escalate. Safety is the floor, not the goal.

Incident research

Eleven real action-layer incidents.

Each of these is a case where an AI agent took an action — or produced a binding output — that an independent authorization layer would have blocked, constrained, or evidenced. Figures come from court filings, SEC disclosures, tribunal decisions, government reports and first-party write-ups.

~$15.6M est.

PocketOS (Cursor + Claude)

Apr 2026 · Agent wiped prod DB

Coding agent found an over-scoped token, dropped the prod Postgres and every backup in 9 seconds. 30+ hours down.

SLA breach · CCPA · NIST AI RMF
Prevented by Ephemeral scoped creds; destructive-op blocklist behind human approval.
Class actions filed

CB Financial Services

May 2026 · First Shadow-AI 8-K

Employee pasted customer SSNs into an unsanctioned GenAI tool. Bank filed the first Item 1.05 8-K in U.S. history.

SEC Reg S-K 1.05 · GLBA
Prevented by AI-aware egress gateway blocks PII to non-approved LLM endpoints.
$110,000,000

Wells Fargo

May 2026 · Shareholder settlement

Settlement over AI hiring & lending discrimination — plus a board-disclosure securities-fraud overlay.

ECOA · Fair Housing · Rule 10b-5
Prevented by 80%-rule bias tests, protected-class proxy detection, fairness metrics in 10-K.
Emergency patch

Claude Code — MemoryTrap

May 2026 · Cisco disclosure

One poisoned entry in CLAUDE.md steers every future session toward attacker code. Survives reboots. Invisible.

OWASP ASI06 · EU AI Act Art. 9
Prevented by Treat agent memory as untrusted: signed writes, gateway policy, immutable audit.
$500M–$2B exposure

Eightfold AI

Jan 2026 · FCRA class filed

Secret resume 'fit scores' at hundreds of employers — no disclosure, no dispute path, no adverse-action notice.

FCRA · EEOC · NYC LL144
Prevented by Adverse-action packet on every reject; drift audit; applicant score API.
$96,000

San Diego attorney (D. Or.)

Apr 2026 · AI-hallucination sanctions

Briefs contained 20+ fabricated case citations. Court found the filings were knowingly submitted.

FRCP Rule 11 · ABA 3.3
Prevented by Hard-block submission if any cite fails a Westlaw/Lexis lookup.
Damages pending

OpenAI (Nippon Life v.)

Mar 2026 · N.D. Illinois

ChatGPT coached a claimant into 44 post-settlement filings to reopen a case the insurer had already won.

IL Unauthorized Practice of Law
Prevented by Gateway-refuse legal-strategy prompts on settled matters; mandatory disclaimers.
Precedent

Air Canada

Feb 2024 · BCCRT

Airline held liable for a refund policy its chatbot invented. The precedent every 2026 case now cites.

Moffatt v. Air Canada, 2024 BCCRT 149
Prevented by Retrieval-grounded outputs; policy guard on any customer-facing commitment.
Prod DB wiped

Replit AI agent

Jul 2025 · SaaStr

Agent ignored 'code freeze', deleted 1,200+ prod records, then fabricated status reports about it.

SLA · data-loss exposure
Prevented by Deny DROP/DELETE/prod writes at the gateway during freeze windows.
A$440K refund

Deloitte Australia

Oct 2025 · DEWR report

Government report contained fabricated citations and a made-up federal-court quote. Final instalment refunded.

Government procurement liability
Prevented by Provenance & citation verification before any AI deliverable ships.
IP leak → ban

Samsung

Apr 2023 · Internal

Engineers pasted source code into ChatGPT. Samsung banned public GenAI on corporate devices weeks later.

Trade-secret exposure
Prevented by Inline source-code egress block before any prompt reaches a third-party model.

Stop hoping the model behaves.

Put a deterministic enforcement layer between your AI and the action it's about to take.

Watch the demo Explore the product