What Do AI “Guardrails” Actually Do? (A Story About Two Products That Never Existed)
Our own AI assistant invented two products that don’t exist — links and all. Here’s what “guardrails” actually means, and why an honest “I’d rather not guess” is sometimes the best answer your website can give.
From the AnswerRails development blog — plain-English explanations of the technology behind trustworthy AI chat.
Every AI product page you’ll read this year says it has “guardrails”. Almost none of them tell you what that means. Is it a list of banned words? A legal disclaimer? A vibe?
This week we shipped a release of AnswerRails that was almost entirely guardrail work, and it started with an embarrassing discovery in our own chat logs. So rather than define the term abstractly, let us show you what guardrails actually are — using a real failure, on our own website, and what it took to fix it properly.
The crests that never existed
Our demo shop, Celtic3d, sells 3D-printed Scottish clan crests, and the AnswerRails assistant on the site answers questions from a knowledge base of real product and clan information. In late July, a visitor asked it a perfectly reasonable question:
“What’s your most Irish clan crest?”
The assistant — running on the small, economical model our free tier uses — answered confidently. It recommended the Clan O’Neill crest and the Clan O’Brien crest, and it helpfully included links to both product pages on our site.
Neither product exists. It invented them — names, descriptions and links — because O’Neill and O’Brien sound like exactly what an Irish-crest product would be called. The links looked completely legitimate, because they pointed at our own domain in the same format as our real product pages. A visitor clicking through would have landed on a “page not found”.
And here’s the part that stung: our own quality checking gave that answer a high score. We already verified links in answers — but only links to other websites. A link to our own site was waved through on trust, no questions asked. The assistant’s most damaging inventions turned out to be the most plausible-looking ones: pages on the very domain it lives on.
A guardrail is a check, not a hope
That incident is a perfect illustration of what “guardrails” means to us, because the fix wasn’t a better model or a sternly worded instruction (though we tightened the instructions too). The fix was a rule the software enforces, whether the AI cooperates or not:
Never take the AI’s word for anything you can check.
In our first post we described the open-book exam: the assistant answers from your documents, not its imagination. Guardrails are everything wrapped around that exam to catch the cases where it goes wrong anyway. In AnswerRails, a visitor’s question now passes through checks at three points:
Before the AI ever sees the message. The incoming message is screened first — and the person this layer protects most is you, the site owner. AnswerRails runs on your own AI provider account, so everything a visitor types into your chat box is processed under your name — and providers have usage policies. A visitor who decides to fill your chat with abuse is doing it on your account. The screen catches that traffic before the answering AI ever sees it: abusive messages get a polite deflection, and only clear, repeated abuse costs a visitor their chat access. One category is deliberately treated differently. Someone whose message suggests they’re in real distress has done nothing wrong, and is never handled like a rule-breaker — no strikes, no telling-off. For those messages the assistant skips the AI entirely and immediately provides signposting to real human support. Some things should never be improvised on, and because this check runs before any AI is involved, it can’t be talked around.
While the answer is being written. This is the open-book machinery: the question is searched against your knowledge base, and the AI writes from the excerpts it’s handed, citing its sources.
After the answer is written — and before your visitor sees it. This is the layer our incident exposed. The software now inspects the finished answer, and every link the AI wants to include on your own site is verified to actually exist — resolved against your real pages, products and posts. If the AI has invented a link, that’s treated as evidence the whole answer has gone off the rails: the answer is withheld entirely, not tidied up and served. The visitor gets an honest message instead, and the invented answer is quarantined in your logs — so you can see exactly what your assistant almost said.
That last design choice surprises people. Why throw away the whole answer over one bad link? Because an invented link is rarely alone. An answer that fabricates a product page has usually fabricated the product too. Stripping the link and serving the rest would mean confidently describing merchandise that doesn’t exist — with the evidence removed.
Staying in its lane
The same release closed a subtler gap. During testing, we asked the shop assistant to explain photosynthesis. The old behaviour: the knowledge base search comes back empty (we sell clan crests, not biology lessons), and the model cheerfully answers from its general knowledge — a small essay on chloroplasts, served on a shop’s website with the shop’s name over it.
Nothing about that answer is dangerous. But it’s not grounded — nothing connects it to your business, and you have no way to vouch for it. And the moment your assistant will answer anything, it will eventually answer something you’d never have signed off: an opinion on a contested political topic, medical advice, a hot take on a competitor. All delivered in your shop’s voice.
So AnswerRails now enforces scope. Friendly conversation — greetings, “what can you do?” — flows normally. But when a substantive question can’t be answered from your documents, the assistant declines rather than freelancing. Which brings us to the most counterintuitive idea in the whole subject.
Why a deflection can be the right answer
Here’s what a visitor sees when one of these checks fires:
“I don’t have reliable information to answer that, so I’d rather not guess. If you have a question about our products or services, I’m happy to help.”
It’s tempting to read that as the assistant failing. We’d argue it’s the assistant doing its most important work. A wrong answer from your website isn’t like a wrong answer from a search engine — it carries your authority. A fabricated returns policy, a made-up product, an invented delivery date: each is a small liability with your name on it. An honest “I’d rather not guess”, followed where appropriate by a handoff to your team, costs you almost nothing — and quietly builds the thing an AI assistant is actually for, which is trust.
The economics only work one way. One invented product page can cost more goodwill than a hundred honest declines.
Guardrails you can audit
One more principle from this release, because it separates real guardrails from marketing: everything the assistant declines is recorded before it’s declined. The withheld answer, the invented links, which check fired and why — all of it lands in your chat logs, scored honestly (an invented answer now scores zero, not 87). Guardrails that operate silently are just another black box. Guardrails you can audit are a system you can supervise.
That cuts both ways, incidentally. The same release changed how moderation events are recorded: a borderline automated flag on a visitor’s message is logged as what the classifier reported, with its confidence score — never as a fact we assert about the person. Guardrails protect your visitors from over-zealous software, too.
What to ask any vendor
If you’re evaluating a public-facing AI assistant for your website, “does it have guardrails?” will always get a yes. Better questions: What happens when the AI invents a link on my own site — is it checked, or trusted? When my documents don’t contain the answer, does it decline, or improvise? And can I see, in my logs, everything it declined to say?
We didn’t have good answers to the first question three weeks ago. We do now, because we watched our own assistant invent two clan crests and decided that should be structurally impossible rather than merely unlikely.
Next in this series: why your AI assistant should tell you when it’s having a bad day — the story of our health dashboard, and a live incident where the diagnosis mattered.
AnswerRails is an AI customer-service assistant for WordPress, built around grounded answers, real citations, and honest handoffs. Follow along as we build it at answerrails.com.