A guardrail that has never been measured is a guardrail whose owner is guessing. Teams ship a prompt-injection classifier, watch a handful of manual test prompts get blocked, and call it done — but without a held-out labelled set and real precision and recall numbers, nobody can say whether the classifier catches 95% of real attacks or 40%, or whether it is quietly blocking one in twenty legitimate requests along the way. A security control that cannot report its own catch rate and its own false-positive rate is not a measured control, it is a hope.
This is an exercise lesson: every code block below is something you build and run, not something to read past. The problem this lesson solves is turning 'the guardrail seems to work' into a number: precision, recall, false-positive rate, and a confusion matrix computed against a labelled evaluation set, plus a latency-vs-catch-rate curve that tells you what a stricter threshold actually costs in blocked legitimate traffic.
By the end you will have a small but real guardrail evaluation harness: a labelled set of attack and benign requests, a scorer that computes the standard classification metrics, and a threshold sweep that shows the trade-off a security engineer actually has to make when tuning a guardrail — catch more attacks or annoy fewer real users, because past a certain point you cannot have more of both from the same classifier.
Analogy🏏Cricket
🏏 Think of it like cricket: a bowling action review by the ICC does not conclude with a coach's gut feeling that a delivery 'looked a bit off.' When Sunil Narine's action was reported during his IPL career, the board sent him to a biomechanics lab, strapped sensors to his arm, and measured the actual elbow extension in degrees against the 15-degree legal limit — a hard number, not an impression. The lab did not report 'mostly fine' either; it produced a distribution across many deliveries, because a single measured ball proves nothing about the action under fatigue and different delivery types. That same discipline applies to a bowling coach reviewing a young pacer's yorker success rate at the death: not 'he seems to nail the yorker,' but a measured hit rate across fifty net attempts, split by whether the batsman was set or new to the crease. Just as the ICC's biomechanics lab replaced a visual impression of Narine's action with a measured degree of elbow extension, a guardrail's effectiveness has to be replaced with measured precision and recall against a labelled set, not a developer's sense that it 'catches the bad ones.' Just as the lab reports a distribution across many deliveries rather than one, a guardrail's metrics have to be computed across a real evaluation set, not a handful of prompts someone tried once. The insight is that a control nobody has measured is a control nobody actually understands, however confident it looks in a demo.
🏏 Showing the Cricket analogy — a Cricket version isn’t available for this concept yet.