Building a Guardrail Pipeline — AI Guardrails & Safety Engineering

Five lessons back, an input-validation layer learned to reject a hostile prompt before it ever reached a model. Four lessons back, an output-validation layer learned to catch a hallucinated order ID a schema check alone could never see. Two lessons ago, a classifier learned to recognize the pattern of an attack no rule was ever told to look for, and the lesson right before this one established the ordering discipline that lets a rule and a classifier and a structural check cover each other's blind spots instead of quietly duplicating one another. Every one of those pieces has been built, tested, and validated in isolation — and an isolated, individually-correct component is not the same claim as a pipeline that actually holds together when real, messy traffic hits all of them in sequence.

This project composes those five lessons into a single working artifact: one guardrail pipeline, protecting one realistic agent, wired input-side and output-side, ordered cheap-to-expensive, fail-closed at every seam, with per-layer telemetry a security reviewer could actually read. Nothing here introduces a new guardrail technique — the entire point is proving that input validation, output validation, rule checks, and classifier checks compose into one coherent system rather than five independent lessons that happen to share a course, which is exactly the gap between "I understand each layer" and "I can ship a pipeline."

The agent under protection is a fantasy-cricket auction assistant: it fields natural-language requests from league managers ("bid 12 credits on Bumrah," "finalize my squad and send the confirmation email"), decides on tool calls, and executes them against a live auction system where a wrong bid or a hallucinated payout is real money moving in a live league. That stakes profile — genuine tool access, genuine irreversible actions, genuine exposure to both direct and indirect injection through league chat messages the agent reads — is precisely the setting layered defense earns its complexity in, and precisely the setting a single-layer guardrail quietly fails in.

Analogy🏏Cricket

🏏 Think of it like cricket: a franchise does not win an IPL title by fielding five brilliant individual net sessions — a batting coach who has drilled technique against pace, a fielding coach who has sharpened reflexes at slip, a fitness trainer who has built stamina, a strategist who has mapped opposition tendencies, and a captain who has rehearsed field placements all produce five genuinely excellent, individually validated pieces of preparation. None of that preparation has been tested together until the team actually takes the field against a real opponent in a real match, under real pressure, where the batting technique has to hold up while the fielding has to back it up while the bowling plan has to execute under a scoreboard pressure no net session ever fully replicates. A team that has only ever tested its five disciplines in isolation, never in the combined chaos of an actual match, discovers the gaps between them exactly when it is most expensive to discover them — a batting plan that assumed perfect fielding support, a bowling plan that assumed a batting cushion that never arrived. This project is that first real match: every guardrail layer built across the last five lessons has been validated in its own net session, and the only way to know whether they actually hold up together is to run them, in sequence, against traffic designed to test the seams between them, not just the strength of any one layer alone. The insight is that a system, like a team: it is not proven by its parts being individually excellent, it is proven by how those parts perform together under conditions none of them was tested against alone.