Which output side guardrails belong on a customer facing RAG answer?
Output guardrails run on the generated answer — PII redaction, citation validation, safety checks, and a low-grounding refusal path — because that is the only layer that sees what the model actually emitted.
Think of a newspaper. Before a story prints, an editor reads the final draft, not just the reporter's question list. The editor blacks out a leaked home address, checks that every quote really came from the person named, makes sure nothing breaks the paper's standards, and spikes the story entirely if the sourcing is too thin to trust. Those four checks all happen on the finished article, because that is the only place the editor can see what was actually written. Filtering the reporter's questions ahead of time helps, but it cannot catch a mistake that only appears in the final copy. And you would never let the reporter be their own editor. Output guardrails on a RAG answer work the same way: inspect the finished text, not just the input.
Concept explanation~2 min read
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
Concept explanation~2 min read
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
A customer-facing RAG answer is a liability surface. The model can surface personal data buried in a retrieved chunk, invent a citation that sounds authoritative, phrase something against policy, or answer confidently from thin context. Each of these is a real incident type that teams have shipped to production and regretted.
Guardrails are the engineered defense, and the single most important idea is layer placement. A guardrail can only act on information that exists at the moment it runs. That one principle decides which checks belong before generation and which belong after — and it is exactly what the two distractors in this question violate.
This deep dive establishes the input versus output distinction, walks through each of the four output-side checks and the specific failure it prevents, then explains in detail why input filtering alone and self-policing both fail. The goal is not to memorize a list but to be able to derive which layer any new check belongs on.
The principle: a guardrail sees only what exists when it runs
Every guardrail is a function with a fixed input. An input-side guardrail receives the user's query and whatever context precedes generation. An output-side guardrail receives the generated answer. Neither can act on information it never sees.
This sounds obvious, but it is the entire basis for classifying guardrails correctly. Ask of any proposed check: what does it need to inspect, and does that information exist yet at the stage it runs? A check for leaked personal data needs the generated text, because the leak is something the model wrote — so it must run after generation. A check for a malicious prompt needs the query, so it runs before.
The trap is assuming one layer can cover the other's job. It cannot, because the information is not there. An input filter examining the query has no access to the answer that does not exist yet. An output filter examining the answer has, by then, already let generation happen. The two layers see disjoint information, which is precisely why a serious system runs both. Defense in depth here is not redundancy for safety margin; it is two filters watching two different things.
Situations where this technique stops working.
2–4 min · Everything important, quickly.
Real products, models, and research that use this idea.
- Microsoft Presidio detects and redacts PII in generated text before it is returned to a user.
- NVIDIA NeMo Guardrails lets teams define output rails that run safety and topic checks after generation.
What an interviewer would ask next. Try answering before peeking at the approach.
QHow would you implement citation validation so it catches a fabricated but plausible reference?
Two layers: existence and entailment. First confirm the cited chunk id actually appears in the retrieved set, not invented. Then run a faithfulness check — an entailment model or LLM judge — that the specific claim is supported by that chunk's text. Discuss thresholds, what to do on a near-miss, and the latency cost of a second model call.
Red flags & common mistakes
The phrases that signal junior thinking. Click to expand.
Red flags & common mistakes
The phrases that signal junior thinking. Click to expand.
Treating input-side query filtering as enough on its own. It runs before generation, so it cannot see leaked PII, a fabricated citation, or unsafe phrasing that exists only in the output.
60 second bullets to scan on the way to the call.
Distinguish input-side from output-side guardrails by when they run
Name the four output-side checks and what each one inspects
Primary sources. Browse if you want the original framing.
Same topic, related formats. Practice these next.