Distinguish training time alignment from runtime guardrails
Alignment reduces the base rate of unsafe outputs; runtime guardrails encode per-deployment policy and bound blast radius when alignment fails.
Imagine you hire a polite, well-trained receptionist. She has been coached not to be rude and not to share office gossip. That coaching is alignment. But your specific clinic has rules she was never taught: do not discuss patient names, do not book the CEO's calendar, do not give medical advice. So you put a checklist on her desk and a supervisor in the back room who reviews anything sensitive before it leaves. The checklist and supervisor are guardrails. The coaching makes everyday work smoother; the checklist catches the rare moment when a clever visitor tries to talk the receptionist into doing something her training never warned her about.
Concept explanation~2 min read
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
Concept explanation~2 min read
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
When a team first ships an LLM product, a natural question is whether the base model's safety training is enough. The model has been through RLHF, maybe Constitutional AI, and refuses the obvious harmful requests in casual testing. Why bolt on more layers?
The short answer is that alignment and runtime guardrails solve different problems. Alignment shapes the model's behaviour on inputs that look like its training distribution. Guardrails enforce per-deployment policy and produce the audit trail regulators read. The two layers compose; neither substitutes for the other.
This deep dive walks through the three structural reasons alignment alone is insufficient, what a layered safety stack actually looks like at serving time, and how recent alignment research (sleeper agents, alignment faking) reinforces the case for external boundaries.
What alignment buys you (and what it does not)
Alignment is a training-time intervention. RLHF takes a base model, collects human preference data on output pairs, and fine-tunes the policy so that preferred outputs are more likely. Constitutional AI replaces some of that human labelling with model-based critique against a written constitution. DPO and related methods optimize the same preference signal more efficiently.
The result is a model whose first-token distribution puts more mass on helpful, honest, harmless outputs across the distribution of inputs the labellers saw. That is a real win,base models without alignment will cheerfully produce instructions for self-harm, slurs, and confidently wrong medical claims at uncomfortable rates.
What it does not buy you
Alignment is a prior, not a guarantee. It reduces the probability of bad outputs on typical inputs. It does not bound the worst case, it does not encode policy specific to your deployment, and it does not produce a logged decision per request. Each of those is a separate piece of infrastructure, and each is what guardrails provide.
Situations where this technique stops working.
2–4 min · Everything important, quickly.
Real products, models, and research that use this idea.
- Anthropic ships Claude Opus 4.7 with Constitutional AI alignment plus an external classifier filter,both layers run on every request
- AWS Bedrock Guardrails sits in front of any Bedrock-hosted model (Claude, Llama 4 Maverick, Mistral) and enforces tenant-specific content, denied-topics, and PII filters that the model itself cannot encode
What an interviewer would ask next. Try answering before peeking at the approach.
QIf alignment improves enough, will runtime guardrails become unnecessary?
Argue that alignment cannot encode per-deployment policy or produce a per-request audit artifact, regardless of capability. Cite EU AI Act and SR 11-7 as governance reasons the boundary must live outside the weights.
Red flags & common mistakes
The phrases that signal junior thinking. Click to expand.
Red flags & common mistakes
The phrases that signal junior thinking. Click to expand.
Treating RLHF as a sufficient safety layer and shipping with no runtime input or output rails, then being surprised when injected retrieval content drives policy violations.
60 second bullets to scan on the way to the call.
Where alignment lives in the stack and where guardrails live
Why alignment alone fails on adversarial input distributions
Primary sources. Browse if you want the original framing.
Same topic, related formats. Practice these next.