Distinguish training time alignment from runtime guardrails
Alignment reduces the base rate of unsafe outputs. Runtime guardrails encode per-deployment policy and bound blast radius when alignment fails.
Imagine you hire a polite, well-trained receptionist. She has been coached not to be rude and not to share office gossip. That coaching is alignment. But your specific clinic has rules she was never taught: do not discuss patient names, do not book the CEO's calendar, do not give medical advice. So you put a checklist on her desk and a supervisor in the back room who reviews anything sensitive before it leaves. The checklist and supervisor are guardrails. The coaching makes everyday work smoother. The checklist catches the rare moment when a clever visitor tries to talk the receptionist into something her training never warned her about.
Concept explanation~2 min read
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
Concept explanation~2 min read
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
When a team first ships an LLM product, a natural question is whether the base model's safety training is enough. The model has been through RLHF, maybe Constitutional AI, and refuses the obvious harmful requests in casual testing. Why add more layers?
Alignment and runtime guardrails solve different problems. Alignment shapes the model's behaviour on inputs that look like its training distribution. Guardrails enforce per-deployment policy and produce the audit trail regulators read. The two layers compose. Neither substitutes for the other.
Three structural reasons make alignment alone insufficient. A layered safety stack at serving time covers them. Alignment research on sleeper agents and alignment faking strengthens the case for external boundaries.
What alignment buys you (and what it does not)
Alignment is a training-time intervention. RLHF takes a base model, collects human preference data on output pairs, and fine-tunes the policy so that preferred outputs are more likely. Constitutional AI replaces some of that human labelling with model-based critique against a written constitution. DPO and related methods optimize the same preference signal more efficiently.
The result is a model whose output distribution puts more mass on helpful, honest, harmless outputs across the distribution of inputs the labellers saw. That is a real win. Base models without alignment will readily produce instructions for self-harm, slurs, and confidently wrong medical claims at uncomfortable rates.
What it does not buy you
Alignment is a prior, not a guarantee. It reduces the probability of bad outputs on typical inputs. It does not bound the worst case, it does not encode policy specific to your deployment, and it does not produce a logged decision per request. Each of those is a separate piece of infrastructure, and each is what guardrails provide.
Situations where this technique stops working.
2–4 min · Everything important, quickly.
Real products, models, and research that use this idea.
- Anthropic pairs Claude's safety training with Constitutional Classifiers. Since May 2025 (ASL-3 protections for Claude Opus 4), these classifiers monitor inputs and outputs and block a narrow class of harmful CBRN information
- AWS Bedrock Guardrails sits in front of any Bedrock-hosted model (Claude, Llama 4 Maverick, Mistral). It enforces tenant-specific content, denied-topics, and PII filters that the model itself cannot encode
What an interviewer would ask next. Try answering before peeking at the approach.
QIf alignment improves enough, will runtime guardrails become unnecessary?
Argue that alignment cannot encode per-deployment policy or produce a per-request audit artifact, regardless of capability. Cite the EU AI Act's logging and human-oversight duties (Articles 12 and 14) and bank model-risk practice as governance reasons the boundary must live outside the weights.
Red flags & common mistakes
The phrases that signal junior thinking. Click to expand.
Red flags & common mistakes
The phrases that signal junior thinking. Click to expand.
Treating RLHF as a sufficient safety layer and shipping with no runtime input or output rails. Injected retrieval content then drives policy violations.
60 second bullets to scan on the way to the call.
Where alignment lives in the stack and where guardrails live
Why alignment alone fails on adversarial input distributions
Primary sources. Browse if you want the original framing.
Same topic, related formats. Practice these next.