Decide between synchronous blocking and asynchronous logging for a new guardrail

A guardrail is a check that runs on what the model sees or says. **Synchronous** means it runs while the user is waiting, and if it fires the request is blocked or rewritten before the response goes out. **Asynchronous** means the response goes out normally and the check runs in the background, writing to logs you read later. The simple rule: only block synchronously when the cost of letting the bad output through is large and hard to undo. Leaked credit card numbers, defamation, illegal content, or regulated advice in a healthcare or finance route all qualify. The check has to be there before the response reaches the user, because once it has reached the user, the harm is done. For every other case, start the new check in asynchronous mode. The check runs and writes its decision to a log, but does not affect the live response. You watch real traffic for a week or two, see how often the check fires on legitimate prompts (false positives) and how often it misses real harm (false negatives), and only then promote it to the hot path.

**The harm class decides the mode.** Synchronous blocking is reserved for irreversible or regulated harms,PII leaks, defamation, illegal content, financial or medical advice in a regulated route. Everything else starts in shadow mode: the check runs, writes its verdict to logs and dashboards, but does not affect the user-visible response. The reason is that a fresh classifier always has an unknown false-positive rate on your specific traffic mix. Promoting it straight to the hot path means every false positive becomes a refused request, and a 2% FPR on a high-QPS route is enough to swamp your support inbox the same week. The shadow stage earns you three things: measured FPR and FNR on real distribution, labelled examples for fine-tuning the classifier, and a baseline dashboard you can defend at the design review. Once shadow data is clean,typically FPR under 0.5 percent and FNR within policy tolerance,you promote in stages: warn-only, then block on the highest-confidence band, then full block. **The trade-off:** every day in shadow is a day the harm is unmitigated, which is exactly why irreversible harms skip the shadow stage and accept the FPR pain.