An **output guardrail** is a check that runs after the model has produced a response but before that response reaches the user. When the guardrail detects a problem, like a phone number that should not have been emitted, the system has to decide what to do.
Option A drops the whole response. This is the safest reaction, but it is also the most wasteful: the response might have been useful in 99 percent of its content and have one accidental phone number in the middle. The user gets nothing.
Option C passes the response through and flags it for offline review. This is fast but unsafe: the user just received the PII you were supposed to redact. By the time the offline reviewer sees it, the leak has already happened.
Option D retries the model call. This wastes time and money, and there is no guarantee the model will not emit the same number again. It also does not address why the number appeared.
Option B is the right answer: **span-level redaction**. The guardrail identifies exactly which characters constitute the phone number, replaces those characters with `[REDACTED]`, and forwards the rest of the response unchanged. The original value is kept in an access-controlled log so the security team can investigate why the model produced it.
**Span-level redaction is the right tool because it neutralises the leak without throwing away the rest of the response.**
A modern output rail does two things in sequence. First, it locates the offending characters precisely, start offset, end offset, and the matched span. Second, it rewrites the response by replacing the span with a redaction marker like `[REDACTED]` or `[PHONE]` and forwarding the surrounding context.
Why the other options are worse:
- **Dropping the whole response** sacrifices significant UX value for a marginal safety gain. If the response was 400 words of useful answer and 11 characters of accidental PII, redaction preserves 397 words; full-drop gives the user nothing and an opaque error.
- **Passing through with offline review** lets the leak land. Offline review is a forensics tool, not a guardrail; by the time it fires, the harm is done.
- **Retrying the model call** burns cost and latency without addressing why the PII appeared. If the prompt context or system prompt is the root cause, the second call will produce the same leak. If the cause is genuinely random sampling, retry might work, but retry alone is not a guardrail.
The original unredacted value should still be retained in an access-controlled audit log. Security needs the unredacted value to trace the root path: was the phone number in the system prompt, in retrieval context, in the user input, or hallucinated by the model? Each root cause has a different fix.
Production implementations: Microsoft Presidio is the canonical open-source library for entity detection and span redaction; Bedrock Guardrails and Azure AI Content Safety both ship native PII redaction modes that operate at the span level by default.
Quick reference
TL;DR
Redact the offending span in place and forward the rest; dropping the whole response wastes work, passing through risks regulatory exposure, and retrying burns cost without fixing the root cause.
Imagine a letter that turns out to have one sensitive sentence in the middle. You could shred the entire letter, but then the recipient loses the helpful parts that were fine. You could mail it anyway, but you might get sued. The sensible move is to take a marker, black out the one sensitive sentence, and send the rest. That is span-level redaction. The recipient still gets value from most of the letter, the sensitive bit never reaches them, and you keep an unredacted copy in a locked drawer for the security team to investigate why it appeared in the first place.
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example.
The leaked entity dominates the response and redaction leaves only fragments Forwarding a response that is 90 percent redaction markers makes the leak obvious by negative space; drop the response and return a graceful error instead.
Regulatory regime that forbids any disclosure even of the existence of the redacted item Some intelligence and healthcare contexts require that the response either be fully compliant or fail entirely; redaction markers reveal that sensitive content existed, which itself can be a violation.
Tightly structured output that downstream code parses by position Inserting [REDACTED] breaks position-dependent parsers; if the schema cannot tolerate redaction markers, either drop the response or restructure the contract.
Streaming responses where the redacted span has already partially shipped By the time the detector fires, characters may have already streamed to the client; partial leakage may already have occurred, requiring a separate streaming-safe detection pattern.
Quick scan · 2–4 min
Everything important, quickly.
5 min: the four reaction options, why span-level redaction wins on UX-safety trade-off, marker style choice, access-controlled audit logging, production implementations (Bedrock, Azure, Presidio), edge cases (streaming, multilingual).
Real-world examples
Real products, models, and research that use this idea.
1AWS Bedrock Guardrails ships native PII redaction modes with both opaque ([REDACTED]) and type-tagged ([PHONE]) output formats, configurable per policy.
2Microsoft Presidio is the open-source canonical PII redaction library, widely used as a rail in NeMo Guardrails deployments on top of Llama 4 and Claude Opus 4.7.
3Azure AI Content Safety includes a Detect API that returns span offsets and entity types for PII categories, used by Azure OpenAI customers shipping GPT-5.5.
4Healthcare deployments on Hippocratic AI and Abridge layer Presidio plus custom medical record number detectors to redact identifiers from model output before the response reaches the clinician UI.
Interviewer follow-ups
What an interviewer would ask next. Try answering before peeking at the approach.
QHow would you architect PII redaction in a streaming response so detection fires before characters reach the client?
Sign in or go Pro to see the approach for this follow-up.
QWhat happens to the false-positive rate when you stack multiple PII detectors (regex plus Presidio plus a model-based detector)?
Sign in or go Pro to see the approach for this follow-up.
QHow do you decide between opaque [REDACTED] and type-tagged [PHONE] markers in a multilingual application?
Sign in or go Pro to see the approach for this follow-up.
Don't say this
Red flags and common mistakes that signal junior thinking. Click to expand.
Most common mistake
Dropping the entire response on every PII hit; the model may have produced a useful answer with one accidental span, and full-drop is a UX hammer where redaction is the scalpel.