Guardrails and the AI Firewall: Keeping Agents Inside the Lines
The problem with polite instructions
Most early agent deployments rely on the system prompt for safety: "never share customer data", "always ask before deleting". This works until it doesn't. A cleverly worded document in the agent's context, a user who knows how to phrase a request, or simply an unusual edge case can push the model past its instructions. A prompt is a suggestion to a probabilistic system, not an enforced rule.
Enterprise software has never accepted this standard for anything else. Databases have permissions. Networks have firewalls. Agents need the equivalent, implemented outside the model where the model cannot talk its way around it.
Guardrails: policy at the point of action
Guardrails in Evolvable are rules evaluated by the platform, not by the model, every time an agent tries to do something. They cover what the agent may read (which knowledge sources, which records), what it may do (which tools, with which parameters, up to which limits), what it may say (topics, tone, forbidden content) and when it must stop and ask.
Because the rules live in the control plane, they apply uniformly across every agent and every model. Changing a threshold or blocking a tool is a configuration change, not a retraining exercise, and it takes effect immediately.
The AI firewall: inspecting the traffic
Guardrails govern the agent's own behaviour. The AI firewall governs what comes in and goes out. On the way in, it screens prompts, uploaded files and retrieved documents for prompt injection, jailbreak patterns and attempts to extract system instructions. On the way out, it screens responses and tool calls for personal data, secrets, and content that violates policy, and it can redact, block or escalate before anything leaves the platform.
The firewall is model-agnostic by design. It sits between the world and every model in the stack, so a switch from one model to another does not change the security posture.
Why both layers, not one
Guardrails without a firewall leave you exposed to manipulation from outside: the agent follows its rules perfectly on a request that was engineered to be harmful. A firewall without guardrails catches bad traffic but does nothing to stop an agent making a legitimate-looking call that happens to exceed its authority. The two together cover both the intent of the request and the consequence of the action.
This is the same defence-in-depth logic that security teams already apply to applications, which is exactly the point: it makes AI governable using concepts the organisation already understands.
Making it auditable
A control that cannot be shown to a regulator is only half a control. Every guardrail decision and every firewall verdict on Evolvable is logged with the input, the rule that fired and the outcome, feeding the same immutable audit trail as the rest of the platform. When the question "why did the agent refuse?" or "why was this allowed?" arrives, the answer is a query, not an investigation.
The takeaway
Safety in agentic systems is an engineering property, not a prompting technique. Put the rules where the model cannot reach them, inspect everything that crosses the boundary, and record every decision. Do that and "can we trust the agent?" becomes a question you can answer with evidence.
