Solution

Ship agents that pass audit.Defence-in-depth guardrails for regulated AI workflows.

Guardrails are the difference between a demo and a deployment in a regulated environment. We design and implement layered controls — input filters, policy registries, output validators, human-in-the-loop confirmation, and audit-grade decision logs — so your agents pass compliance review the first time.

4 layers
of defence — input, policy, output, human gate
100%
of agent decisions traceable to a cited policy clause
0
audit findings across 4 quarterly reviews on a recent deployment
< 6 hrs
customer activation time (was 36+ hrs) on guardrail-protected workflow
Use cases

Where guardrails are non-negotiable

Compliance document review

Vendor due-diligence, customer onboarding (KYC / KYB), regulatory filings. Every decision must cite the policy clause it relies on. Human review above a defined risk threshold.

Financial workflows

Loan eligibility, claims triage, transaction review. Layered checks: PII redaction, policy-grounded reasoning, output validation, approval queue above defined exposure.

Healthcare operations

Patient intake summarisation, insurance pre-authorisation drafting. Strict PHI handling, citation-grounded output, human sign-off before any patient-facing communication.

Legal document analysis

Contract red-flag review, clause comparison, term extraction. Disclaimers baked into outputs. Citations required for any conclusion that affects negotiation.

Customer communication automation

Draft → review → send agents where the brand voice and regulatory copy requirements (financial promotions, healthcare claims) must be enforced before any message goes out.

Code-changing agents

Guardrails on autonomous PR creators: scope limits, file allowlists, write-only-to-branch enforcement, mandatory test generation, mandatory human approval for merge.

Industries served
Financial ServicesHealthcare OperationsLegal TechInsuranceRegulated SaaSPublic Sector
Technology

Guardrail technology stack

Input layerPII / PHI detection · prompt-injection filters · jailbreak heuristicsPolicy layerVersioned policy registry · clause citation requirement · region routingReasoning modelClaude Opus / Sonnet · scoped tool registry · audit context in promptOutput layerPydantic v2 validators · regex + schema checks · LLM-as-judge cross-checkHuman gateRisk-scored escalation · approval queue · sign-off audit trailAudit logImmutable decision trace · replayable · policy clauses cited
Defence in depth

Multi-layer controls protecting every decision

Defence-in-depth — what blocks what
Agent
  1. L1
    Audit log
    Immutable trace of every decision; replayable; cites policy clauses.
  2. L2
    Human gate
    Risk-scored escalation above threshold; approval queue with sign-off.
  3. L3
    Output validators
    Pydantic + regex + LLM-judge cross-check before any external action.
  4. L4
    Policy registry
    Versioned policy clauses; agent must cite a clause for any conclusion.
  5. L5
    Input filter
    PII / PHI redaction, prompt-injection blocking, jailbreak heuristics.
Methodology

Implementation methodology

01

Threat model

Enumerate failure modes: PII leakage, prompt injection, policy mis-citation, output-schema bypass, hallucinated authority, risk-band escape. Map each to the layer that catches it.

02

Policy registry

Externalise every policy your agent must follow as versioned, citable clauses. Agents output a clause ID alongside every conclusion. Drift between versions is detectable and auditable.

03

Layered implementation

Build the input filter, policy-grounded prompt, output validator, and human-gate escalation in sequence. Each layer is tested adversarially before the next is wired in.

04

Adversarial eval set

Build the eval suite with the failure modes from the threat model: jailbreak attempts, PII smuggling, policy-conflicted inputs, ambiguous risk-band cases. Score every layer.

05

Audit sign-off

Walk-through with your compliance / risk team. Produce the audit pack: threat model, policy registry, eval results, decision trace samples. Sign-off before go-live.

06

Quarterly revalidation

Models change. Policies change. Adversaries adapt. Each quarter, re-run the adversarial eval suite, re-validate the policy registry, and publish the delta.

Security & scalability

Security & scale primitives

PII / PHI minimisation

Input filters redact sensitive identifiers before they reach the reasoning model whenever the workflow allows it. Where they must reach the model, prompts include explicit handling rules and outputs are scrubbed.

Prompt-injection resistance

Inputs that contain instructions are detected and stripped or quarantined. Tools never act on instructions embedded in user-provided content.

Versioned policy registry

Policies live as code, in version control, with clause-level IDs. Agents cite clauses by ID. Reviewers can diff policy versions and re-run historic decisions against the new registry.

Output validation

Every output is validated against a Pydantic schema. High-stakes outputs get a second LLM-judge cross-check. Failures route to escalation, not silent fallback.

Human-in-the-loop gating

Risk score thresholds defined per workflow. Above-threshold decisions queue for human sign-off with the full context, the cited clauses, and the agent's confidence. Below-threshold are still logged.

Immutable audit trail

Append-only decision log with the inputs, the policies cited, the validators passed, the human approver (if any), the model version, and the cost. Replayable end-to-end.

Integrations

Integration points

  • Identity providers: Okta · Azure AD · Auth0 · Google Workspace
  • Policy management: in-repo (preferred) · GRC tools · custom registries
  • PII / PHI detection: presidio · custom regex packs · cloud DLP APIs
  • Audit + SIEM: Splunk · Datadog · Elastic SIEM · custom S3 sinks
  • Approval queues: Slack · Microsoft Teams · custom dashboards
  • Encryption at rest + in transit: KMS-backed · TLS 1.3 · field-level for PHI
Business impact

Business impact in regulated environments

Guardrails are not overhead — they are what makes the workflow shippable in the first place. The honest comparison is not "guarded agent vs. unguarded agent"; it is "guarded agent vs. manual review forever".

3.2×
documents reviewed per FTE per day
0
audit findings on AI-assisted decisions over 12 months
< 6 hrs
customer activation time (was 36+ hrs)
100%
decisions traceable to a cited policy clause
Case studies

How recent engagements actually shipped

Financial Services / Compliance · 10 weeks discovery → audit sign-off

Audit-grade compliance review ships under multi-layer guardrails

Regulated financial-services intermediary · India · 95 employees

Problem

Manual compliance review of vendor and onboarding documents was the bottleneck for new-customer activation. Every traffic spike threatened SLA breach. Reviewer fatigue led to inconsistent flagging — some weeks too strict, some weeks too loose, with no defensible pattern.

Solution

A single-agent system wrapped in four guardrail layers: an input filter that detects and redacts PII / strips prompt-injection patterns; a versioned policy registry the agent must cite by clause ID for every conclusion; output validators (schema + LLM-as-judge cross-check); and a human-in-the-loop gate on anything scored above a defined risk threshold. Every decision is appended to an immutable audit log.

Custom detectorsClaude Opus 4.7 (final ruling)Versioned in repoPydantic v2
0
audit findings across 4 quarterly reviews
3.2×
throughput per reviewer
< 6 hrs
customer activation time
10 wks
engagement, discovery to audit sign-off
Read the full case study
Deep dives

Read what we publish on this

Tool Design

Tool descriptions are prompts. Fix the registry, not the agent.

When an agent picks the wrong tool, the registry is broken — not the agent. Three rules I now apply before debugging anything in a multi-tool system: precise names, "when to use" triggers, and a curated load list. Anthropic's new tool-selection telemetry finally puts numbers on what changes accuracy.

Read the post Production

The cheapest LLM call is the one you do not make — GitHub's 19-62% token cut, decoded

GitHub published an instrumented analysis of their agentic CI workflows and reported 19-62% token-cost reductions. The savings are the headline. The technique — pre-agentic data fetching and tool-registry hygiene — is the story most teams will miss.

Read the post Architecture

Claude Opus 4.7's 1M context: when to RAG and when to just stuff it

A million tokens reliably is real now, but it does not retire RAG — it changes the calculus. Cost, latency, recency, and the prompt-cache angle nobody is talking about.

Read the post MCP

MCP 1.0 is here. What changes for the servers you already wrote

The protocol stabilised. Most working servers will keep working. Three places the new spec actually requires changes — auth profile, server registry, streaming-response semantics — with diffs from a real migration.

Read the post
Frequently asked

AI Guardrails — questions buyers ask

Map your guardrail requirements

Most regulated AI projects fail at audit, not at build. We spend a session walking through the threat model, policy registry, and approval workflow your auditors will ask for — and propose the layered architecture that ships.

Adjacent

Topics & solutions worth reading next

Topic Pillar

Agentic AI

Designing, building, and shipping production agents.

Topic Pillar

AI Observability

Tracing, eval, and telemetry for production agents.

Topic Pillar

AI Engineering

The discipline of shipping AI systems, not demos.

Topic Pillar

Enterprise AI Automation

Operational agents for IT services and enterprise teams.

Solution

Agentic AI Consulting

Designed, built, and handed off — production agentic systems for enterprise teams.

Solution

Enterprise AI Architecture

Reference architectures for organisations standing up an AI platform — not one agent, but the foundation for many.

Solution

AI Observability

Tracing, eval, cache-hit telemetry, and cost attribution for production agents.

Solution

AI Automation for Enterprises

Operational agents that replace manual workflows — triage, support, ERP integration, content pipelines.