7.2 — Guardrails and Safe Deployment

CCDV-F Domain 7 · Task 7.2

What You Need to Know

A guardrail is a check with an enforcement point. A behaviour shaper is different: the model reads something and decides. Ask three questions: What does it inspect? Where does the code run? What happens when it fires?

The Four Layers

Layer	What it can catch
Input checks	Classification, pattern filtering, redaction, shape validation — cheap, probabilistic, channel-specific
System prompt / model training	Shape behaviour; enforce nothing
Tool-level controls	Which tools exist, credential scope, approval requirements, deterministic pre-execution blocks — where enforcement lives
Output checks	Validate shape, classify against policy, redact, and block the resulting action

Content Policy Is an Engineering Obligation

Anthropic’s Usage Policy has three parts: Universal Usage Standards, High-risk Use Case Requirements, Additional Use Case Guidelines.

High-risk Areas (eleven): legal, medical, finance, credit, insurance, housing, employment, education and credentials, healthcare access, public benefits and services, legal status and adjudication.

Two controls on every High-risk AI Recommendation:

1. Qualified human-in-the-loop — meaningful review before delivery/decision; authority to change it
2. Disclosure — the person receiving advice or subject of the decision is clearly told AI was used

Consumer-facing chatbots/agents must disclose that users are interacting with AI (at beginning of each chat session or in the product interface).

Secure by Design

• Least privilege — smallest tool set and narrowest credential scope; remove rather than deny
• Privacy — minimisation applied to the context window; data the task does not need never enters
• Identity and access management — every tool call resolves to an identity with checkable entitlements

Fail Closed on the Security Path

When the classifier times out, validation is inconclusive, or the approval service does not answer: refuse the consequential action and hold it. Do not proceed unguarded. Separate the consequential action from the whole feature; held work has a queue and a notification.

Rollout and Observation

Stage the exposure. Monitor security-relevant events. Red-team with documents and tool outputs that deliberately contain injection attempts. A guardrail you cannot see firing is a guardrail you cannot maintain.