Generative Artificial Intelligence has brought major advances to the market, but it has also opened the door to serious risks, such as hallucinations and sensitive data leaks. To control these threats, AI guardrails act as an intelligent interception system, ensuring that models operate within safe limits and avoid critical failures. But how do you apply this in the real world without breaking the customer experience?

To show what actually works in practice, Tech For Humans' R&D team conducted an in-depth technical study on the architecture and optimization of these security layers. After analyzing more than 72,000 interactions, we identified the ideal configuration to shield conversational systems and prevent poorly tuned protections from frustrating end users. The full study is available for download via the button below, and throughout this article we detail its main technical conclusions.

Study Summary

‍

What Are AI Guardrails?

AI guardrails work as an interception and security layer sitting between the user and the Language Model (LLM). Their main function is to filter interactions, blocking malicious inputs before they are processed by the system.

In technical terms, they operate as an intermediary control mechanism. No message reaches the AI's "brain" without first being validated by this filter.

This shield specifically neutralizes threats such as:

• Prompt Injection: Attempts to manipulate the AI with hidden or malicious instructions.
• Jailbreaks: Commands designed to break the model's ethical and safety locks.

Without this containment barrier, deploying LLMs in corporate environments becomes a security and reputational risk that most companies cannot afford to take on.

‍

Why Do Traditional Guardrails Fail?

Implementing AI guardrails isn't as simple as "flipping a switch." Tech For Humans' technical study found that, without precisely correct configuration, security systems suffer from chronic problems that destroy the user experience.

There are three main pain points affecting today's AI products:

1. "Rigidity of Thought" (Overfitting)

Many guardrails suffer from cognitive rigidity. They work on a "copy-paste" basis: if the user's attack is identical to the example the developer put in the manual, it gets blocked. But if the attack is creative or uses a subtle variation in language, the system lets it through. This leaves the door open to real vulnerabilities.

2. Hypersensitivity: The Angry Customer Case

This is customer service's worst nightmare. Poorly calibrated models suffer from hypersensitivity, generating false positives. Imagine a frustrated customer saying: "I'm furious, I want to cancel this now!" A bad guardrail confuses this legitimate emotion with "toxic behavior" or an "attack" and blocks the AI's response. This results in a customer who was already upset becoming even more irritated with the technology.

3. Responsibility Conflict

This occurs when we try to make the AI guardrail act as a business manager. The system oscillates between protecting the infrastructure and blocking questions simply because they're "out of scope." This confusion makes the AI slow and unpredictable.

‍

Tech For Humans Research: The Search for the "Elite Configuration"

To solve these problems, our R&D team didn't rely on guesswork. We conducted a massive systematic ablation study, analyzing more than 72,000 experimental interactions.

We used an exclusive Hybrid Dataset, made up of 62% synthetic attacks (jailbreaks, prompt injection) and 38% sanitized real production logs (real conversations). The goal was to find the architecture that delivers maximum security with minimal disruption to the user.

Below, we simplify the most impactful findings from our study:

1. Model Size Matters (Gemini vs. GPT)

We found that choosing the "brain" that acts as the safety judge is decisive.

• The Champion: Gemini 2.0 Flash was the clear winner. It achieved nearly 98% technical effectiveness (F1-Score of 0.9781) and hit exactly 0.00% formatting (parsing) errors, perfectly balancing security and stability.
• The Danger of Smaller Models: We tried using lighter models (like GPT-4.1 Nano) to save costs, but the result was poor. Small models struggle to interpret context. Since they need to make a binary decision ("pass" or "don't pass"), when in doubt, they choose to block for fear of getting it wrong. This creates a paranoid system that blocks legitimate users without real cause.

2. Context Is King: Why Memory Prevents Errors

The most decisive variable for security was the use of Full History (the complete conversation history).

Many messages can be ambiguous when viewed in isolation. For example, if a customer says "I want to cancel the contract," an AI without context might interpret the word "cancel" as a risky or aggressive action and lock up the conversation.

When the model has access to history, it understands that this is part of a legitimate negotiation. Without this memory, the AI tends to judge based only on keywords rather than actual intent, causing unnecessary blocks.

The real data: Activating history reduced undetected threats (false negatives) by 50% and raised overall system effectiveness by 2.34 percentage points.

3. The Danger of Excessive Reasoning (Chain of Thought)

In the AI world, the Chain of Thought technique (forcing the model to explain its reasoning step by step) is famous for improving logic. However, the study proved that using it in strict guardrails is a mistake.

When forced to "reason out loud," the AI suffers from a "context competition": it focuses so much on creating the narrative explanation that it ends up breaking the mandatory response code format (JSON). This generated a technical system error (parsing) rate of a staggering 8.24%. The study's conclusion is that, for the security layer to perform well, it's much better to be direct and use clear examples (few-shot) than to ask the AI for detailed explanations.

‍

The Big Insight: Everyone in Their Own Lane

Tech For Humans' research revealed a fundamental mindset shift: what we call Identity Isolation. To scale your AI with quality, you need to separate who handles security from who handles customer service.

The market's most common mistake is trying to teach business rules to the security system. Many companies put the "Agent Prompt" (who it is, what it sells) inside the Guardrail. This creates mental confusion in the AI.

In our tests, this mixing caused the system to make mistakes 57.7% of the time when a user asked something off-topic (so-called out-of-scope). The Guardrail confused innocent but irrelevant questions with real attacks and blocked the user unnecessarily.

The "elite" solution we found is to clearly divide responsibilities:

• The Guardrail (The Technical Security Guard): It doesn't need to know whether you sell shoes or insurance. Its function is technical and binary: "Is this an attack or is it safe?" It should be blind to the business and focused only on blocking injections and toxicity.
• The Agent (The Specialist): This is who decides whether the question is useful or not. If a user asks a banking chatbot for a cake recipe, the Agent will politely respond that it doesn't know how to cook. The Guardrail lets the message through, because asking for a recipe isn't a crime or a cyberattack.

This separation "clears" the AI's mind. Without the burden of trying to understand business rules, the security model can dedicate 100% of its attention to what really matters: detecting critical risks.

‍

The Golden Recipe: How to Configure Your Guardrail

Based on the analysis of the elite configurations from our research, we created a practical checklist for you to implement today:

• Use Models with Reasoning Capability: Prefer models like Gemini 2.0 Flash. Very small models can't judge nuance and end up blocking legitimate interactions out of "fear" of getting it wrong.
• Activate Memory (Full History): Never analyze messages in isolation. Context is what differentiates an attack from a valid question about a contract.
• Teach with Examples (Few-Shot): There was a suspicion that giving examples would limit the AI, but the research proved otherwise. Explaining what should be blocked and giving 2-3 clear examples improves the model's reasoning ability, helping it build mental links about what constitutes a threat.
• The Temperature Surprise: Although market recommendation favors low temperatures (to prevent the model from "going off the rails" in its response), our research showed that, statistically, temperature had very little influence on security results. Even so, we still recommend keeping it low (between 0.0 and 0.1) as good practice for consistency.
• Output Format: Prefer JSON Schema to ensure the system understands the verdict without technical errors.
• Remove the Agent Prompt: Keep the Guardrail focused solely on technical security, without knowledge of business rules.

‍

About Tech for Humans

At Tech for Humans (T4H), we design and implement fluid Digital Journeys and AI Agents.

As owners of our own technology, we don't rely on off-the-shelf solutions: we build custom projects to solve your business's specific challenges with the agility the market demands.

Major companies like Porto, Allianz, and MAPFRE have already anticipated this trend with us, replacing their old chatbots with true intelligent copilots capable of understanding, deciding, and executing complex tasks. The practical result is greater customer retention, higher operational efficiency, and a customer service experience elevated to a new level.

‍