When should I use deterministic guardrails instead of model-based guardrails for an AI agent?

Deterministic guardrails should be used when a rule can be precisely defined in code, policy, or a tool schema, especially for critical security functions or when clear, auditable criteria exist. Model-based guardrails are more suitable for subjective evaluations or when iterative refinement provides measurable value, but they require careful design to ensure reliability and bias control.

• Prioritize deterministic controls for critical security functions: For actions like shell command safety (e.g., preventing filesystem destruction, SQL drops, or shell injection), a lightweight, self-contained approval system with no external classifier dependency is recommended. This aligns with the NIST AI RMF function of Govern by establishing clear policies for acceptable actions.
• Use deterministic checks for clear, auditable criteria: If a unit test, schema validator, linter, or type checker can definitively decide a question, use that tool and feed its result to the agent. This provides a clear, auditable record and helps prevent issues like LLM08: Supply Chain Vulnerabilities by ensuring the integrity of tool outputs.
• Apply deterministic configuration for repeatable mistakes: If an agent consistently makes the same errors, such as using incorrect CLI flags or misunderstanding a repository layout, these issues should be addressed with deterministic configurations rather than relying on model-based "dreaming" to learn from mistakes. This is a proactive measure under the NIST AI RMF function of Map to identify and address vulnerabilities.
• Implement pre-execution enforcement for tool calls: A secure harness should intercept every tool call and evaluate it against policy *before* execution, rather than relying on post-hoc observability. This is a critical control for LLM07: Insecure Plugin Design and LLM01: Prompt Injection, ensuring that unauthorized actions are prevented at the source.
• Utilize permission systems for fine-grained control: Implement permission systems that determine whether a tool call should be allowed based on factors like the user, agent mode, and tool function. This provides a safety layer between model intent and real-world action, addressing the NIST AI RMF function of Measure by controlling agent behavior.
• Combine model-based evaluations with programmatic checks and human approval: While model-based evaluations can scale assessment, they should be paired with programmatic checks and human approval for high-stakes decisions where authority matters. This hybrid approach helps mitigate risks associated with LLM05: Model Denial of Service by ensuring robust decision-making.