agent 的护栏Guardrails for agents

护栏就是给 agent 的输入输出加检查，不合格就当场拦下。 它和评测是两回事：评测测「好不好」，护栏管「行不行」。 模型会犯错、会被诱导，护栏是工程上的最后一道闸。

Guardrails mean putting checks on an agent's inputs and outputs, intercepting failures on the spot. They are a different thing from evaluation: evaluation measures "how good", guardrails police "is this allowed at all". Models err and can be manipulated; guardrails are engineering's last gate.

OpenAI Agents SDK 官方文档把 guardrails 定义为 "Guardrails enable you to do checks and validations of user input and agent output." 在实践中分成三类，各自守在不同位置。

输入护栏：检查用户原始输入，只对链路里的第一个 agent 生效。 输出护栏：检查 agent 的最终输出，只对最后一个 agent 生效。 工具护栏：包住具体函数工具，每次调用前后都过一遍。

官方特意点出一个常见误区： 如果流程里有 manager、handoff 或委派的专家 agent， 指望 agent 级输入/输出护栏在每一跳都生效是会落空的—— 要那种「每次工具调用前都查」的效果，就得用工具护栏。

The OpenAI Agents SDK official docs define guardrails as "Guardrails enable you to do checks and validations of user input and agent output." In practice they split into three kinds, each standing at a different position.

Input guardrails: check the user's raw input, effective only on the first agent in the chain. Output guardrails: check the agent's final output, effective only on the last agent. Tool guardrails: wrap a specific function tool, checked before and after every call.

The official docs deliberately call out a common misconception: if the flow has a manager, handoffs, or delegated specialist agents, expecting agent-level input/output guardrails to fire at every hop is a disappointment — for a "check before every tool call" effect, you need tool guardrails.

护栏的核心机制是 tripwire（触发线）。 检查不通过时，runner 立刻抛出对应异常并中止执行：

异常里带着上下文：是哪个护栏触发的、触发前已完成的结果列表。 接入方 catch 到异常后自行决定怎么回应用户。

护栏也能直接调外部分类器，不必再起一个 agent。 官方给的示例场景很有代表性： 面向客服的贵模型前面挂一个快模型护栏， 遇到「帮我写数学作业」这类滥用直接挡掉。

The core mechanism of guardrails is the tripwire. When a check fails, the runner immediately raises the corresponding exception and halts execution:

The exception carries context: which guardrail tripped, and the list of results completed before the trip. The integrating side catches the exception and decides how to respond to the user.

A guardrail can also call an external classifier directly, without spinning up another agent. The official example scenario is representative: in front of an expensive customer-service model, hang a fast-model guardrail that blocks abuse like "write my math homework" outright.

输入护栏有两种跑法，官方文档写明了代价差异。

并行执行（默认）：护栏与 agent 同时跑，延迟最低。 但触发时 agent 可能已经烧过 token、执行过工具。

阻塞执行：护栏先跑完，agent 后启动。 触发即止，token 与工具副作用都不会发生。 OpenAI 官方原文：阻塞执行 "is ideal for cost optimization and when you want to avoid potential side effects from tool calls"。

注意输出护栏不支持并行参数——它永远在 agent 完成后跑。

Input guardrails have two run modes, and the official docs spell out the cost difference.

Parallel execution (default): the guardrail and the agent run together, lowest latency. But when it trips, the agent may already have burned tokens and executed tools.

Blocking execution: the guardrail finishes first, the agent starts after. Trip and halt — no tokens spent, no tool side effects. OpenAI official text: blocking execution "is ideal for cost optimization and when you want to avoid potential side effects from tool calls".

Note output guardrails do not support the parallel flag — they always run after the agent completes.

文档层面是函数加判定输出；模型层面可以是用 LLM 当分类器。 Llama Guard 论文（arXiv 2312.06674）是这条路线的代表： 一个指令微调的安全分类模型，自带安全风险分类体系（taxonomy）， 对 prompt 和 response 做多分类，输出二值判定。

论文摘要原文："matches or exceeds that of currently available content moderation tools"。 注意这是 2023 年底的论文结果， 换成今天的模型与场景需自行复验。

At the code level it is a function plus a verdict; at the model level it can be an LLM acting as a classifier. The Llama Guard paper (arXiv 2312.06674) represents this route: an instruction-tuned safety classifier with its own risk taxonomy (taxonomy), multi-label classification over prompts and responses, emitting binary verdicts.

Paper abstract text: "matches or exceeds that of currently available content moderation tools". Note these are late-2023 paper results; with today's models and scenarios you must re-verify yourself.

1. 护栏管「行不行」，别顺手让它管「好不好」——那是评测的活。 2. 检查要快：挂在主流程前的护栏，本身不能成为延迟大头。 3. 失败要可见：拦了什么、为什么拦，要留痕，否则无法排查误杀。 4. 别只守门口：工具调用、交接、委派，每一跳都可能是入口。

最后一句官方提醒值得放在案头： Anthropic 官方原文："The autonomous nature of agents means higher costs, and the potential for compounding errors." 护栏不是万能药，但它是把错误复合按在第一步的那只手。

1. Guardrails police "allowed or not" — don't let them drift into "how good"; that is evaluation's job. 2. Checks must be fast: a guardrail in front of the main flow must not itself become the latency hotspot. 3. Failures must be visible: what was blocked and why must leave a trace, or false positives cannot be debugged. 4. Don't guard only the front door: tool calls, handoffs, delegations — every hop can be an entry point.

One last official reminder worth keeping on the desk: Anthropic official text: "The autonomous nature of agents means higher costs, and the potential for compounding errors." Guardrails are not a cure-all, but they are the hand that pins compounding errors down at the first step.