Guardrails layer

What you'll build

Step-by-step build

1. 1

   Define the policy

   List the rules you will enforce and the action for each: redact PII, block injection, validate schema, moderate output. Make the policy a config so rules can be turned on, off, or set to flag-only per deployment. This policy is the contract the rest of the layer implements.

2. 2

   Redact PII on input

   Before any text reaches the model, run it through Presidio or regex rules to find emails, phone numbers, and other identifiers, and replace them with placeholders. Keep a reversible map only if you genuinely need to restore values later. Nothing sensitive should reach the model that does not have to.

3. 3

   Detect jailbreaks and injection

   Screen user input for prompt-injection and jailbreak patterns, starting with known phrasings and escalating to a free LLM-based classifier for subtle cases. Prompt injection is when input text tries to override your system instructions, so treat retrieved and user content as untrusted. Block or flag per policy.

4. 4

   Call the model safely

   Only after input checks pass do you call the model, with a hardened system prompt that reasserts its rules. Pass the sanitized, redacted input, never the raw text. This keeps the model boundary clean.

5. 5

   Validate the output

   Parse the model's output against a strict Pydantic or Zod schema. On a mismatch, attempt one automatic repair pass and reject if it still fails, rather than passing malformed data downstream. Well-formed output is a safety property, not just a nicety.

6. 6

   Moderate the output

   Run the validated output through a moderation check for unsafe content before it reaches the user. Apply the policy action: block, redact, or flag for review. This is the last gate between the model and the person.

7. 7

   Log every decision

   Write an audit record for each request: which checks ran, what they caught, and the action taken. Store it in Postgres or Atlas so you can prove what the layer did and tune the rules. This log is essential for both debugging and compliance.

8. 8

   Red-team, deploy, document

   Build a small test set of PII leaks, injection attempts, and malformed responses, and confirm the layer catches all of them. Deploy the service in front of a real app and write a README covering the policy, the checks, and the red-team results. Show a blocked attack, because that is the proof.

Done when

• ✓PII in the input is redacted before it ever reaches the model.
• ✓A known prompt-injection or jailbreak attempt is blocked or flagged per policy.
• ✓Malformed model output is repaired or rejected, never passed downstream.
• ✓Every request has an audit log row showing the checks and the action taken.

Ship it

Run the guardrails layer as a FastAPI or NestJS service in front of your app on the AWS free tier, with the audit log in Postgres or Atlas. Put a real app behind it and run your red-team test set against it. Put the policy, the list of checks, and the red-team results in the README, and show a blocked attack.

What it proves: You can ship AI safely: redacting PII, blocking injection, validating output, and moderating content with a full audit trail. That safety layer is what lets an AI project actually launch.

Paste this into Cursor, Claude, or ChatGPT and build it step by step.

You are my senior AI engineer pair. Help me build "Guardrails layer" step by step. Stack: FastAPI or NestJS as the guardrails service wrapping every model call, Groq free tier for the app model and a free LLM-based check for subtle cases, Presidio or regex for PII detection, Pydantic or Zod for output schema validation, and Postgres or MongoDB Atlas (free M0) for the audit log.

Guardrails are checks that run on the way in and on the way out of the model. Prompt injection is when input text tries to override my system instructions, so I treat all user and retrieved text as untrusted.

Requirements:
1. A config-driven policy where each rule can block, redact, or flag.
2. Input PII redaction before text reaches the model.
3. Jailbreak and prompt-injection detection on input, from known patterns up to a free LLM classifier.
4. Strict output schema validation with one repair attempt, then reject.
5. Output moderation, plus an audit log of every check and action, and a small red-team test set the layer must pass.

Work in this order: policy, PII redaction, injection detection, safe model call, output validation, moderation, logging, then red-team. STOP after each step so I can test. Do not write the whole app at once.