The guardrail metaphor has become the dominant framing for AI safety: add rules, filters, and prompts that keep the model within acceptable boundaries. The problem is that guardrails are suggestions, and models—like determined users—are skilled at finding the gaps between suggestions.
Where guardrails fail. Prompt injection attacks bypass content filters. Adversarial inputs cause models to produce outputs that no filter would approve in isolation. Context window manipulation causes models to "forget" their instructions. These are not theoretical vulnerabilities—they are well-documented attack vectors that any motivated actor can exploit.
Cages: hard boundaries. A cage is a constraint that the model cannot override because it is enforced outside the model. Examples: an output schema validator that rejects any response not conforming to the expected JSON structure; a classification layer that categorizes every output into allowed or denied categories; a rate limiter that prevents the model from generating more than N tokens of a particular type in a session; a deterministic post-processor that replaces sensitive patterns with redacted placeholders.
The architectural principle. Never trust the model to police itself. The model generates text; the system validates, transforms, and filters that text before it reaches the user. The model is the engine; the cage is the chassis. An engine without a chassis is dangerous not because the engine is faulty but because engines are not designed to constrain their own output.
Procurement implications. EU AI Act high-risk system requirements specify human oversight and intervention mechanisms. These are cage requirements, not guardrail requirements. The system must be designed so that a human operator can override, modify, or halt the AI output at any point—not through a polite request to the model but through a deterministic override in the system architecture. SAM.gov contract vehicles for AI services reference similar requirements under the NIST AI RMF.
Guardrails are a starting point. They catch casual misuse. But production systems—especially those deployed in public-sector contexts where the consequences of failure are high—need cages. The discipline of cage design is the discipline of production AI safety.