# Guardrail Placement

Guardrails belong at input screening, output screening, and tool-call authorization — a single output filter is not enough.

## Why the CCAR-P exam tests this

Candidates must show they can place controls at every trust boundary, not just bolt one filter onto the final response.

## Definition

An LLM application has three distinct enforcement points, and a robust design guards **all three**:

1. **Input screening** — inspect the incoming user message and any retrieved/`MCP` content before it reaches the model, catching injection attempts, disallowed requests, and untrusted instructions. 2. **Output screening** — inspect the model's generated response before it reaches the user or a downstream system, catching leaked secrets, `PII`, and policy-violating content. 3. **Tool-call / action authorization** — before any tool executes, check that *this* caller is allowed to perform *this* action on *this* resource with *these* arguments.

A **single output filter is insufficient**: it cannot stop a prompt injection that has already caused a destructive tool call, cannot enforce least-privilege on actions, and sees only text — not the side effects the agent has triggered. The most damaging failures (data exfiltration, unauthorized writes) happen at the tool boundary, which an output-only design never inspects.

Treat these as layers of **defense in depth**. Each layer fails closed, and the tool-authorization layer in particular enforces must-hold rules in **deterministic code**, not in the prompt.

## Exam trap

"Add a content filter on the model's output" as the *complete* answer is the trap — it leaves the input and tool-call boundaries unguarded, where the worst damage occurs.

## Commonly confused with

- **prompt-injection-defense** — Injection defense is a goal; guardrail placement is the architecture of where you enforce it.
- **fail-closed-vs-fail-open** — Placement is where controls sit; fail-closed is how each one behaves on error.

## Related

- prompt-injection-defense
- least-privilege
- pii-redaction
- fail-closed-vs-fail-open

---

Source: Claude Cert Prep — an independent, unofficial CCAR-P study resource (domain P5). Not affiliated with Anthropic.