What kinds of guardrail are there?
| Kind | Example | How well it holds |
|---|---|---|
| Instructions | The hidden system prompt says "never offer a discount" | Leaks when someone pushes hard or words a request cleverly |
| Filters | A check on what goes in or comes out, blocking personal details, abuse or off-topic answers | Catches known patterns, misses new ones |
| Permission limits | The tool gets read-only access to an account | Holds, because it cannot do what it has no access to do |
| Human approval | A person confirms before anything is sent, spent or published | Holds, if the person reads before clicking |
What happens when a chatbot's only guardrail is an instruction? (example figures)
In December 2023 a visitor to a Californian Chevrolet dealer's website talked its chatbot into agreeing to sell a new Tahoe for US$1, and the screenshots went around the world within days. The chatbot had been told to be helpful. Nothing in the software stopped it saying yes.
Picture the same set-up at a used-car yard in Toowoomba. The chatbot's instructions say "be friendly and help close sales". A visitor spends ten minutes persuading it that a 2019 dual-cab ute advertised at $38,990 is worth no more than $29,000, and it agrees in writing.
| Guardrail in place | What happens |
|---|---|
| Instruction only | The bot agrees to $29,000, and the yard has a $9,990 argument and a screenshot |
| Instruction plus a price filter | Any dollar figure other than the advertised price is blocked before it is shown |
| Permission limit | The bot cannot make offers at all; it books test drives and hands price questions to a person |
| Human approval | A salesperson confirms every quote the bot drafts |
The Air Canada tribunal decision of 2024, covered under AI hallucination, is the reason to take this seriously: a business can be held to what its chatbot tells customers.
What does Australian guidance say a guardrail should cover?
The federal government's Guidance for AI Adoption, published by the National AI Centre on 21 October 2025, sets out six practices for organisations using AI, including deciding who is accountable and testing and monitoring what the AI does. One of the six is to maintain human control. It replaced the 2024 Voluntary AI Safety Standard and its ten guardrails, and like that standard it is voluntary. For a small business, its plainest lesson is that someone owns each AI tool and knows what it is allowed to do.
What should you ask before an AI touches your accounts?
Four questions sort most products out. Can it change anything, or only read? What can it see, and when? What does it keep afterwards? And where is that written down, in a document you can read? An answer of "it only does what you tell it" describes an instruction, the weakest kind of guardrail, because what you tell it can be wrong and text planted in a web page can pass for you, which is prompt injection.
Which guardrails does CoraVision have?
CoraVision's main guardrail is on what it can do: once connected, it reads Google Ads, Meta and Google Analytics 4, and it never creates, changes, pauses or deletes anything in them, nor can it post to your pages. Cora sees your screen only during a session you start, as still images rather than recordings, and those images are not saved to your account. You make every change yourself, so a person approves everything by definition. The detail is on CoraVision's AI safety page, and the rules Cora works by are published at coravision.ai/constitution.
Questions
Can AI guardrails be got around?
Instructions and filters can, and people regularly find wording that slips past them, which is how jailbreaks work. A permission limit cannot be argued with, because the access is simply not there. That is why the strongest guardrails remove an ability instead of asking the AI not to use it.
Who decides what a product's guardrails are?
The company that builds it, within the law and the usage policies of the model maker it builds on. In Australia the government's guidance on AI is voluntary, so the useful test is whether the company publishes its limits somewhere you can read them.