The model's own training refuses some things, but production systems add external enforcement: classifiers screening inputs and outputs, validators forcing formats, allowlists on which tools an agent may call, human sign-off on risky actions. The distinction matters because training-based behavior can be jailbroken with words; a hard check outside the model cannot.

Designing guardrails is a trade between safety and usefulness — too loose fails on the worst day, too tight refuses legitimate work every day.