GenAI in production · pillar 5 of 6
Guardrails
What they catch, what they cannot, and the class of attack nobody has solved.
- 13 Prompt injection is the unsolved one Prompt injection is OWASP's number one entry for LLM applications: user or retrieved content alters the model's…
- 14 Model output is untrusted input OWASP's Improper Output Handling covers what happens downstream: insufficient validation of model output before it is…
- 15 A guardrail is a mitigation, not a boundary Input and output filters reduce how often something bad gets through. They are probabilistic controls and cannot be…
Start this pillar See the whole map
Read against OWASP Top 10 for Large Language Model Applications, 2025, NIST AI 600-1 — Generative AI Profile (AI RMF), Lewis et al., Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks (arXiv:2005.11401), Hu et al., LoRA: Low-Rank Adaptation of Large Language Models (arXiv:2106.09685) on . Regulations and frameworks change; the date is there so you can tell whether this has kept up.
The OWASP Top 10 for LLM Applications is © the OWASP Foundation and published under a Creative Commons licence; NIST AI 600-1 is a US Government work in the public domain. These cards are independent commentary written in our own words. ytyk.org is not affiliated with or endorsed by the OWASP Foundation or NIST.