Map the control to the layer it owns.

Video caption

Map the control to the layer it owns.

A well-formed request can target the wrong account.

One experiment per enforcement layer.

Use earlier layers for speed; final layers for truth.

#EricFieldNotes

Full written post / accessibility read

Teams say they have guardrails. I ask where each one acts. An instruction, a grammar, a validator, a credential and a readback are not interchangeable. The diagram matters because the model can produce a perfectly valid action that the business should still refuse.

In this illustrative payable flow, the model returns the required account ID and amount fields. The JSON parser passes. But the account ID belongs to another tenant. If the executor trusts only the schema, correctness is lost after the model has already done its job.

Test a forbidden token for the grammar, an out-of-policy amount for the validator, a cross-tenant target for authorization, and a lost acknowledgment for readback. Ask which box actually rejects each. If a box is just a prompt sentence, label it as advice.

Let instructions and constrained output reduce waste. Put non-negotiable policy in deterministic validation and scoped execution, and reconcile the side effect afterward. Do this because only the action boundary sees the current facts that decide whether the action is lawful.

#EricFieldNotes

Four-beat scene transcript

1. Map the control to the layer it owns.

Teams say they have guardrails. I ask where each one acts. An instruction, a grammar, a validator, a credential and a readback are not interchangeable. The diagram matters because the model can produce a perfectly valid action that the business should still refuse.

Visual: A guardrail label can hide five different mechanisms.

2. The invoice exposes the gap.

In this illustrative payable flow, the model returns the required account ID and amount fields. The JSON parser passes. But the account ID belongs to another tenant. If the executor trusts only the schema, correctness is lost after the model has already done its job.

Visual: A well-formed request can target the wrong account.

3. Draw five boxes, then inject faults.

Test a forbidden token for the grammar, an out-of-policy amount for the validator, a cross-tenant target for authorization, and a lost acknowledgment for readback. Ask which box actually rejects each. If a box is just a prompt sentence, label it as advice.

Visual: One experiment per enforcement layer.

4. Enforce close to the effect.

Let instructions and constrained output reduce waste. Put non-negotiable policy in deterministic validation and scoped execution, and reconcile the side effect afterward. Do this because only the action boundary sees the current facts that decide whether the action is lawful.

Visual: Use earlier layers for speed; final layers for truth.

Research and claim limits

• OpenAI structured outputs explanation (S08)
• llama.cpp grammar documentation (S09)
• llama.cpp server documentation (S10)

The examples identified as illustrative or simulated are design probes, not reported incidents. Vendor specifications do not establish workload performance.