# What Are AI Agent Rails? How to Run Agents on Customer Data Without Going Off Track

AI agent guardrails for customer data work best as rails: written, versioned tracks that let one agent do one job and nothing else. Each rail fixes what the agent may read, propose and execute, who approves, what is logged and who can stop it. Because tools and gates enforce the limits rather than prompts, rails work on any customer data platform (CDP).

**Who this is for:** marketing-operations leads, DPOs and architects who have been asked "how do we keep agents safe?". You will get a definition, a comparison and a ten-question test for one real agent. This page is part of the [AI agent rails](https://privycdp.org/ai/rails) method.

## What does an AI agent rail fix?

An AI agent rail fixes five powers for one job: read, propose, execute, approve and log. The full definition is this. An agent rail is a versioned, written operating track for one AI agent doing one job on customer data. It fixes what the agent may read, what it may propose, what it may execute, who approves, what is logged, how success is measured and who can stop it. An agent on a rail cannot do anything the rail does not describe.

The one-line rule is: one job, one data scope, one approver, one audit trail.

Here are the five powers for one agent. The [Reporting Summariser](https://privycdp.org/ai/rails/agents/reporting-summariser) writes a plain-language summary from approved metric queries, at L1.

| Power | Reporting Summariser |
|---|---|
| Read | Fixed metric queries, the metric catalogue and the campaign calendar. Aggregates above a minimum group size, with no row-level data. |
| Propose | Nothing. The summary is read-only output for review. |
| Execute | Nothing. A separate service delivers the report. |
| Approve | The report owner reviews each report at first, then samples. |
| Log | Query IDs, result hash, model version, report version and reviewer. |

The empty rows matter most. A misled session of this agent can write a poor paragraph. It cannot send that paragraph, read one customer's record or change a locked figure.

Rules enforce and models explain. Hard limits such as consent, suppression, thresholds and allow-lists are deterministic. A model's "pass" never overrides a failed rule, and a model's silence does not mean correct.

## Guardrails stop the agent leaving the road; rails mean there is only the track

A guardrail filters what passes through, while a rail defines the only things that can happen. That difference decides what fails when a filter misses.

Take a rule that customer email addresses must not leave in a report. A guardrail scans the output and removes anything that looks like an address, so an encoded address may get through. A rail gives the session aggregates only and no outbound tool. There is no address to leak and no way to send one.

Guardrails stay useful on a rail. An output filter can be the system that enforces an output contract, and a tool-call check can enforce part of a tool scope. [Agent rails, guardrails, policies and prompts](https://privycdp.org/ai/rails/rails-vs-guardrails-vs-policies) compares what each one enforces, and what each does under attack.

> **Diagram:** Side-by-side. Left: an agent on a road with guardrails, with arrows bouncing off the edges. Right: an agent on a single track with five labelled stations (read, propose, approve, execute, log). Caption: guardrails filter, rails define.

## "Rails" means something else in NeMo Guardrails

The word "rails" already has other meanings in AI tooling, so here is how this section's term relates to each. NVIDIA NeMo Guardrails uses "rails" for checks at stages of an LLM interaction [1](#source-1). Guardrails AI's early releases used `.rail` files [2](#source-2), though its current package page describes input and output guards built from validators and does not mention RAIL [3](#source-3). Those are components that can enforce parts of an agent rail. Our term sits one level up: the operating track for a job.

| Term | Source | What it means | Relation to an agent rail |
|---|---|---|---|
| Input, retrieval, dialog, execution and output rails | NVIDIA NeMo Guardrails | Checks at stages of an LLM interaction | Can enforce parts of one |
| `.rail` file | Guardrails AI, early releases | A specification used to validate model output | Could enforce an output contract |
| "AI Agents on Rails" | Celent, 7 May 2025 | Agents built with limits; "Autonomous Agents + Operational Guardrails" [4](#source-4) | Earlier use of the phrase, in a looser sense |
| Ruby on Rails | Web framework | Unrelated software | None |

## Why is a prompt not a control?

A prompt is not a control because the model reads it alongside everything else in its context, including text an attacker wrote. Meta calls prompt injection "a fundamental, unsolved weakness in all LLMs" [5](#source-5). Its Agents Rule of Two limits one session to at most two of three properties: it processes untrustworthy inputs, it accesses sensitive systems or private data, and it changes state or communicates externally [5](#source-5).

OWASP's Top 10 for Agentic Applications names what goes wrong: ASI01 Agent Goal Hijack, ASI02 Tool Misuse & Exploitation and ASI03 Identity & Privilege Abuse [6](#source-6)[16](#source-16).

A rail cannot prevent prompt injection. It limits what a hijacked agent can reach. The incidents behind this are in [7 things AI agents should never do with customer data](https://privycdp.org/ai/7-things-ai-agents-should-never-do-with-customer-data), and the architecture is in [running agents inside your boundary](https://privycdp.org/ai/ai-agents-on-customer-data-inside-your-boundary).

## Three ways to run an agent

Three ways of running an agent differ in what stops a bad action and what is left afterwards. The table compares them for one agent working on customer data.

| Way of running | What stops a bad action | What an auditor sees | How far one error spreads | Set-up effort | When it is enough |
|---|---|---|---|---|---|
| No controls | The prompt and the model's judgement | Chat history or vendor logs, if kept | As far as the credentials reach | Lowest | Private experiments on synthetic data |
| Guardrail filters | A check that recognises the problem | Which checks fired and what they blocked | As far as the credentials reach, minus what the filters catch | Moderate: configure and tune checks | Chat with no tools and no private data |
| On rails | No tool exists for it, a system refuses it, or a named person rejects it | The card in force, plus a ledger entry per run with tools, hash, approver and outcome | To the limits on the card: one job, capped counts, allow-listed destinations | Highest: write, own and test each card, and run the systems behind it | Any job with tools on personal data, and anything that changes state |

## What do rails add for regulated teams?

Rails give regulated teams evidence of how an agent was controlled, not compliance itself. These are the main touchpoints.

- **GDPR Article 22.** A rail and its ledger can show that a human review was real [8](#source-8). That matters because the UK's Data (Use and Access) Act 2025 section 80 turns on meaningful human involvement [10](#source-10), and the SCHUFA ruling shows a score can be the decision when others draw strongly on it [9](#source-9). See [explainable AI for customer decisions](https://privycdp.org/ai/explainable-ai-customer-decisions).
- **EU AI Act Article 50.** Transparency duties apply from 2 August 2026 where customers deal with an AI system [11](#source-11). A rail can record that the disclosure step ran. See the [EU AI Act guide](https://privycdp.org/regulation/eu-ai-act-marketing-customer-decisioning).
- **EU AI Act Article 14.** Human oversight duties apply to high-risk systems only, with Annex III obligations from 2 December 2027 [12](#source-12)[14](#source-14). Marketing segmentation is not high-risk per se, but a rail's gate is a useful start if an agent touches such a use.
- **EU AI Act Annex III point 4(b).** Monitoring workers' performance and allocating tasks by individual behaviour are listed high-risk uses [13](#source-13). Report agent results by rail and role, not by named person, and take advice.
- **HIPAA.** If an agent could see protected health information, its data scope and model placement must match your agreements. See the [HIPAA customer data platform guide](https://privycdp.org/guides/hipaa-compliant-customer-data-platform).
- **DORA.** A model or agent vendor may belong in your register. See the [DORA register of information guide](https://privycdp.org/regulation/dora-marketing-stack-register-of-information).

## What do rails cost?

Rails cost team time rather than licences, though the systems behind them may carry their own cost. Four items recur.

- **Writing and owning cards.** Every job needs a card and a named owner who keeps it current.
- **An approval queue.** It can become a bottleneck, and long queues push people to bypass it. Track approval turnaround.
- **Evaluation upkeep.** Test sets age. Someone must add each escaped error and rerun the set after any model, prompt or tool change.
- **Enforcement systems.** A data view, a gateway, an approval service and a ledger writer must be built or bought.

Rails are overkill for one-off analysis of non-personal data, for a vendor agent that stays on data the vendor already holds, and for a check a script can do. Anthropic's advice to use the simplest solution applies [7](#source-7). PrivyCDP's [product page](https://privycdp.org/cdp) describes limits on data access, review of results and an immutable audit ledger that records each AI-assisted action with the human or system actor that authorised it.

## Is this agent on a rail?

An agent is on a rail only if you can answer yes to ten questions, one for each field of the [agent rail card](https://privycdp.org/ai/rails/agent-rail-card). Any "no" names the gap.

1. **Job.** Can you state its job in one sentence with one outcome?
2. **Trigger.** Is what starts a run written down, and can nothing else start it?
3. **Data scope.** Does a data view or field projection limit what it reads, rather than a prompt?
4. **Tool scope.** Is there an allow-list of tools by read, propose and execute, held outside the model?
5. **Output contract.** Is its output validated against a fixed format, with figures checked by a rule?
6. **Gate.** Does a named person other than the requester approve, bound to a hash, with timeouts that expire?
7. **Limits.** Do a gateway or an execution service enforce numeric limits?
8. **Ledger.** Is every run recorded by a system the agent cannot write to?
9. **Evaluation.** Is there a test set with seeded failures, rerun on every model, prompt or tool change?
10. **Owner and kill switch.** Is there a named owner, and has someone drilled the stop?

## Three first rails

Three jobs make good first rails, because each one changes little and shows results quickly. Once you pick one, use the [rail levels](https://privycdp.org/ai/rails/rail-levels-autonomy-ladder) to confirm its ceiling.

| First rail | Level | Why start here |
|---|---|---|
| [Reporting summaries](https://privycdp.org/ai/rails/use-cases/reporting-summaries) | L1 | Aggregates only, nothing changes, and a number check catches wrong figures. |
| [Journey QA before launch](https://privycdp.org/ai/rails/use-cases/journey-qa-before-launch) | L2 | No customer profiles, and seeded defects give a clear score. |
| [Campaign anomaly detection](https://privycdp.org/ai/rails/use-cases/campaign-anomaly-detection) | L1, L4 pause | Your first bounded action, where a written rule fires the pause and a person resumes. |

By Art Kukharenko
Published: 2026-11-02
Updated: 2026-11-02

## FAQ

### Are AI agent rails the same as guardrails?

No. Guardrails are checks that filter inputs, outputs or tool calls at runtime. An agent rail is the written track for one job: what the agent may read, propose and execute, who approves, what is logged and who can stop it. A guardrail can be one component that enforces part of a rail.

### Can rails stop prompt injection?

No. A rail cannot stop a model being misled by text it reads. It limits what a misled agent can reach: no extra data, no extra tools, no action past its gate, and a record of the run. Meta describes prompt injection as unsolved [5](#source-5), and the UK NCSC expects only to reduce its likelihood or impact [15](#source-15).

### Do rails slow marketing teams down?

At first, yes. Writing a card and building a gate takes time, and a long approval queue can slow launches. After that, read-only and draft work runs without approval, and a reviewer sees a diff and counts rather than a ticket thread. Measure cycle time and approval turnaround against a baseline rather than assume a gain.

### Who owns a rail?

A named person in the function whose job the agent does, such as the head of marketing operations for journey QA. The owner accepts changes, signs promotions and can stop the agent. Security approves new tools and the DPO approves wider data scope. With no named owner, the rail drops a level automatically.

### Do rails work with vendor agents such as Agentforce?

Yes, as far as the vendor lets you configure them. Write the card anyway, and mark each field as enforced by the vendor, enforced by you, or a known gap. The gaps tell you whether the vendor's agent is enough for this job. For many low-risk jobs on data the vendor already holds, it will be.

### Do rails make us GDPR compliant?

No. A rail is a control and a source of evidence, not compliance. It can show what the agent was allowed to do and who reviewed its work, which helps with accountability. You still need a lawful basis, a DPIA where one is required, and an Article 22 assessment for each use. Ask your DPO.

## Sources

1. NVIDIA, NeMo Guardrails overview: https://docs.nvidia.com/nemo/guardrails/latest/about/overview.html
2. Guardrails AI, package page for release 0.2.4: https://pypi.org/project/guardrails-ai/0.2.4
3. Guardrails AI, current package page, release 0.11.0 (opened 1 November 2026): https://pypi.org/project/guardrails-ai/
4. Celent, "AI Agents on Rails: Balancing Autonomy with Safety" (7 May 2025): https://www.celent.com/en/insights/ai-agents-on-rails
5. Meta, Agents Rule of Two (31 October 2025): https://ai.meta.com/blog/practical-ai-agent-security/
6. OWASP GenAI Security Project, Top 10 for Agentic Applications for 2026 (9 December 2025): https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/
7. Anthropic, "Building effective agents" (19 December 2024): https://www.anthropic.com/engineering/building-effective-agents
8. GDPR Article 22: https://gdpr-info.eu/art-22-gdpr/
9. CJEU, Case C-634/21 SCHUFA Holding (Scoring), 7 December 2023: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0634
10. Data (Use and Access) Act 2025, section 80: https://www.legislation.gov.uk/ukpga/2025/18/section/80
11. EU AI Act, Article 50: https://artificialintelligenceact.eu/article/50/
12. EU AI Act, Article 14: https://artificialintelligenceact.eu/article/14/
13. EU AI Act, Annex III: https://artificialintelligenceact.eu/annex/3/
14. Regulation (EU) 2026/1744, OJ 24 July 2026: https://eur-lex.europa.eu/eli/reg/2026/1744/oj
15. UK National Cyber Security Centre, "Prompt injection is not SQL injection" (8 December 2025): https://www.ncsc.gov.uk/blog-post/prompt-injection-is-not-sql-injection
16. Cycode, list of the OWASP agentic risk names: https://cycode.com/blog/owasp-top-10-agentic-applications/

Back to the [AI agent rails hub](https://privycdp.org/ai/rails). To test one of your own agents against the ten fields, [download the rail card template](https://privycdp.org/tools/agent-rail-card).

This article is general information, not legal advice.

## Further reading

- [AI Agent Rails: An Operating Model for Running Agents on Customer Data](https://privycdp.org/ai/rails)
- [AI Agent Rail Card Template: YAML, Spreadsheet and JSON Schema](https://privycdp.org/tools/agent-rail-card)
- [7 Things AI Agents Should Never Do With Customer Data (and How to Enforce It)](https://privycdp.org/ai/7-things-ai-agents-should-never-do-with-customer-data)
- [Running AI Agents on Customer Data Without Leaving Your Boundary: Architecture Patterns](https://privycdp.org/ai/ai-agents-on-customer-data-inside-your-boundary)
- [Explainable AI for Customer Decisions: Reason Codes, Model Lineage, and What Auditors Ask](https://privycdp.org/ai/explainable-ai-customer-decisions)