Agent rail

Part of the Learn hub and the customer data glossary.

What it means in practice

An agent rail fixes what the agent may read, what it may propose, what it may execute, who approves, what is logged, how success is measured and who can stop it. An agent on a rail cannot do anything the rail does not describe. The one-line rule is: one job, one data scope, one approver, one audit trail.

The rail is written down on a rail card, and each job gets a rail level. Systems hold the limits, because a prompt is not a control: a data view, a tool allow-list, an approval service, an execution service and a ledger writer. A draft-only rail holds no tool that can do anything else.

The word "rails" is used in other ways too. Celent used "AI Agents on Rails" in 2025 for agents with built-in constraints 1. NVIDIA's NeMo Guardrails defines input, retrieval, dialog, execution and output rails, which are checks at stages of an LLM interaction 2. A rail in this glossary is broader: the whole operating spec for one job.

Rails are a vendor-neutral method, not a product feature. PrivyCDP's AI layer offers limits on data access and review of results, which a rail can build on.

Example (retail bank, illustrative): marketing operations wants help building segments. The Segment Drafter rail lets an agent read the schema and consent-filtered counts and draft a definition at L2. A reviewer who did not make the request approves it. The agent holds no tool that could activate the segment.

Related terms

• Rail card: the written spec for a rail.
• Rail level: how much the agent may do on that job.
• Approval gate: where a person decides.
• Audit ledger: the record of every run.
• AI agent: the software a rail constrains.

Where it matters

• What are AI agent rails?: the full explanation.
• Marketing automation QA with an AI agent: one job on a rail, step by step.
• AI agent rails: the method and its agents.

Back to the customer data glossary or the Learn hub.