# Agent rail

**An agent rail is a versioned, written operating track for one AI agent doing one job on customer data.**

*Part of the [Learn hub](https://privycdp.org/learn) and the [customer data glossary](https://privycdp.org/learn/glossary).*

## What it means in practice

An agent rail fixes what the agent may read, what it may propose, what it may execute, who approves, what is logged, how success is measured and who can stop it. An agent on a rail cannot do anything the rail does not describe. The one-line rule is: one job, one data scope, one approver, one audit trail.

The rail is written down on a [rail card](https://privycdp.org/learn/glossary/rail-card), and each job gets a [rail level](https://privycdp.org/learn/glossary/rail-level). Systems hold the limits, because a prompt is not a control: a data view, a tool allow-list, an approval service, an execution service and a ledger writer. A draft-only rail holds no tool that can do anything else.

The word "rails" is used in other ways too. Celent used "AI Agents on Rails" in 2025 for agents with built-in constraints [1](#source-1). NVIDIA's NeMo Guardrails defines input, retrieval, dialog, execution and output rails, which are checks at stages of an LLM interaction [2](#source-2). A rail in this glossary is broader: the whole operating spec for one job.

Rails are a vendor-neutral method, not a product feature. PrivyCDP's AI layer offers limits on data access and review of results, which a rail can build on.

**Example (retail bank, illustrative):** marketing operations wants help building segments. The [Segment Drafter](https://privycdp.org/ai/rails/agents/segment-drafter) rail lets an agent read the schema and consent-filtered counts and draft a definition at L2. A reviewer who did not make the request approves it. The agent holds no tool that could activate the segment.

## Related terms

- [Rail card](https://privycdp.org/learn/glossary/rail-card): the written spec for a rail.
- [Rail level](https://privycdp.org/learn/glossary/rail-level): how much the agent may do on that job.
- [Approval gate](https://privycdp.org/learn/glossary/approval-gate): where a person decides.
- [Audit ledger](https://privycdp.org/learn/glossary/audit-ledger): the record of every run.
- [AI agent](https://privycdp.org/learn/glossary/ai-agent): the software a rail constrains.

## Where it matters

- [What are AI agent rails?](https://privycdp.org/ai/rails/what-are-ai-agent-rails): the full explanation.
- [Marketing automation QA with an AI agent](https://privycdp.org/ai/rails/use-cases/journey-qa-before-launch): one job on a rail, step by step.
- [AI agent rails](https://privycdp.org/ai/rails): the method and its agents.


Back to the [customer data glossary](https://privycdp.org/learn/glossary) or the [Learn hub](https://privycdp.org/learn).

By Art Kukharenko
Published: 2026-11-02
Updated: 2026-11-02

## FAQ

### Is an agent rail the same as a guardrail?

No. A guardrail stops an agent going off the road. A rail means there is no road, only the track: data and tools outside the rail are simply not available. Teams often use both.

### Does each agent need its own rail?

Each job needs its own rail. One agent can hold an L3 rail for one job and an L1 rail for another, because levels belong to a job.

## Sources

1. Celent, "AI Agents on Rails" (7 May 2025): https://www.celent.com/en/insights/ai-agents-on-rails
2. NVIDIA, NeMo Guardrails overview: https://docs.nvidia.com/nemo/guardrails/latest/about/overview.html


## Further reading

- [AI Agent Rails: An Operating Model for Running Agents on Customer Data](https://privycdp.org/ai/rails)
- [AI Agent Rail Card Template: YAML, Spreadsheet and JSON Schema](https://privycdp.org/tools/agent-rail-card)
- [Customer Data Glossary: 50 Terms Explained](https://privycdp.org/learn/glossary)
- [Segment Drafter: An AI Agent That Drafts Segments for Human Approval](https://privycdp.org/ai/rails/agents/segment-drafter)
- [Marketing Automation QA: Check Journeys Before Launch With an AI Agent on Rails](https://privycdp.org/ai/rails/use-cases/journey-qa-before-launch)