THE QUESTION, ANSWERED
DO I NEED AI GUARDRAILS OR EXECUTION CONTROL?
Both, and they are not the same job. Guardrails filter what a model says: the prompt going in, the text coming out. Execution control decides what an agent does: the action it is about to take, checked before it runs. If your AI only answers questions, guardrails may be enough. The moment it can send, write, pay, delete or deploy, you need the second one, because a filter on language does not stop an action.
The difference, plainly
- Guardrails
- Look at words. Block a jailbreak, redact personal data in a prompt, refuse an unsafe answer. Probabilistic, because judging language is.
- Execution control
- Look at actions. Check "delete these files" or "wire this amount" against a rule before it runs. Deterministic, because the rule either covers the action or it does not.
- What a guardrail cannot do
- Stop an action the model has already decided to take through a tool call. By then the words are gone and the request is real.
- What execution control cannot do
- Improve the model's answers. It does not touch the reasoning. The model still decides; the action does not run until it has been checked.
What the guidance says
The OWASP GenAI Security Project keeps prompt injection at the top of its list, which is the guardrail problem, and lists excessive agency and tool abuse beside it, which is the execution problem. Its agentic guidance says to separate the decision from the execution and to enforce authorization outside the model. That is the line between the two jobs.
The research side drew the same line earlier. AgentDojo (Invariant Labs and ETH Zurich, December 2024) is an evaluation framework that measures how an agent's defenses hold up when it is attacked through the tools it uses. It measures the defenses. It does not stop the action.
How to decide
- The AI answers and drafts, and a person acts on it. Guardrails.
- The AI calls tools, reads systems, or writes anywhere. Guardrails and execution control.
- The AI can pay, delete, deploy, send outside, or change access. Execution control with three outcomes, so the actions that should not run unseen are held for a person. Why hold, not modify.
What the difference looks like on tape
In July 2026 a vendor updated the model behind a demo agent. No prompt was malicious. The instructions were unchanged. The agent made more than 140 attempts in one run to do things it had never done, through tools it already had. A guardrail had nothing to filter. The check on each action stopped every one before it ran, with no new rule. The July run. Every published test. Where the check sits.
Common questions
Do I need AI guardrails or execution control?
Mountain Theory controls what your AI does; guardrails filter what a model says. Most enterprises need both. Guardrails stop a model from saying something unsafe. Execution control stops an agent from doing something unsafe. A jailbreak filter does not stop an authenticated agent from deleting a database, because nothing unsafe was said. If your AI only produces text, guardrails may be enough. If it takes actions, they are not.
How do you stop an AI agent from taking a harmful action?
Check every action before it runs and return ALLOW, HOLD, or BLOCK. The same holds for a workflow: each step it tries to take is checked before it runs, so a workflow manipulated mid-run still cannot act outside policy. Filtering the prompt does not help once the model has already decided. Mountain Theory evaluates each action against policy and returns one of three outcomes: ALLOW, HOLD or BLOCK. The action does not execute until it has been checked.
Does this require a human to approve every action?
No. It runs on its own, and a person steps in only where your rules say. HOLD is an option you switch on for the actions you choose, not a requirement. You decide where a person steps in, and everything else is checked and allowed to proceed without waiting on anyone.
More answers
The product, if you want it
Mountain Theory is the check described above, shipped. It works with any AI you already use, in your environment or the cloud.