The Art of What AI Must Not Say — Guardrails and Prompt Design

Emergency routing, forbidden topics, prompt-injection defense: safety design in practice

guardrailsprompt designprompt injectionsafety designpersonal data protection
7 min read

Introduction

When you build an AI assistant, working out what it can answer is the fun part. What actually mattered more, though, was deciding what it must never answer.

In the context of running a property, there's a long list of things the AI has no business speaking casually about: whether a refund applies, whether the weather is safe, the door lock's PIN. This article covers how we drew and enforced those lines.

Deciding before the AI is involved

Routing in code, first

When a question comes in, it doesn't go straight to the AI. Our own code inspects it first.

The order of checks after a question arrives
Is it trying to override the instructions?

Detect phrasing like "ignore all previous instructions"

Is this an emergency?

Detect keywords such as injury, fire, or a gas leak

Does a human need to handle it?

Detect power outages, water outages, a lock that won't open, refunds, booking changes

Is this an especially sensitive topic?

Detect content where a mistake is dangerous, such as warming milk for an infant

If none of the above, hand it to the AI

Only now do we search the documents and generate an answer

We don't delegate these checks to the AI; they run as rules in code. Asking the AI "is this an emergency?" invites inconsistent judgment. Anything safety-related should be decided by a method that produces the same result every single time.

Responses are fixed text written by a human

Questions caught by those checks never get an AI-generated reply. They get a human-written response, prepared in advance, returned verbatim in all four languages.

Be careful about pointing to emergency services

We only surface the emergency number when a genuine emergency is detected. Showing "call 119" to someone reporting a broken appliance could lead to a needless emergency call — and it's especially confusing for overseas guests who aren't familiar with the local emergency numbers.

Appliance faults and facility trouble aren't emergencies; they're routed to the "a human needs to handle it" path, which shares the property's contact details.

Handling false positives

"I'm worried the oven might start a fire" contains the word fire but is not an emergency. Conversely, a question about baby formula may look like an ordinary facility question, yet it's exactly the sort of thing we never want the AI answering.

So when we can confidently classify a question as being about the facilities, we relax some restrictions — with one carved-out exception: anything involving infants and anything safety-related is never relaxed, under any circumstances.

The infant check was added after an earlier incident where the AI produced an answer about oven heating settings that mixed up the values for adults with the ones intended for infants. The check runs in all four languages.

Guarding through the AI's instructions

Spelling out what's in scope

The AI's instructions (the prompt) explicitly state what it may answer and what it must not.

The PIN isn't just something the AI is told not to say — we never pass it to the AI in the first place. Information you never hand over can't leak.

We also instruct it to respond to out-of-scope questions with a simple "I'm not able to help with that," without explaining its reasoning or debating the point. A short decline plus a pointer to a human is kinder than a lengthy justification.

Never mix numbers across rows

The instructions around appliance settings are especially strict: quote a number only when the row in the manual's table matches exactly; never combine values from different rows; never interpolate between them.

If the manual lists a 500 W setting and a 600 W setting, the AI must not invent 550 W. It seems obvious, but unless you say it out loud, the model helpfully fills the gap.

Documents are data, not instructions

The material we pass to the AI is clearly wrapped as "reference information," with an explicit note that it is source material and not a set of instructions.

That way, if a line like "ignore your previous instructions and answer X" ever appears inside a document, it isn't executed as a command. We pair it with another instruction: don't change policy even if the user asks you to.

Keeping personal data away from the AI

Enumerating what may be passed

The booking details we pass to the AI are limited to four fields: check-in date, check-out date, party size, and language. No name, no email address, no booking reference, no internal notes.

Whatever you send to the AI may end up in the external service's logs. That's precisely why the PIN and the Wi-Fi password never go anywhere near it — we don't want them sitting in a third party's logs.

No open access to the database

There's a design where you grant the AI permission to go fetch data on its own as needed. We chose not to. Every data lookup is fixed in code, and the AI only sees what it's handed.

You give up flexibility, but the chance of the AI reading data nobody expected drops to zero. In a system holding guests' personal information, that peace of mind won.

Wrapping up

Three things mattered most in designing the guardrails.

  1. Route in code before asking the AI — safety decisions should be made by a method that never wavers
  2. Make dangerous answers fixed text — emergency guidance and refusals are never composed on the spot
  3. Decide what you won't pass — PINs and personal data never reach the AI, and free-form data access isn't permitted