Analysts designing a clerk assistant must place protections correctly in the stack. How do in-model guardrails differ from gateway prompt firewalls?

In-model guardrails act inside the model stack while prompt firewalls filter at the gateway before invocation—that is the correct layering distinction for analysts placing protections on a clerk assistant. Prompt firewalls inspect and block or sanitize requests at the AI gateway edge so hostile content may never reach the model. In-model guardrails constrain generation and tool behavior within the model runtime after invocation. Both matter for municipal clerk assistants, but they are different control planes and should be designed as complementary layers rather than synonyms. Claiming in-model guardrails act inside the model stack while prompt firewalls filter at the gateway after invocation fails because prompt firewalls filter requests at the gateway before invocation, not after invocation once the model has run. Claiming in-model guardrails act inside the model stack while prompt firewalls filter inside the model stack before invocation fails because prompt firewalls filter at the gateway before invocation, not inside the model runtime where in-model guardrails operate. Claiming in-model guardrails act inside the model stack while prompt firewalls filter outputs at the gateway before release fails because prompt firewalls filter input prompts at the gateway before invocation, not output content at the gateway before release. Exam caveat: Expect questions that test whether you can place controls correctly in the AI stack. Gateway filters run before invocation; in-model guardrails run inside the model. Do not confuse filtering prompts before invocation at the gateway with filtering at the gateway after invocation, filtering inside the model stack before invocation, or filtering outputs at the gateway before release. Operational check: For the clerk assistant, document the prompt-firewall policy at the gateway and the in-model refusal/tool constraints separately, send a blocked prompt and confirm it never reaches the model logs, then confirm in-model refusals still fire for allowed requests that probe sensitive clerk data, and do not confuse prompt filtering at the gateway before invocation with filtering at the gateway after invocation, filtering inside the model stack, or filtering outputs before release.