A multi-agent customer-support system can read knowledge bases, call refund tools, and generate customer-facing replies. Risk review found that harmful content can enter via user chat, malicious tool payloads, or model-generated text. Leadership wants layered controls, not a single filter at the end. Which guardrail strategy best matches multi-intervention design?

AI-500 explicitly covers multi-intervention guardrail strategies spanning user inputs, tool calls, tool responses, and outputs. The best match is validating and filtering user inputs, tool call arguments, tool responses, and final agent outputs with policy checks at each stage of the agent loop. In multi-agent systems the attack surface is wider than chat: a subagent can inject content through tool results, or an orchestrator can issue a dangerous tool invocation. Stage-specific checks might include jailbreak detection on input, schema and allowlist validation on tool arguments, untrusted-content labeling and sanitization of tool payloads, and groundedness/safety checks on final messages. The single toxicity classifier applied only to the final natural-language reply while trusting all tool traffic is a single point of failure. Relying exclusively on the base model’s pretraining to refuse unsafe requests without additional runtime controls ignores operational guardrails required for production. Logging all conversations for offline review with no synchronous blocking guardrails may help compliance audits but does not prevent live harm. Implement custom domain constraints (for example, refund amount caps) as first-class guardrails, version them with prompts and tools, and include them in automated evaluation suites before each release.