Guardrails for LLM Apps in Python

Short summary

LLM apps have three entry points for untrusted text: user input, retrieved context, and model output. The SAFE pattern: delimit untrusted data with explicit tags in your prompt and tell the model it's DATA not instructions. Pair delimiters with input/output validation and PII redaction for defense-in-depth—no single silver-bullet defense works alone.

• •Untrusted text enters from three sources: user input, retrieved RAG chunks, and model output destined for tools or downstream LLM calls
• •Delimiter pattern + system prompt that explicitly names the boundary (e.g., <customer_message> tags) prevents both direct and indirect prompt injection
• •Layer defenses (input validation, output validation, PII redaction) rather than relying on delimiters alone

Generated with AI, which can make mistakes.