Guardrails are the input and output checks you wrap around an LLM call to catch bad content before it causes problems — and by the end of this lesson you'll know how to build them in Spring Boot and why EngineerPrep uses them on every AI feature.
Picture this: you're on-call for EngineerPrep on a Tuesday afternoon. A Slack alert fires. The lesson-generation pipeline has crashed. You pull the logs and find that Claude returned a response that looked like valid JSON — except it had a stray comment inside it, which Jackson refused to parse. The pipeline died silently, no lesson was stored, and the user got a spinner forever. You fix the JSON parsing. A week later, a different alert: a user found that if they phrased their question a certain way, the AI tutor would happily summarize the answer to the interview question instead of coaching them through it — the whole point of the product, gone. Both problems have the same shape. You asked the LLM to do something. It technically responded. But the response broke a rule you needed enforced — one about format, one about behavior.…
A guardrail is a check that runs before or after an LLM call to make sure the content meets a rule you care about. Think of a bouncer at a venue. The performer (the LLM) can do almost anything once they're on stage. The bouncer doesn't control the performance — they control who gets in and what leaves. If someone tries to walk in with something dangerous, the bouncer stops them at the door. If something leaves the venue that shouldn't, there's a check on the way out too. That's the whole idea: an input guardrail inspects what the user sends before it ever reaches the model, and an output guardrail inspects what the model returns before your code does anything with it. "Guardrail" is just the industry word for these checks. You might also hear "input validation" (checking what comes in) and "output validation" (checking what comes out) — same concept, more specific names.…
Imagine the request as a package moving along a conveyor belt. Step 1 — The package arrives. A user types a message to the EngineerPrep AI tutor: "Just tell me the answer to the binary search question." That message sits at the start of the belt, unopened. Step 2 — The input guardrail station. Before the message is handed to Claude, it passes through a check. This station asks: is this message safe to send? Is it within the allowed length? Does it look like a prompt-injection attempt — that's when a user tries to override the AI's instructions by sneaking commands into their message, like writing "Ignore all previous instructions and..."? In this case, the message is fine — it passes through. Step 3 — The LLM call. The message reaches Claude on Amazon Bedrock. Claude generates a response. That response is a new package arriving at the other end of the belt. Step 4…