WTF is Stateful Guardrails?
Guardrails that judge the whole conversation, not just the latest message, and remember strikes across a session.
Also called: conversation-level guardrails
TL;DR
A determined user can split a forbidden request into ten innocent-looking messages. Single-message filters pass each one. Stateful guardrails look at the recent conversation as a whole, notice the pattern, and can keep warning or blocking state for the rest of the session.
How it works
They evaluate a compact transcript of recent turns against policy-specific checks and maintain strike or ban state across the session, acting as a runtime gate before the agent acts, alongside ordinary single-turn input and output guardrails. Targets: gradual jailbreaks, policy evasion and prompt extraction. Trade-offs: extra latency and cost on every turn, and thresholds need careful tuning to avoid blocking legitimate users.
Origin
- Coined / introduced by
- Thoughtworks Technology Radar
- When
- Nov 2026
- Story
- Featured as Trial in Radar Vol. 35.