Your Model Is the Coworker Who Overshares and Lies in the Same Breath
You know the one. Leaks a customer's phone number, then confidently invents a refund policy that does not exist, all in a single sentence, and never once notices. That is an unguarded LLM response talking to your users right now.
I built this discipline into regulatory-document pipelines for a living. The rule was simple. Nothing ships to a user or a compliance reviewer without knowing whether it is grounded in something real, and no chat transcript walks out the door carrying an SSN because nobody checked. guardrail-gate is that rule, rebuilt small enough to actually read.
It redacts the PII, checks whether every claim is backed by the sources you retrieved, throttles the clients trying to abuse you, and hands you one verdict: allowed or blocked, with the receipts attached. No mysterious "safety score" that means nothing.
Two Problems, Two Answers
Leaking private data and making things up are different failures. Blend them into one number and you lose the plot on both. So this checks them separately and tells you which one tripped.
• PII detection: pattern matching for emails, phone numbers, SSNs, credit cards, and IPs, and it hands back exactly which spans it scrubbed so you can audit the redaction instead of trusting it.
• Grounding: it breaks the answer into sentences and scores each one against your sources, then flags the response that snuck a hallucination in next to three true statements.
• Rate limiting: a per-client token bucket that returns a 429 before someone hammers you into a cloud bill.
• Hardening: optional API-key auth, size limits, a readiness probe, and error handling that never coughs up a stack trace to a stranger.
The Temptation I Said No To
Every instinct wanted to collapse PII and grounding into one clean confidence score. It demos beautifully. It is also useless, because when it fires you have no idea which failure you are looking at, and a guardrail you cannot explain just sells you false confidence. Two separate verdicts is uglier in the API and the only version that survives a real incident review.
I also wrote down what it misses, on purpose. The PII matcher will not catch a name buried in prose, that needs real NER. The grounding check will not catch a subtle fact bent inside an otherwise-solid sentence. A tool that pretends to catch everything is more dangerous than one that tells you its blind spots.
The Number
On the bundled benchmarks: 100% precision and recall on structured PII, and 83% accuracy telling a grounded answer apart from a hallucinated one.
20 tests green across the full Python matrix, plus a live Docker smoke test that boots the container and runs a real PII-and-grounding example end to end. No trust required.