Technology Radar
Stateful guardrails extend LLM guardrails from single messages to whole conversations. Instead of checking only the current user message or the final model response, they evaluate a compact transcript of recent turns against policy-specific checks and maintain strike or ban state across the session. This matters because unsafe intent can emerge gradually: each message may look acceptable on its own, while the conversation as a whole reveals attempts at policy evasion, jailbreaking or prompt extraction. In practice, stateful checks run as a runtime gate before the agent acts, working alongside conventional single-turn input and output guardrails.
Evaluating conversation history on every turn adds latency and cost, and strike or ban thresholds need tuning to prevent false positives from locking out legitimate users. Our teams have used this technique in a production conversational assistant for sensitive workflows, tracing guardrail decisions in Langfuse. We recommend that teams running multi-turn assistants in production try stateful guardrails rather than relying on per-message checks alone.
