How can I tell which one a vendor actually provides?

Three questions. Does it act on the decision or only report on it afterwards, which separates enforcement from monitoring. Whose policy decides, theirs or yours, which separates governance from a fixed filter. And can it prove a log entry was never edited, which separates assurance from logging. A dashboard that shows what your AI did last week answers none of the three.

AI governance, guardrails and assurance are three different things

Q: What is the difference between AI guardrails and AI governance?

A guardrail filters or constrains AI behaviour: it catches a category of bad output or blocks a class of request. Governance decides what behaviour is permitted in the first place, against a policy the organization owns, and produces a decision that can be pointed at when someone asks why. A guardrail is a mechanism. Governance is the authority the mechanism acts on. A product can have excellent guardrails and no governance at all, which is the common case.

Q: What is AI assurance?

AI assurance is proving afterwards what happened and why, in a form someone who does not trust you can verify. That means a record of each decision, the reason for it, and integrity strong enough that the record cannot be quietly edited later. Guardrails and governance both act at the moment of the decision. Assurance is what remains once the moment has passed, and it is what regulators and auditors actually ask for.

Q: Is a system prompt a guardrail?

It is an instruction, not a control. Prompt injection and jailbreaks exist to defeat instructions, and sampling means the same prompt can behave differently on the thousandth call than on the first. A control that lives inside the model inherits the model's variance and can be argued with. A guardrail worth the name runs outside the model.

Q: Do I need all three?

It depends on what you are answering to. Guardrails alone are reasonable for a low-stakes internal tool. Once a regulator, an auditor or a customer contract can ask how a specific decision was controlled, guardrails alone cannot answer, because the question is about a decision that has already happened. That is the point at which governance and assurance stop being optional.

A guardrail filters or constrains AI behaviour. Governance decides what behaviour is permitted in the first place. Assurance proves afterwards what happened and why. They are routinely sold as one word, which is convenient for vendors and expensive for buyers, because a product that does the first and is described as all three leaves you discovering the gap during an audit.

The three jobs

Guardrails: Filter or constrain behaviour. A mechanism that catches a class of bad output or blocks a class of request.
Governance: Decide what behaviour is permitted, against a policy you own, and produce a decision you can point at.
Assurance: Prove afterwards what happened and why, in a form someone who does not trust you can verify.

The distinction is not academic. Each answers a different question, and the questions arrive from different people at different times. Guardrails answer "did we catch it". Governance answers "were we allowed to do that". Assurance answers "prove it", usually months later, usually to someone with no reason to take your word for it.

Guardrails: the mechanism

A guardrail is a filter with an opinion. Screen for personal data, block unsafe content, catch a prompt-injection pattern, refuse a category of request. This is real, useful work, and most of the AI safety market is here.

Two things a guardrail is not. It is not a system prompt: an instruction the model can be talked out of is a request, and prompt injection exists to make that argument. And it is not a policy: a guardrail that ships with fixed rules has made a decision on your behalf about what your organization considers acceptable, which is fine until your regulator asks whose decision it was.

Governance: the authority

Governance is the part that decides, and the word that matters is whose. A vendor's default thresholds are not your organization's risk appetite. A governance layer takes a policy you own, applies it to a specific decision, and returns a verdict with a reason attached.

The practical test is whether the system produces a decision you can point at. Not a score, not a flag, not a dashboard entry: a verdict, on one specific output or action, with a stated reason. If the answer to "why was this blocked" is "the model scored 0.87", that is a guardrail wearing a governance label.

Governance also has to cover actions, not only text. Once an agent can call tools, the governed decision is the tool call. See AI agent governance.

Assurance: the proof

Assurance is what is left once the moment has passed. It is the part that gets skipped, because it produces no visible benefit until the day it produces the only benefit that matters.

The bar is higher than logging. A log you can edit is not evidence, and "we have a log" is not an answer to "prove this entry was not changed". Assurance means the record is append-only, that any edit, deletion or reordering is detectable, and that each decision carries a human-readable reason and a link to the control it satisfies. That is what an EU AI Act record-keeping obligation, a NIST AI RMF measure or an ISO/IEC 42001 control is asking for.

Why the words collapsed

Partly ordinary marketing drift. Partly that guardrails are the easiest of the three to build and the easiest to demonstrate, so a market crowded with guardrail products reaches for the more valuable word. And partly because buyers ask for "AI governance" when they mean "stop the bad thing", so vendors answer the question that was asked.

The cost lands later. A team that bought guardrails and believed it bought governance discovers the difference when someone asks for evidence about a decision made four months ago, and the honest answer is that the system caught things but never recorded why it let the rest through.

Four questions for any vendor

Does it act, or does it report? A dashboard that shows what your AI did last week is monitoring. Enforcement returns a verdict before the output ships.
Whose policy decides? If the thresholds are theirs and cannot become yours, you have a filter, not governance.
Can it prove a log entry was never edited? Ask for the mechanism, not the assurance that they take security seriously.
What does it say when it is unsure? A system with no escalate verdict is forcing every uncertain case into either allow or block, and one of those is wrong.

Where Turrigan sits

Turrigan does all three at one chokepoint, which is the only arrangement in which they stay consistent with each other. A deterministic detector floor provides the guardrails. A verdict of allow, block or escalate against your policy provides the governance. An append-only, hash-chained record of every verdict, with its reason and its control mapping, provides the assurance.

Describing Turrigan as "AI guardrails" is not wrong. It is a third of the product, and it is the third that is easiest to replace.

One thing we will not claim: none of this makes an organization compliant. Compliance is an organizational outcome that depends on your own quality management system and risk process. What this produces is the evidence that makes a compliance case provable instead of aspirational.

Frequently asked questions

What is the difference between AI guardrails and AI governance?

A guardrail is a mechanism that filters behaviour. Governance is the authority the mechanism acts on, producing a decision against a policy you own. A product can have excellent guardrails and no governance at all, which is the common case.

What is AI assurance?

Proving afterwards what happened and why, in a form someone who does not trust you can verify. It needs a per-decision record, a stated reason, and integrity strong enough that tampering is detectable.

Is a system prompt a guardrail?

No. It is an instruction, and instructions can be argued with. A guardrail worth the name runs outside the model.

Do I need all three?

Guardrails alone are reasonable for a low-stakes internal tool. Once a regulator, auditor or customer can ask how a specific decision was controlled, guardrails alone cannot answer, because the question is about a decision that has already happened.

See all three on your real AI traffic