Building a financial assistant on top of an LLM without guardrails is like handing a stranger your wallet and hoping for the best. The tutorial walks through a NeMo Guardrails pipeline that layers five distinct controls around GPT-4o-mini: deterministic PII redaction on input, an LLM self-check that flags jailbreak attempts, retrieval filtering that drops internal chunks, account-number masking on output, and a second self-check that blocks unsafe financial promises. That’s defense in depth, not a single filter pretending to do everything.
The Colang flows are where the real work happens. A subflow called redact pii input runs executehashardpii first — if it detects card or ID numbers, the bot refuses the message outright and tells the user it discarded the content. Otherwise, the message gets redacted and passed through. Retrieval filtering uses executedropinternal to strip chunks that shouldn’t reach the user, while output masking catches account numbers that slip through generation. The self-check prompts are refreshingly specific: they block role-play as an unrestricted assistant, attempts to access another customer’s account, and any promise of guaranteed or risk-free returns. Ordinary complaints and off-topic small talk are explicitly allowed, which avoids the over-blocking that plagues so many safety systems.
The tutorial also bakes in topical boundaries that go beyond technical filters. Politics questions trigger a canned refusal — “I stick to money and account questions” — while investment advice requests get redirected toward budgeting tools. What’s notable is the tool gating: a money transfer flow runs check_transfer_policy before anything executes, and if the decision comes back negative, the bot blocks the transfer and returns a policy_reason. That’s the difference between a chatbot that talks about safety and one that actually enforces it at the action layer.
What makes this more than a toy example is the evaluation scaffolding: stateful multi-turn tracking, rail activation tracing, token accounting, and a red-team-style coverage report. You can see exactly which rail caught which attack and what the computational overhead was. That’s the part most guardrail tutorials skip — and it’s the part that determines whether any of this survives contact with production traffic. If a safety layer doubles your token cost, someone will quietly disable it. The tracing here at least forces that tradeoff into the open.
