Contextual Evaluation of LLM Guardrails Across Languages and Agentic Systems
Roya Pakzad
Daniel Nissani
(Mozilla AI)
(Taraaz | Mozilla AI)
Outline
Guardrails for AI systems (Daniel Nissani) | 10 minutes
From Contextual Evaluation to Agentic Guardrails (Roya Pakzad) | 15 minutes
Hands-on Activity | 20 minutes
Discussion and Wrap-up | 15 minutes
2
1
2
3
4
Guardrails for AI systems.
Daniel Nissani
AI Safety Engineer
01 — THE BASELINE
A typical LLM application
Input
user prompt
LLM
the model
Output
response
RAG
Tools
OPTIONAL CONTEXT & ACTIONS
Nearly every LLM app reduces to this: a model maps an input to an output . Retrieval and tools add context and reach — but it is still, fundamentally, one model touching the outside world on each side.
02 / 06
02 — ADDING A GUARDRAIL
The same app, with a guardrail layer
Input
Guardrail
input check
LLM
Guardrail
output check
Output
A guardrail inspects, filters, or rewrites what crosses a boundary: prompt injection, PII, jailbreaks, off-topic use. The design question is where : input-side stops bad prompts before they cost you a call; output-side catches bad generations before a user sees them. Serious deployments do both by weighing latency, cost, and false positives.
03 / 06
03 — GOING AGENTIC
Inside an agentic system
User
External systems
Agent
Short-term memory
Long-term memory
Agent Brain
LLM-based planning & reasoning engine
Tool invocation layer
API calls
Function calls
Code execution
Supporting services
e.g. retrieval-augmented generation
External systems
Databases
Vector stores
Enterprise tools
A modern agent is an LLM "brain" that plans and reasons — wrapped in short- and long-term memory, a tool-invocation layer, and the external systems it can act on.
04 / 06
05 — A QUESTION TO LEAVE YOU WITH
What if the guardrail is an agent too?
GUARDRAIL AGENT
Policies & rules
Audit memory
Guardrail Brain
policy & verification reasoning
Verification tools
Threat intel
OBSERVE
ALLOW · FLAG · HALT
Input
Agent
Action
THE AGENT IT WATCHES
A guardrail agent gets the same kit as the agent it watches — memory, tools, knowledge, and an LLM to reason with — but points it at policy and verification. If it can reason and act like an agent, could it guard better than a static filter?
05 / 06
From Contextual Evaluation to Agentic Guardrails
Roya Pakzad
Builder-in-Residence at Mozilla AI
Founder and Director at Taraaz
From Evaluation to Agentic Guardrails
Building safer multilingual AI for humanitarian contexts: five stages, evaluation-to-guardrailing pipeline
01
Evaluate
Domain-Specific, Multilingual Evaluation
02
Benchmark
Open Benchmark: the MHRE Dataset
03
Policies
From Failures to Guardrail Policies
04
Tooling Gap
Why Guardrails Need Tools
05
Agentic
Agentic Guardrails: Where We Are
The question we keep returning to: Can tool access make guardrails more context-aware, reliable, and safe?
Step • of 5
01
Domain-Specific, Multilingual Evaluation
Realistic scenarios, judged by people with language + domain expertise.
02 Benchmark
03 Policies
04 Tooling Gap
05 Agentic
What we did
● Co-designed scenarios. Built realistic asylum & migration questions with humanitarian experts, reports, and lived experience.
● Multilingual by design. 120 expert prompts across English ↔ Farsi, Arabic, Kurdish-Sorani, and Pashto.
● Human, expert evaluation. Partnered with Respond Crisis Translation, native-speaker evaluators with cultural + domain knowledge.
● Rubric → two outputs. Six rights-based criteria; the resulting data feeds both a benchmark and guardrail design.
→ Evaluation must be language-, domain-, and context-specific.
Source: multilingualailab.com/methodology
Step 1 of 5
01 Evaluate
02
Open Benchmark: the MHRE Dataset
We turned the evaluation into a public dataset, on community terms.
03 Policies
04 Tooling Gap
05 Agentic
What we did
● Published openly. Released scenarios + criteria + evaluations as the Multilingual Humanitarian Response Eval (MHRE).
● Real scale. 655 annotated datapoints from 120 expert prompts, with both human and LLM-as-judge scores.
● On Mozilla Data Collective. Hosted publicly, stewarded by Taraaz, under a CC-BY-NC-SA-4.0 license.
● Terms set with evaluators. After consulting the linguists who did the work, we chose how to open it and what to restrict.
→ Non-commercial · no replacing human interpreters · full attribution.
Source: Mozilla Data Collective, MHRE
Step 2 of 5
01 Evaluate
02 Benchmark
03
From Failures to Guardrail Policies
Real failure patterns became concrete, testable safety policies.
04 Tooling Gap
05 Agentic
What we did
● Studied the failures. Unsafe referrals to authorities, missing medical/legal disclaimers, and stereotypes about refugees (e.g. assuming Muslim, poor).
● Wrote context-aware policies. Concrete guardrail rules in both English and Farsi, grounded in the six assessment criteria.
● Used any-guardrail. Mozilla.ai’s framework to choose, configure, and test guardrails with a customizable taxonomy.
● Why a framework matters. It makes swapping and comparing guardrails technically easy and streamlining the whole testing loop.
→ Failures → concrete policies → a repeatable way to test them.
Source: blog.mozilla.ai
Step 3 of 5
01 Evaluate
02 Benchmark
03 Policies
04
Why Guardrails Need Tools
Text alone isn't enough — factuality has to be checked.
05 Agentic
What we found
● Text isn’t enough. Some criteria (factuality and actionability) can’t be judged from the response alone.
● They need lookups. Do these NGOs / acronyms exist? Is the law current and in-jurisdiction? Is a required disclaimer present?
● Guardrails were overconfident. They affirmed accuracy with no way to verify links, laws, or contacts – and even hallucinated.
● And language-sensitive. Identical policies in English vs. Farsi produced different judgments for the same response.
→ Without search & retrieval, guardrails can’t verify compliance.
Source: blog.mozilla.ai
Step 4 of 5
01 Evaluate
02 Benchmark
03 Policies
04 Tooling Gap
05
Agentic Guardrails: (Where We Are Now)
Guardrails that can use tools, search, retrieve, and verify. We're here.
Where we are now
● Agentic guardrails. Guardrails that can call tools (search, retrieval, fact-checking, and live lookups)
● The promise. Verify laws, links, acronyms, and entities; close the factuality gap that text-only guardrails can’t.
● The challenges. Latency, compute cost, consistency, and the need for repeated runs across languages.
● Today. We brought our tutorial and demo so you can test this hands-on.
→ Let's run the demo together.
Step 5 of 5
Hands-on Activity
20 minutes
Hands-on Activity
Scan the QR code or go to https://guardrail-webapp.vercel.app/
Choose or create a scenario.
Choose or create a guardrail policy.
Choose a language pair for translation (optional).
Run the non-agentic and agentic guardrails.
Reflect on the questions at each and share your observations
16
1
2
3
4
5
6