What can actually be enforced this way?

Properties of the text: shape, format, length, membership of a fixed set. Those are visible while the answer is being produced, which is what makes them enforceable. Accuracy and appropriateness are properties of meaning and are not available to the mechanism, whatever the surrounding marketing suggests.

Why does it matter that the failure is quiet?

Because a rejected answer gets noticed and a substituted one does not. Constrained to a fixed set, a system with no good answer returns the closest permitted value, which looks exactly like a normal response. Nothing downstream can tell the difference, so the check that would have caught it has to sit somewhere else.

Is this the same as structured output?

Structured output is the most common form of it, sold as a reliability feature. Naming them together is fair, and the reason to keep the general term is that the same reasoning applies to constraints that are not about data shape, such as limiting the permitted next actions of an agent.

Glossary

Guarded generation

Guarded generation constrains the output while it is being produced, so certain answers cannot be formed at all, rather than being caught and discarded once they exist.

In plain terms

Narrowing what the model is allowed to say as it says it. The alternative is to let it answer and then inspect the result, throwing away anything unacceptable. Both end with an acceptable answer most of the time. They differ in what happens on the occasion when no acceptable answer is available, and that is the difference worth understanding.

Why it matters

Because retrying costs time and money, and a check that runs after the fact pays for every attempt. Where the requirement is structural, such as an answer that must be one of four values or must parse as a particular shape, constraining during generation removes a class of failure rather than catching it. Where the requirement is about meaning, it does much less than the name suggests.

How it works

The constraint applies to form far more reliably than to substance. Requiring output to fit a shape, choose from a fixed set, or stay within a length is enforceable while the answer is being produced, because those are properties of the text itself. Requiring it to be accurate, fair or appropriate is not, since none of those is visible in the shape of a sentence.

The failure mode moves rather than disappearing, which is the part most often missed. A check after the fact fails loudly: something was produced, judged unacceptable and rejected, and there is a record of it. A constraint applied during generation fails quietly, by producing the nearest permitted answer instead, and the nearest permitted answer to a question the model cannot answer is a confident wrong one in the required format.

It is usually invisible in products, appearing as a setting rather than a feature. Structured output modes, fixed response options and schema enforcement are all this technique, sold as reliability rather than as safety. That framing is accurate for what they enforce, and it is worth remembering that reliability of form is what has been bought.

It composes with checks rather than replacing them. The shape can be guaranteed during generation and the meaning checked afterwards, which is the arrangement most production systems converge on. Treating the constraint as sufficient because nothing malformed has appeared is the mistake, since malformed was never the failure anybody was worried about.

Two ways to prevent a bad answer

Reading the two columns together explains why production systems almost always end up with both, having usually started with one. Teams reach for the left column first because it is cheap and because malformed output is the failure that breaks code, which makes it the failure they meet earliest. Once that is solved the remaining failures are all in the right column's territory: answers that parse perfectly, satisfy every constraint, and say something untrue. The constraint mechanism has no view on those and cannot acquire one, because it is operating on the text rather than on the claim. The useful reading is not that one approach is better but that they address disjoint failures, and that the quiet substitution on the left is the reason a system can appear to be working for a long time before anybody discovers what it has been returning.

Seen in the wild

An agent platform with governance and guardrails built in, where what the agent may produce is bounded before anybody reviews a transcript.
Sierra
Agents expressed as controllable graphs, where the permitted next steps are part of the structure rather than a matter of persuasion.
LangChain / LangGraph
An automation step that accepts a fixed set of values, so a downstream system cannot receive something it has no branch for.
Make

Common misconceptions

People assume

Constraining generation makes the answer correct.

In fact

It makes the answer well formed. A response forced into one of four options will be one of those four, including on the occasions when none of them is right. Form and truth are separate properties, and only one of them can be enforced while the text is being produced.

People assume

It replaces checking the output.

In fact

It removes the malformed-output failure and leaves every other one untouched. The arrangement that works applies the constraint to shape and a check to meaning, because the failures that matter to a reader are almost always about meaning.

Telling them apart

Guarded generation vs Guardrails

Guarded generation

Constrains the answer while it is being formed.

Guardrails

Inspects the answer once it exists, and refuses.

One cannot produce the unacceptable answer; the other catches it. The first fails quietly by substituting, the second fails loudly by rejecting.

Questions

What can actually be enforced this way?: Properties of the text: shape, format, length, membership of a fixed set. Those are visible while the answer is being produced, which is what makes them enforceable. Accuracy and appropriateness are properties of meaning and are not available to the mechanism, whatever the surrounding marketing suggests.
Why does it matter that the failure is quiet?: Because a rejected answer gets noticed and a substituted one does not. Constrained to a fixed set, a system with no good answer returns the closest permitted value, which looks exactly like a normal response. Nothing downstream can tell the difference, so the check that would have caught it has to sit somewhere else.
Is this the same as structured output?: Structured output is the most common form of it, sold as a reliability feature. Naming them together is fair, and the reason to keep the general term is that the same reasoning applies to constraints that are not about data shape, such as limiting the permitted next actions of an agent.

Key takeaways

Constrains form while the answer is produced; cannot constrain meaning.
The failure moves rather than vanishing: a quiet substitution instead of a loud rejection.
Structured output modes are the everyday form of it, sold as reliability.
Pairs with a check on meaning; it does not replace one.

Tools that use this

Sierra
Governance and guardrails built in, bounding what the agent may produce.
LangChain / LangGraph
Controllable graphs, where permitted steps are structural.
Make
A step accepting a fixed set of values, so downstream cannot be surprised.