--- title: AI Guardrails: Why AI Prompts Don’t Scale Against Fraud source_page: https://www.sardine.ai/media/fraudology/episodes/ai-guardrails canonical: https://www.sardine.ai/media/fraudology/episodes/ai-guardrails format: text/markdown date: 2026-11-12T13:01:00.000Z description: AI guardrails belong in code and not prompts. Why AI decisions need limits, how governance works after deployment, and why abuse fighting is not just blocking… --- **Quick links:** [Human page](https://www.sardine.ai/media/fraudology/episodes/ai-guardrails) · [Home](https://www.sardine.ai) · [Customers](https://www.sardine.ai/customers) · [Blog](https://www.sardine.ai/blog) · [Demo](https://www.sardine.ai/demo) --- # AI Guardrails: Why AI Prompts Don’t Scale Against Fraud **Published:** 2026-11-12T13:01:00.000Z AI guardrails belong in code and not prompts. Why AI decisions need limits, how governance works after deployment, and why abuse fighting is not just blocking… Welcome back to Fraudology. Assaf Kipnis first joined me back in 2023, just after he left Facebook, for a two part conversation on how bad actors use social media platforms. Since then he has worked at Google and an AI startup, started his own consultancy, and spent most of his time building with AI. He now spends about 90% of his working day on AI builds, and that makes him the right person to ask a question I keep hearing from fraud leaders. How do we use AI without losing control of it? We talk about AI guardrails, and why Assaf believes they have to be enforced in code. We also talk about why abuse fighting is not the same as blocking, what happens to a fraud team when leadership expects AI to replace it, and why AI governance is far harder when you start after deployment. Along the way, Assaf shares how he builds investigation tools, why he treats AI like a threat actor, and why he thinks you cannot run a business with a chatbot. What you’ll hear in this episode: Why AI changes the speed of fraud more than the tactics, and what that means for defenders who also have to keep doing their jobs. Why abuse fighting is not blocking, and why leaders who see it that way expect AI to remove the team. How AI scales fraud analysts, from running several investigations at once to turning a multi day report into a quick review. Why fraud teams lose knowledge when people leave, and how an AI knowledge base can keep what they learned. Why AI never says I don’t know, and why a chatbot is not the same as a search engine Why bad decisions matter more than hallucinations, and why you cannot trust AI output without bounds. How deterministic code, and not prompts, keeps a nondeterministic AI inside the lines, including a warning about spreadsheets. Why AI governance after deployment is hard, from AI agent sprawl to defining account takeover consistently. Why black box decisions fail when legal, courts, or law enforcement ask for proof. You should listen to this episode if you: Lead or work on a fraud team and are being asked to use AI for part of your job Worry that leadership expects AI to replace your fraud team, or are the leader weighing that choice Are building AI agents for fraud investigations and want to know where guardrails belong Need to explain AI governance to legal, compliance, or an executive team Want a practical reason to write guardrails in code and not in a prompt ### Episode notes AI changes the speed of fraud and not the tactic Assaf has spent 13 years in security, trust and safety, and fraud. What the largest companies taught him is scale. They are the first guinea pig for every threat actor, which shows you what works at scale and what breaks a year later when one change cascades into another. He sees the same pattern when leaders fix the problem in front of them because it is the one they can measure today. On the attacker side, he says industrialization began around 2019 and 2020. AI mostly adds scale. Attackers can build tools faster, sell them, and copy each other’s playbooks. Defenders have the same freedom to innovate, but they have to keep doing their jobs while they do it. AI changes the speed of fraud, and not the tactic. Abuse fighting is not blocking Assaf made a case I will remember. Abuse fighting is not blocking. Blocking is easy and measurable, and when a team sees its job as blocking, leadership starts to see it that way too. Ask leaders what AI can do, and the first answer is to remove menial work. If blocking is the job, they reduce it. I hear the same from companies that told every department to use AI for 25% of its work or cut human hours. Some of those companies are now paying token costs and asking teams to pull back. AI headcount reduction is the easiest pitch to a CFO, Assaf says, and it is the wrong goal. AI scales fraud analysts. A report that took days now takes a quick review, and six analysts who each run several investigations never run out of work. Blocking needs finding, and finding needs people. Zombies, knowledge, and the people who hold it I shared an analogy many fraud fighters have heard from me. Fraud is not a dragon you slay once. It is more like zombies that come back bigger and adapted to your last defense. Assaf adds every failure to his own toolbox. That works for one person, and a company needs a shared way to do it. He described sitting in a room and hearing a colleague say they worked on the same username five years ago. That is the knowledge fraud teams lose when people leave or when AI replaces them. A living AI knowledge base can hold what the team learned. I raised a concern I hear from fraud leaders, which is that employees fear sharing what they know will make them replaceable. Assaf says hoarding knowledge is not a new problem and it is a cultural one. Companies hire for judgment more than knowledge, and judgment is what finds the next attack. Why AI never says I don’t know Assaf noticed that people think AI thinks the way a person does. A person who runs into a closed door learns from it. AI may run into that door again, because context for AI is flat data. I added something I have learned. AI never says I don’t know. A friend and I once asked an AI tool about fraud tactics we made up, and it gave us confident definitions. Assaf explained that a chatbot is not a search engine. He doesn’t ask it to tell him about a topic. He asks it to go research and find articles by experts, and sometimes it comes back empty. I worry about the sources, because much of what fraud fighters know lives in their heads, and much of what is public comes from vendor posts that end in a pitch. A company that fires a fraud manager and asks a chatbot instead will get answers it cannot test. Bad decisions, not hallucinations, and why code sets the limits Assaf says the real problem is not hallucination. It is a decision the model made with the context it had, and he says it would not reach the same conclusion he would about half the time. AI output is nondeterministic. It is probabilistic, and it can’t be consistent. Can you trust AI output? Not on its own. His answer is to bound it with code. If you want a yes or no, ask code, and let AI write the code. He also warns about spreadsheets. Give AI a stack of them, and it can make decisions you can’t see that corrupt your data. Have code parse them into documentation first. He builds guardrails for fraud investigations into his own harness, and if the AI tries to delete something, the code says no. That is why he treats AI like a threat actor. It needs limits, and they have to be enforced in code and not by skills or prompts. As he put it, you cannot run a business with a chatbot. AI governance after deployment I asked what he would tell teams who came to our AI boot camp at the Merchant Fraud Alliance worried about AI governance. His advice is the same. Have guardrails and guidelines enforced in code. Companies bring in AI, tell everyone to use their credits, and build things nobody reviewed, which he calls a software engineer’s worst nightmare. Governance takes time because the model is an adversary that tries to get around you. You build the wall, and it goes under. Starting AI governance after deployment is possible, and it is a lot of work. One merchant described AI agent sprawl, with around 27 agents that each found account takeover differently. How do you define it consistently? Assaf added that legal discovery could ask which of the 27 is right. Black box decisions don’t hold up when you have to show proof to legal, a court, or law enforcement. Ask why every time AI fails Assaf closed with advice I plan to borrow. When AI fails, do not say fix it and move on. Ask why it happened and run a root cause analysis. I pointed out that AI doesn’t necessarily learn from yesterday’s mistake the way we do. Assaf agreed that it doesn’t feel the pain. The lesson has to come from the person and be written into the code. ### Key takeaways Fraud leaders should keep people in the loop when they adopt AI, because AI changes the speed of fraud more than the tactics. Abuse fighting is not blocking, and a team that sees its job as blocking invites leaders to replace it with AI. AI scales fraud analysts when it handles tedious work such as report writing, and analysts can then run more investigations. Replacing fraud teams with AI loses institutional knowledge, which a living AI knowledge base can only partly keep. Judgment is what companies hire for, and judgment is what finds the next attack. AI never says I don’t know. Research prompts, expert sources, and testable answers matter more than a quick chatbot reply. Bad decisions matter more than hallucinations, and AI output cannot be trusted without bounds. AI guardrails belong in code and not in prompts or skills, and deterministic code should handle yes or no decisions. AI governance is much harder after deployment, and it has to cover AI agent sprawl and one clear definition of events such as account takeover. Black box decisions will not stand up when legal, a court, or law enforcement asks for proof. ### Final takeaway If you take one idea from this episode, let it be that AI guardrails are a design choice and not a policy memo. A prompt asks the model to behave. Code makes it. Assaf’s habit of asking why every time something fails is a good place to start, and it works well beyond AI. Build the walls early, expect the model to look for a way under them, and keep the people whose judgment tells you where to build next. Episode resources & links Connect with Assaf Kipnis | LinkedIn Owner and Head Consultant/Advisor at ASK Consulting Connect with Karisse Hendrick | LinkedIn Host of the Fraudology Podcast Award-Winning Cyberfraud Expert Ecommerce Fraud Prevention Consultant Startup Advisor, Keynote Speaker, and Consultant to Fortune 500 merchants