Top 10 AI guardrails tools in 2026, ranked by where they enforce

AI guardrails are the checks that sit between a user, a language model and the tools it can call, deciding whether each prompt, response or tool call is allowed, blocked, redacted or flagged for review. By October 2026 the category has split into four kinds of product that are easy to confuse: gateways that enforce policy on every request in transit, libraries that wrap the LLM call inside one application, open classifier models that return a safety label, and cloud provider APIs that sell checks by the character or token.

The split matters more than any feature list, because the place a guardrail runs decides what it can see, which teams have to deploy it and whether an application can route around it. A content filter that only one team has wired into its chatbot does nothing for the coding agent next door. A classifier with excellent recall still needs something to call it and act on its answer.

This ranking compares ten LLM guardrails tools on that basis, for platform and security teams that have to put one policy across many applications and agents. Every capability, latency figure and price below comes from the vendor’s own documentation or model card, read between 12 and 15 October 2026. GenAI Brief did not benchmark these tools; where a vendor does not publish a figure, the tables say “Not published”.

What AI guardrails are, and the four places they run

A guardrail is a policy check with an action attached. The check might be a regular expression, a small classifier, a large judge model or a managed API; the action is to allow, block, redact, rewrite or log. Most products check two moments, the input before it reaches the model and the output before it reaches the user, and the better ones now add a third: the tool call an agent is about to make.

The OWASP Top 10 for LLM applications gives the security case. Its first entry, prompt injection, covers both direct attacks typed by a user and indirect attacks hidden in web pages, files or retrieved documents, and it lists input and output filtering as one of the mitigations. Content safety, personal data and leaked credentials are the other everyday reasons teams add guardrails, usually because a compliance or legal review asked for them.

Where the check runs falls into four patterns:

• Gateway. A proxy between every application and every model provider applies the same rules to all traffic. The platform team owns the policy, and applications cannot skip it if the gateway holds the provider keys. Readers new to the idea can start with the site’s explainer on what an AI gateway is.
• In-app library. A Python package wraps the LLM call inside one application. It sees the most context, such as dialog state, retrieved chunks and the expected output schema, but each team has to adopt it separately.
• Classifier model. An open-weight model such as Llama Guard returns a label. It is a component, not an enforcement point: an application or gateway has to call it and act on the result.
• Cloud provider service. Amazon, Microsoft and Google each sell a managed guardrail API with a broad policy menu. Like a classifier, it needs a caller, although each cloud also wires it into its own model platform.

Figure 1: The enforcement point decides what a guardrail can see and who can route around it. Classifiers and cloud APIs are strongest when a gateway or library calls them.

The four patterns are complements more often than alternatives. The most common production design in vendor documentation is a gateway or library that calls one or more classifiers and cloud APIs, with cheap local checks first and expensive model-based checks second.

How this ranking was built

The ranking weights enforcement and coverage most heavily, because the most common failure in practice is not a weak classifier but a guardrail that only covers some of the traffic. Detection quality is weighted lower than one might expect, for a practical reason: most vendors publish no comparable accuracy figures, and the ones that do test on their own datasets.

The criteria favour tools that act as an enforcement point and can combine several detectors, which is why a gateway ranks first and the classifier models rank mid-table despite strong published numbers. A reader who only needs a classifier for one application should read the ranking with that in mind and jump to the recommendations at the end.

The ten AI guardrails tools at a glance

1. Bifrost

Bifrost is an open-source AI gateway written in Go, published by Maxim AI, with its code in the maximhq/bifrost repository. It ranks first because it is the only tool in this list that combines a self-hosted enforcement point, its own local detectors, and a menu of twelve external guardrail providers that includes three other entries in this ranking. It also gets the longest write-up here for that reason: its documentation covers every criterion in the table above.

What it checks. The guardrails documentation separates rules from profiles. A rule is a policy written in CEL (Common Expression Language) that decides when to check, for example only for one team, one virtual key or one model, and whether to check the input, the output or both. A profile is a configured detector. Three are managed by Bifrost itself: Secrets Detection, which runs the 222 default rules from Gitleaks v8.30.1 locally to catch API keys, tokens and private keys; Custom Regex, a local RE2 engine with a built-in PII template; and Prompt Guardrails, which sends text and a natural-language policy to a configured judge model that returns allow or block. External profiles cover Microsoft Presidio, Azure AI Language PII, AWS Bedrock Guardrails, Azure Content Safety, Google Model Armor, CrowdStrike AIDR, Gray Swan Cygnal, Patronus AI, Check Point’s AI Agent Security, Repello Argus, Singulr AI and A10 Guardrails.

Rules have two targets. The llm target checks prompts before they reach a provider and responses after. The mcp target checks the arguments of an MCP tool call before the tool executes and the result before it returns to the agent, which is the boundary that matters most for guardrails for AI agents. A rule matching mcp_client == "github" && mcp_tool == "create_issue" can block a GitHub issue before it is filed, rather than after the model has already proposed it.

Actions. Profiles can detect, block or redact, depending on the provider. Redaction has three modes: runtime, which rewrites the live request; logs only, which lets the call proceed but keeps raw secrets out of Bifrost’s logs and exported traces; and runtime reversible, which replaces values with numbered placeholders such as [EMAIL-1] that a user with reveal permission can restore in Bifrost’s logs. A blocked request returns HTTP 446 with a guardrail_violation error naming the guardrail and stage.

Latency and cost. Bifrost’s published benchmark reports 11 µs of added overhead per request at 5,000 RPS on an AWS t3.xlarge, according to its benchmarking documentation. Guardrail checks add whatever the chosen detector costs on top: local secrets and regex profiles carry no external charge, while external profiles and the judge model add their own round trip and price. The docs recommend putting a cheap local profile first in a rule’s execution order, so obvious cases are blocked or redacted before a request is sent to an external service, and offer per-rule sampling rates and timeouts for high-traffic routes. When a rule links several profiles, a block stops the chain, and a provider error or timeout is reported while the next profile still runs.

For streamed responses, detect-only rules observe the stream without delaying it, runtime redaction releases safe text in buffered segments, and a rule that can block holds the stream until the check finishes. The same guardrail profiles also apply to traffic from employee machines routed through Bifrost Edge, according to the Edge security page. A fuller walkthrough of the product’s approach is on its AI guardrails page.

Best for: platform teams that need one guardrail policy across many applications, model providers and MCP-connected agents, and want to choose which cloud or specialist detectors sit behind it.

Enterprise tier. Guardrails, along with SSO, RBAC, audit logs and clustering, are part of Bifrost Enterprise; the open-source gateway covers routing, failover, budgets and MCP.

2. Amazon Bedrock Guardrails

Amazon Bedrock Guardrails has the broadest managed policy menu of the three cloud services. It ranks second because its ApplyGuardrail API works without invoking a Bedrock model, which means any gateway or application can use it on traffic to any provider.

What it checks. Six safeguards: content filters for hate, insults, sexual content, violence, misconduct and prompt attacks, with a configurable strength per category; denied topics described in natural language; word filters; sensitive information filters that block or mask PII by probabilistic detection or custom regex; contextual grounding checks that flag RAG answers not supported by the retrieved source; and Automated Reasoning checks that validate responses against a set of logical rules. The Standard tier extends content and topic detection into code, including comments, variable names and string literals. AWS notes the checks exclude reasoning content blocks.

Latency and cost. AWS publishes no latency figure. Pricing is per filter used, per text unit of up to 1,000 characters, so a 5,600-character input counts as six units. As of October 2026 the Bedrock pricing page lists content filters and denied topics at $0.15 per 1,000 text units, sensitive information filters at $0.10, contextual grounding at $0.10 and Automated Reasoning at $0.17 per policy, with word filters and regex-based sensitive information filters free. Image content filtering is $0.00075 per image. A newer InvokeGuardrailChecks API prices content filters at $0.07 and a standalone prompt attack filter at $0.08 per 1,000 text units.

Best for: teams on AWS that want a single managed service for harm, PII, topic and grounding checks, and teams that need contextual grounding or Automated Reasoning, which few alternatives offer.

Limitation: charges stack per filter and per 1,000 characters, so long RAG contexts and full conversation histories become the main cost driver; checking only the user turn, which Bedrock supports through input tagging in the SDK, keeps it down.

3. Azure AI Content Safety

Azure AI Content Safety is Microsoft’s guardrail service, and it ranks third because it takes indirect prompt injection more seriously than any other cloud API in this list.

What it checks. The text and image analysis APIs score sexual content, violence, hate and self-harm at multiple severity levels. Prompt Shields detects two attack types: user prompt attacks that try to bypass system instructions, and document attacks, meaning instructions hidden in emails, web pages or files. For agents, Prompt Shields can also scan tool responses for document attacks, in preview. Groundedness detection (preview) checks answers against supplied sources, protected material detection flags known text such as lyrics or articles, and a Task Adherence API flags tool use by agents that is “misaligned, unintended, or premature”.

Latency and cost. Microsoft publishes rate limits rather than latency: the S0 tier allows 1,000 requests per 10 seconds for the moderation APIs and Prompt Shields, and 50 requests per second for groundedness. Billing is per text record of up to 1,000 characters, and the free tier includes 5,000 text records a month, per the pricing page. The standard-tier rate was not rendered on the public page when we checked, so confirm it in the Azure pricing calculator.

Best for: applications and agents that read untrusted documents, email or web content, where document-attack detection is the check that matters.

Limitation: language coverage is uneven. Groundedness, protected material and custom categories work in English only, and Microsoft says the Prompt Shields models are primarily trained and evaluated on English, so performance on other languages needs testing.

4. NVIDIA NeMo Guardrails

NeMo Guardrails is the most capable open-source in-app library, an Apache 2.0 Python package at version 0.24.1 in its repository, supporting Python 3.10 to 3.13. The name accounts for much of the search interest in “nemo guardrails”, and the product justifies it.

What it checks. NeMo organises checks into five rail types: input rails on the user’s message, dialog rails that steer how the model is prompted, retrieval rails on RAG chunks, execution rails on tool and action calls, and output rails on the response. Rails are configured in YAML and Colang, NVIDIA’s flow language, which comes in versions 1.0 (the default) and 2.0. Built-in and integrated checks include NVIDIA’s NemoGuard models for content safety (Llama 3.1 NemoGuard 8B), topic control and jailbreak detection, Llama Guard, LLM self-checks for facts and hallucination, PII detection through GLiNER-PII, Presidio and others, and Guardrails AI validators. A LangGraph integration covers agent tool calls.

Latency and cost. The library is free; the cost is in the models it calls. Self-check rails use an LLM call each, and the NemoGuard checks run as separate models, so latency depends on which rails are enabled and where the models are hosted. NVIDIA does not publish an end-to-end figure on its overview page. The same configuration runs as a library in-process or as a microservice on Kubernetes with Helm.

Best for: conversational applications that need to control the shape of the dialog, keep the assistant on topic and check retrieved content, with a team willing to learn Colang.

Limitation: it protects the application that adopts it. Other apps, agents and scripts calling the same providers are not covered unless each integrates the library or routes through the microservice, which is why many teams pair it with a gateway.

5. Google Model Armor

Model Armor is Google Cloud’s guardrail service. Google states it can protect AI deployed “in Google Cloud or other cloud providers”, which puts it alongside Bedrock Guardrails as a cloud API usable from anywhere.

What it checks. Prompt injection and jailbreak detection, responsible AI filters for sexually explicit, dangerous, harassment and hate content, CSAM detection, malicious URL detection and Sensitive Data Protection for PII and intellectual property. It can screen documents, including PDFs and CSV files, for the same risks. Confidence thresholds are set per category (high, medium and above, low and above), and floor settings let a security team enforce minimum filters across projects. Google recommends separate templates for prompts and responses because they carry different risks.

Latency and cost. Google publishes token limits per filter but no latency figure. Pricing is per token, defined as four characters excluding white space. Standalone use is free up to 2 million tokens a month and $0.10 per million tokens after that; Security Command Center Enterprise and Premium subscriptions include 3 billion tokens a month, according to the pricing page. Sensitive Data Protection inside Model Armor carries no extra charge.

Best for: Google Cloud organisations, and teams that want document screening and malicious URL checks in the same call as injection detection.

Limitation: its controls are configured in Google Cloud projects and IAM, so teams outside Google Cloud take on a second cloud’s identity and logging model to use it directly; calling it from a gateway profile avoids putting that in every application.

6. Meta Llama Guard 4 and Prompt Guard 2

Meta’s two open classifiers are the default building blocks for self-hosted guardrails, and between them they account for the search volume on “llama guard”. They rank sixth because each is a component that needs a caller, but their published numbers are among the most transparent in the category.

What they check. Llama Guard 4 is a 12-billion-parameter dense model pruned from Llama 4 Scout that classifies prompts and responses, including prompts with multiple images, against 14 hazard categories from S1 (violent crimes) to S14 (code interpreter abuse, text only). It covers English plus French, German, Hindi, Italian, Portuguese, Spanish and Thai, and runs on a single GPU. Prompt Guard 2 is a much smaller binary classifier, 86 million or 22 million parameters, that labels input benign or malicious, where malicious covers both injection and jailbreak attempts.

Latency and accuracy. Meta reports Prompt Guard 2 at 92.4 ms for the 86M model and 19.3 ms for the 22M model on 512 tokens on an A100, with English recall of 97.5 and 88.7 per cent respectively at a 1 per cent false-positive rate. Llama Guard 4 is a different story: on Meta’s English test set for response filtering it reports 69 per cent recall at an 11 per cent false-positive rate, and 43 per cent recall on its multilingual set. Both use the Llama 4 Community License, which requires companies with more than 700 million monthly active users to request a licence.

Best for: teams that run their own inference and cannot send prompts to a third-party API, and gateways or libraries that need a free classifier to call.

Limitation: a 512-token window means Prompt Guard 2 must scan long inputs in segments, and Meta itself says Llama Guard 4 can be vulnerable to adversarial and prompt-injection attacks and recommends pairing it with Prompt Guard.

7. Guardrails AI

Guardrails AI is an Apache 2.0 Python framework built around input and output “guards” assembled from validators. Its distinctive strength is output validation: a guard can be built from a Pydantic model so the LLM’s answer is checked against a schema.

What it checks. Validators from Guardrails Hub cover risks such as toxic language, competitor mentions, regex matches and PII, and several can be combined in one guard, each with an on_fail action such as raising an exception. A Guardrails Server, started with guardrails start, exposes guards over REST and an OpenAI-compatible endpoint, so an application can point its OpenAI SDK base URL at a guard.

Latency and cost. The framework is free; each validator’s latency depends on whether it is a regex or a model. In July 2026 the project announced that validators are moving to standard PyPI packages and that its hosted remote inferencing would be discontinued, with a planned cutoff of 25 August 2026, so model-based validators now run on infrastructure the user provides.

Best for: Python applications that need structured output validation and a library of composable checks, and NeMo users who want Hub validators inside NeMo rails.

Limitation: like NeMo, it covers the applications that adopt it, and teams that relied on hosted validator inference have migration work to do after the August 2026 change.

8. Cloudflare AI Gateway guardrails

Cloudflare AI Gateway’s Guardrails feature is the simplest gateway-level option for teams already running on Cloudflare, and it is still labelled beta.

What it checks. Prompts and responses are evaluated by Llama Guard 3 8B on Workers AI against categories S1 to S13, and prompt injection (category P1) by Prompt Guard 2 86M. Each category can be set to flag, ignore or block, separately for prompts and responses. A separate Data Loss Prevention feature scans prompts and responses for sensitive data using Cloudflare’s DLP engines.

Latency and cost. Cloudflare’s usage notes say evaluations typically add about 500 ms per request, more for long inputs that are split into chunks, and that usage is billed as Workers AI inference. If a blocking category cannot reach Workers AI the request is blocked; if a flagging category cannot, the request proceeds.

Best for: teams already routing AI traffic through Cloudflare that want harm and injection checks switched on without running anything.

Limitation: Guardrails does not support streaming. On gateway endpoints it buffers the whole response and returns it unstreamed; on the REST API it evaluates and logs a streamed response but does not enforce the result.

9. OpenAI Moderation API

The OpenAI moderation endpoint is the cheapest guardrail in this list: OpenAI states it is free to use. The omni-moderation-latest model classifies text and images up to 20 MB into 13 categories, from harassment and hate through illicit content, self-harm and violence, with a score for each.

What it checks. Harm categories only. Moderation can run standalone or be requested inside a Responses API call, which returns input and output scores alongside the generated text without a second request. The application still decides what to do with the result.

Latency and cost. Free; OpenAI publishes no latency figure.

Best for: a zero-cost first pass on harmful content, in front of any model, for teams that will add injection and PII checks elsewhere.

Limitation: there is no prompt injection, PII or grounding category, it does not classify audio, and OpenAI says it is not designed for CSAM detection.

10. LiteLLM

LiteLLM’s proxy guardrails make it the second self-hosted gateway in this ranking. Guardrails are defined in config.yaml and run in pre_call, during_call (in parallel with the model call), post_call or logging_only mode, and integrations include Presidio, Bedrock Guardrails, Azure Content Safety, Model Armor, Guardrails AI and OpenAI moderation among many others.

Best for: Python-centric teams already running LiteLLM that want to attach a third-party guardrail to the proxy.

Limitation: per-key guardrails, model-level guardrails and tag-based modes are marked as Enterprise features, so the open-source proxy applies guardrails per request or globally rather than per consumer. Teams weighing the two self-hosted gateways can compare them in the site’s LiteLLM alternatives piece.

What actually differs between guardrail layers

The tools above differ less in what they detect than in when they run, what they cost per character and what happens to a streamed response. Those three properties decide whether a guardrail survives contact with production traffic.

Latency budgets

Published figures span three orders of magnitude. Local regex and secrets checks run in-process. Meta’s Prompt Guard 2 22M takes 19.3 ms per 512 tokens on an A100. Cloudflare’s Llama Guard 3 8B check typically adds about 500 ms. An LLM-as-judge check, such as Bifrost’s Prompt Guardrails or NeMo’s self-check rails, adds a full model round trip, which is why Bifrost’s docs tell users to “account for the extra model latency and token cost of each Prompt Guardrails judge call”.

The practical rule is to order checks by cost. Run local secrets and pattern checks on everything, a small injection classifier on user input, and reserve judge models and grounding checks for routes where a wrong answer is expensive.

Cost per character

Cloud guardrails are priced on text volume, and the unit differs by vendor. Bedrock and Azure count 1,000-character units; Google counts four-character tokens. A rough comparison for one million requests of 2,000 characters each, input only, at October 2026 list prices:

These figures are arithmetic on published list prices, not quotes; free tiers, enterprise agreements and the length of conversation history sent with each check change them substantially. Checking full multi-turn histories on every request is the most common way teams multiply the bill, which is why Bifrost exposes max_turns_to_send and Bedrock supports tagging only the user turn.

Streaming

Any output check that can block has to see the whole response first, so it turns a streamed answer into a delayed one. Vendors handle this differently. Bifrost holds the stream only when a matched rule can block, and lets detect-only and redact rules pass text through. Cloudflare buffers the full response on its gateway endpoints and does not enforce on its streaming REST API. Teams that care about time to first token often run output checks in flag-and-log mode on low-risk routes and block mode only where harm is likely.

Guardrails for AI agents

Agents change the threat model because the dangerous moment is no longer the text a model writes but the action it takes. An injected instruction in a retrieved web page that makes an agent call delete_branch does its damage at the tool boundary. Three products in this list check that boundary directly: Bifrost’s MCP-target rules inspect tool arguments before execution and results before they return, NeMo Guardrails’ execution rails cover tool calls, and Azure’s Task Adherence API and tool-response Prompt Shields target misaligned or injected tool use. For background on how MCP traffic is brokered, see the site’s MCP gateway explainer.

Figure 2: A layered design runs the cheapest checks first and gives tool calls their own gate, so an injected instruction is stopped at the action, not only at the text.

A worked example shows how the layers divide the work. A support agent reads a customer’s uploaded PDF and can call a refund tool. A local secrets and regex check redacts card numbers in the upload. A document-attack check, Azure Prompt Shields or Model Armor, scans the PDF text for hidden instructions. The model drafts a reply and proposes issue_refund(amount=4800). A tool-call rule matching amounts over a threshold blocks the call and routes it to a person. The output check flags but does not block a borderline phrase, so the reply still streams. No single detector in that chain is decisive; the design is.

What guardrails cannot do

Guardrails reduce risk; they do not remove it, and the vendors say so. The OWASP prompt injection entry states that “it is unclear if there are fool-proof methods of prevention for prompt injection”, and notes that RAG and fine-tuning do not fully mitigate it. Meta’s own Prompt Guard 2 card warns that adaptive attacks designed to evade the classifier can succeed. The site’s companion piece on prompt injection examples and defences covers the attack side in detail.

Accuracy figures, where published, are sobering. A 69 per cent recall at 11 per cent false positives, Meta’s English figure for Llama Guard 4, means roughly three in ten unsafe responses pass and about one in nine safe ones is flagged on that test set. Google’s own guidance warns that the most sensitive Model Armor threshold “can cause a high volume of false positives”. False positives are not free: every wrongly blocked request is a support ticket or an abandoned session.

Three further limits are structural rather than statistical:

• Coverage gaps. A guardrail only protects traffic that passes through it. Applications that call providers directly, and employees pasting data into consumer chat apps, bypass in-app libraries entirely. That is the case for enforcement at a gateway, and for extending it to endpoints, which the site’s piece on shadow AI governance examines.
• Availability trade-offs. Every external check is a dependency. Products differ on whether they fail open or closed when a detector is unreachable, and teams should know which behaviour they have configured for each rule.
• Language and modality. Most published accuracy is for English text. Azure, Meta and Cloudflare all document narrower coverage for other languages, and image coverage varies from full (Bedrock content filters, Llama Guard 4) to none.

The conclusion is not that guardrails are weak, but that they are one control among several. Least-privilege tool permissions, human approval for irreversible actions, per-consumer budgets and full request logs do work that no classifier can.

How to choose AI guardrails for your stack

Start from the constraint you cannot change, then layer. Most teams end up with a gateway as the enforcement point, one cloud API or open classifier behind it, and a library inside the one or two applications that need dialog or schema control.

Figure 3: The enforcement point comes from your architecture; the detectors behind it come from your cloud and data constraints.

• You run many applications and agents across several providers. Put the policy at a gateway. Bifrost is the strongest option because it chains local, judge-based and twelve external detectors per rule and checks MCP tool calls; the site’s ranking of AI gateways compares the wider field.
• You are standardised on AWS. Use Bedrock Guardrails, through ApplyGuardrail or a gateway profile, and keep text volume down by checking only the user turn.
• Your agents read untrusted documents, email or web pages. Prioritise document-attack detection: Azure Prompt Shields or Model Armor, plus a tool-call gate.
• Prompts cannot leave your network. Self-host Prompt Guard 2 for injection and Llama Guard 4 for harm categories, and call them from a gateway or NeMo Guardrails.
• You have one conversational application with strict topic rules. NeMo Guardrails’ dialog and topic rails are built for this; Guardrails AI suits schema-heavy output.
• You need something today at zero cost. OpenAI’s moderation endpoint covers harm categories for free; add a regex and secrets check and you have a credible first layer.

The question to ask any vendor is not “how accurate is your classifier” but “which of our traffic does it see, and what happens when it is unavailable”. A guardrail that covers every request with a mediocre detector usually beats an excellent detector that covers one app. We think the gateway-first pattern, with cloud and open classifiers plugged in behind it, is where most production teams will settle in 2026, because it is the only design in which adding a better detector next year is a configuration change rather than a migration.