AI guardrails: what they are, how they work and which to use

MITRE ATLAS, the knowledge base of attacks on AI systems, describes guardrails as safety controls that sit between users, tools and generative AI models. They inspect prompts, retrieved context, model outputs and agent actions, and can block, change or reroute anything unwanted, such as malicious instructions, sensitive data, unsupported claims or unsafe tool requests, before it is executed or shown to a user ^[1].

Guardrails can be rule-based (filters, allow and block lists, regular expressions, schema validation, permission checks) or AI-based (classifiers, LLM judges, entity recognition and groundedness checks), and ATLAS says they should be evaluated, red-teamed and updated continuously, with their decisions logged ^[1]. ATLAS treats them as separate from two other controls: instructions in the system prompt (AML.M0021) and alignment through training or fine-tuning (AML.M0022). In our reading, guardrails are the runtime layer around the model rather than a change to it.

Agents raise the stakes because they act: they call tools, read untrusted content and chain steps without a human in between. OWASP published a separate Top 10 for Agentic Applications in December 2025, led by agent goal hijack and tool misuse ^[12][13]. MITRE ATLAS adds agent-specific mitigations alongside guardrails ^[1][65]:

• Human approval for high-impact actions (AML.M0029, Human In-the-Loop for AI Agent Actions).
• Restricted tool calls when untrusted data is in the context (AML.M0030, Restrict AI Agent Tool Invocation on Untrusted Data).
• Validation of every input and output between agent components (AML.M0033).
• Limits on agents expanding their own authority, and detection of scope drift (AML.M0037 and AML.M0038).

In products, this shows up as execution rails that check tool calls, checks for goal hijacking in an agent’s reasoning (Meta’s LlamaFirewall AlignmentCheck), and gateways that sit between agents and the MCP servers they use ^[3][22][63]. Palo Alto Networks made its AI gateway for LLM, MCP and agent-to-agent traffic generally available in July 2026, built on its Portkey acquisition ^[43][44].

• They don’t stop every attack. OWASP says it is unclear whether fool-proof methods of preventing prompt injection exist, and recommends filtering alongside least privilege and output validation ^[7]. Design the system so that a fooled model can’t do serious damage.
• They add latency. NVIDIA notes that each call to its NemoGuard guard models adds to inference time, and that output checks grow with response length ^[4]. Meta measured 92.4 ms per check for Llama Prompt Guard 2 (86M) and 19.3 ms for the smaller 22M model on an A100 GPU ^[21]. Vendor latency figures, such as Lakera’s sub-50 ms, are the vendors’ own ^[39].
• They block legitimate requests. A peer-reviewed study (NotInject, ACL 2025) found state-of-the-art prompt guards fell close to random guessing, around 60% accuracy, on harmless inputs containing trigger words ^[55]. Vendor false-positive claims vary even for one product: lakera.ai cites 0.01% ^[39], while Check Point’s acquisition announcement said below 0.5% ^[37].
• They have coverage gaps. Azure says Prompt Shields are trained and evaluated mainly on English ^[27]; Prompt Guard 2 reads 512 tokens at a time, so longer inputs must be split ^[21]; Bedrock’s Classic tier supports only English, French and Spanish ^[32].
• They can fail open. Some integrations let traffic through when the guard fails; NeMo’s CrowdStrike integration runs fail-open, while NeMo’s own streaming rails changed to fail closed in version 0.24 ^[5][3]. Ask every vendor which mode it uses.

We found no independent, current and reproducible benchmark of commercial guardrail products. The most cited, Lakera’s PINT benchmark, is run by Lakera (now Check Point), which ranks its own product first, and part of its dataset is private ^[54]. Academic benchmarks such as GuardBench and AgentDojo evaluate guard models and agent defenses, not commercial APIs ^[56][57]. Test candidates on your own traffic.

1. False positives on your traffic: run a week of real, harmless prompts through each candidate and count the blocks.
2. Detection on your threats: test direct and indirect prompt injection, including attacks hidden in documents and tool output.
3. Latency at your volume: measure the added time per request at peak load, not the vendor’s average.
4. Languages and length: check the languages you serve and the maximum input each check reads.
5. Agents and tools: confirm it can check tool calls and MCP traffic, not only chat text.
6. Failure mode: ask whether it fails open or closed when the guard is unavailable.
7. Logs and evidence: make sure every decision is logged for incident response and audits.
8. Ownership and roadmap: check who owns the product today and whether it is sold standalone.

We weighed documented coverage across input, output and agent rails, deployment options, transparency (public documentation, prices and evaluations), whether the product is maintained under a clear owner, and the cost to start. We did not run hands-on tests, and no vendor paid to be listed.

• Amazon Bedrock GuardrailsCloud

  The broadest documented policy set among the cloud services, including prompt attacks, PII, denied topics, contextual grounding and Automated Reasoning checks, with public per-unit prices. Its ApplyGuardrail API checks any text without calling a Bedrock model.^[31][33][34]

• NVIDIA NeMo GuardrailsOpen source

  The most complete open-source orchestration layer: all five rail types, including retrieval and tool rails, 20+ community and third-party integrations, and regular releases.^[3]

• Palo Alto Networks Prisma AIRSCommercial platformOur review →

  The widest commercial scope: an AI gateway for LLM, MCP and agent-to-agent traffic, network and API intercept, red teaming and model scanning. Includes the former Protect AI and Portkey. Best for existing Palo Alto customers.^{[41][42][43][44]}

• Azure AI Content Safety: Prompt ShieldsCloud

  Separates direct prompt attacks from attacks hidden in documents, with public pricing and a capped free tier. The natural choice on Azure, but trained and evaluated mainly on English.^[27][29]

• Google Cloud Model ArmorCloud

  The lowest metered list price of the three cloud services, with floor settings that set minimum protections for templates, and Google says it works whether you deploy AI on Google Cloud or another cloud.^[35][36]

• Meta Llama Guard 4, Prompt Guard 2 and LlamaFirewallOpen weights

  Free, self-hosted classifiers: Prompt Guard 2 (22M) takes about 19 ms per check on an A100, and LlamaFirewall (MIT) adds checks for agent goal hijacking. The Llama Community License applies to the models.^[20][21][22]

• Cisco AI DefenseNetworkOur review →

  For Cisco customers: runtime guardrails enforced at the network level, plus algorithmic red teaming; Cisco says Robust Intelligence was foundational to it.^[49][66]

Directory vendors with documented guardrail products. Their profiles show ownership changes as they happen.

1. 01

   Lakera

   Best for: A dedicated prompt-injection and data-leakage API

   Now part of Check Point Software Technologies

   Now Check Point AI Agent Security, after Check Point’s acquisition (announced September 2025). It covers prompt injection, data leakage and MCP, in 100+ languages, with vendor-stated latency under 50 ms; contracts are now with Check Point.^[37][39]

   Lakera profile →

2. 02

   F5 AI Guardrails

   Best for: Regulated, government and air-gapped deployments

   F5’s guardrails product, launched alongside F5 AI Red Team when F5 completed its acquisition of CalypsoAI on 26 September 2025 (reported at $180 million; F5’s 10-Q records $145.2 million in cash). Model-agnostic, with documented on-premises and air-gapped deployment and natural-language custom policies; NeMo Guardrails can call it as an input and output rail.^{[45][46][47][67][68]}

   F5 AI Guardrails profile →

3. 03

   Lasso Security

   Best for: Inline enforcement at a proxy, API or AI gateway

   Enforces policy inline at the proxy, API or AI gateway layer, covering prompt injection and MCP. Its accuracy and latency figures (under 50 ms per check) are vendor claims without published methodology.^[58]

   Lasso Security profile →

4. 04

   Fiddler AI

   Best for: Teams that want guardrails and observability together

   Fiddler Guardrails, powered by its Centor models, cover PII and secrets, prompt injection and jailbreaks, hallucination and toxicity, with vendor-stated latency under 80 ms. The Free plan includes guardrails; Developer is $0.002 per trace.^[59]

   Fiddler AI profile →

5. 05

   Pillar Security

   Best for: Self-hosted runtime protection in your own VPC

   Runtime protection against prompt injection and data leaks, masking of personal data and secrets, and MCP and tool security, deployable in the cloud, self-hosted or in your own VPC.^[60]

   Pillar Security profile →

6. 06

   Knostic

   Best for: Coding agents such as Cursor and Claude Code

   Its Kirin product runs beside coding agents, including Cursor, Claude Code, GitHub Copilot and Windsurf, and blocks prompt injections and rogue agent actions in real time.^[61]

   Knostic profile →

• AI red team tools →Test before you deploy: the tools ranked.
• LLM observability →Trace and monitor what your guardrails let through.
• Shadow AI →Find and control the AI tools staff use without approval.
• EU AI Act →Article 15 robustness and cybersecurity duties.