Best AI Guardrails in 2026: NeMo, Guardrails AI, Lakera and Bedrock
Once an AI feature takes input from strangers, or an agent reads web pages and emails, someone will try to make it misbehave. We compare two open-source guardrail frameworks, NVIDIA NeMo Guardrails and Guardrails AI, with two hosted services, Lakera Guard and Amazon Bedrock Guardrails: what each catches, where it sits in your app, and what a million messages a month costs.
First: what are you guarding against?
A model follows instructions, and it cannot reliably tell yours from an attacker's. For a chatbot that means jailbreaks and embarrassing answers. For an agent with tools, it means a hidden line in an email or web page can tell it to forward data or delete records, and it may comply.
Agents also pull in tools from MCP servers. Security researchers have shown attacks where a server changes a tool's description after you approved it, sometimes called a "rug pull", so the poisoned version runs in every later session.
Prompt injection and jailbreaks
Direct attacks typed by a user, and indirect ones hidden in documents, web pages, emails or tool results the model reads.
Personal and secret data
Customers pasting card numbers into a prompt, or the model repeating an email address, key or record it should not.
Harmful or off-brand answers
Hate, violence, medical or legal advice you are not licensed to give, competitor recommendations, or topics your product should not touch.
Unsafe tool calls
An agent calling a tool with arguments it should not, or acting on instructions that arrived inside a tool's result.
What guardrails do not do: they reduce risk, they do not remove it. AWS describes its own service as blocking "up to 88%" of harmful content, which is a useful reminder of the ceiling. The defence that does not depend on detection is limiting what a successful attack could do: narrow tool permissions, credentials kept away from the model (our agent auth guide covers that), and a human confirming anything irreversible.
Do you need this yet? If only your own team uses the feature and it cannot take actions, your model provider's built-in safety may be enough for now. You need guardrails once the public can type into it, it handles personal data, or an agent can act.
Quick Verdict
Open-source framework for programmable rails on input, output, dialog flow, retrieval and tool execution, written in the Colang policy language.
Open-source Python framework of composable validators that block, fix or re-ask, plus structured output from a Pydantic model. Acquired by Harvey in September 2026.
Hosted API focused on prompt injection and jailbreaks, including attacks that arrive through MCP-connected tools. Claims under 50 ms and 100+ languages. Part of Check Point.
Amazon Bedrock GuardrailsAWS policies for content, prompt attacks, denied topics, personal data and grounding, usable with any model through the ApplyGuardrail API. Published per-use pricing.
TL;DR
No single winner, and they stack. Your own rules over dialog and tool calls, self-hosted → NeMo Guardrails. Validators and guaranteed output format in Python → Guardrails AI. A dedicated prompt-injection detector you just call → Lakera Guard. Published prices and one policy across every model, on AWS → Bedrock Guardrails. A common setup is one hosted screen plus one framework for your own rules.
The question that decides it: detect, validate, or govern?
"Guardrails" covers three different jobs. The four tools here each lead on one, and knowing which job you have narrows the choice quickly.
1. Detect: a classifier you call (Lakera Guard, Bedrock Guardrails)
Send the text, get back a verdict: attack or not, harmful or not, personal data found. Fast and simple to add, maintained by a vendor who tracks new attacks. You do not control the model behind the verdict, and on SaaS the text leaves your infrastructure.
2. Validate: checks you compose (Guardrails AI)
A chain of validators runs on the input or output, each able to block, fix or ask the model to try again. The same machinery makes the model return valid JSON for your schema. Strong on output quality and format, lighter on attack detection.
3. Govern: policies over the whole flow (NeMo Guardrails)
Rules that decide what the conversation may do next and what tools may run with which inputs, not just whether one message is bad. The most control, and the most to write and test.
A quick test: if your worry is "someone will trick it", start with detection. If it is "it will say or return the wrong thing", start with validation. If it is "the agent will do something it should not", you need governance over tool calls.
The four, in detail
Features, licences and prices as published on each vendor's site or repository in October 2026.
NeMo Guardrails
NVIDIA's open-source programmable guardrails
$0 (Apache-2.0)
You pay for hosting and any model calls the rails make
- Five rail types: input, dialog, retrieval, execution (tool calls) and output
- Policies in Colang, a Python-like modeling language (1.0 default, 2.0 supported)
- Built-in jailbreak and injection detection, self-check moderation and hallucination rails
- NVIDIA content-safety and topic-safety models; third-party services such as ActiveFence
- Python library or a guardrails server (Docker); works with LangChain
- Latest release 0.24.1 (September 2026); about 7.3K GitHub stars
- CaveatColang is another language for the team to learn and test. Rails that ask an LLM to self-check add a model call, with its latency and cost, to every message. Anonymous usage telemetry is on by default; set NEMO_GUARDRAILS_NO_USAGE_STATS=1 to turn it off.
Best for: Teams that need their own policies over conversations and tool calls, inside their own infrastructure.
Guardrails AI
Open-source validators and structured output
$0 (Apache-2.0)
Guardrails Pro (hosted validation, dashboards) by quote
- Compose a Guard from validators: toxic language, PII, competitor mentions, regex and more
- Each validator can block, fix the output, or re-ask the model
- Structured output from a Pydantic model, using function calling where supported
- Runs in-process or as a REST server with an OpenAI-compatible endpoint
- Validators install as ordinary PyPI packages since August 2026
- Downloaded over 250,000 times a month, per Harvey
- CaveatHarvey acquired Guardrails AI on September 9, 2026 and has not said what happens to the open-source project. Hosted remote inference for validators ended on August 25, 2026, so heavy model-based validators now run on your hardware. It checks text in and out more than it governs tool calls.
Best for: Python teams that need reliable output formats and a set of content checks they can extend.
Lakera Guard
Hosted prompt-injection and AI security API
Free Community · Enterprise by quote
Production pricing is not published
- Detects prompt injection, jailbreaks and adversarial instructions before they reach the model
- Flags sensitive data and harmful output in prompts and responses
- Covers unsafe tool use, including indirect injection through MCP-connected tools
- Claims under 50 ms latency and coverage of 100+ languages
- Detection informed by Gandalf, its public prompt-injection game
- Check Point announced its acquisition in September 2025
- CaveatYou cannot price production use without a sales call. It is a detection API, not a policy engine: it tells you a message looks like an attack, and your code decides what to do. On SaaS, prompts are sent to Lakera.
Best for: Public-facing chat and agents where prompt injection is the main risk and you want a maintained detector.
Bedrock Guardrails
AWS guardrail policies for any model
$0.10–$0.15 per 1K text units
Per policy, charged on input and output; word and regex filters free
- Content filters for hate, violence, sexual content, misconduct and prompt attacks, on text and images
- Denied topics described in plain language; word filters for exact terms
- PII and custom regex masking on inputs and outputs
- Contextual grounding checks against a source to catch invented answers
- Automated Reasoning checks against logical rules ($0.17 per policy)
- ApplyGuardrail API works with OpenAI, Gemini and self-hosted models; org-wide enforcement across AWS accounts
- CaveatNeeds an AWS account and IAM setup even if your models run elsewhere. Each policy is billed separately on input and output, so enabling everything multiplies the bill. AWS states it blocks up to 88% of harmful content.
Best for: Teams on AWS, or anyone who wants predictable per-use pricing and one policy across several models.
What a million messages costs
Our assumptions: 1 million messages a month, each input and each output under 1,000 characters (one Bedrock text unit each), with attack, content and personal-data checks on both. Bedrock prices are from AWS's October 2026 pricing page. Self-hosted figures are our estimate and exclude anyone's time.
| Option | How it is priced | Monthly cost |
|---|---|---|
| Bedrock Guardrails | Content filter $0.15 + PII $0.10 per 1K units, × 2M units | ~$500 |
| Lakera Guard | Enterprise quote at this volume | Ask for a quote |
| NeMo Guardrails, classifier rails only | Your hosting; a GPU if you run safety models yourself | ~$50–600 |
| NeMo or Guardrails AI, LLM self-check rails | An extra small-model call per message checked | Often more than the above |
The cost that surprises people: "free" open-source guardrails that work by asking a model whether a message is safe add a model call per check. At a million messages, two self-check rails on a small model can cost more than a hosted classifier. Use dedicated classifier models for high-volume checks and keep LLM-judged rails for the cases that need judgement. And check only what matters: screening outputs of a feature that never sees personal data is money spent on nothing.
Feature comparison
Bedrock GuardrailsA cross means the capability is not described in the vendor's documentation, not that it cannot be added with custom code.
If you run agents: four rules that matter more than the tool
Screen what comes back, not just what goes in
Indirect injection arrives in tool results: a web page, an email, a file. Run the same screening on tool outputs before they reach the model.
Pin your MCP tools
Record the tool descriptions you approved and alert when a server changes them. A changed description is the "rug pull" pattern.
Least privilege for every tool
A tool that reads a calendar should not be able to send email. Scope each credential to the one job the tool does.
A human on anything irreversible
Payments, deletions, outbound messages to customers: ask a person to confirm. It is the one guardrail with no false negatives.
Which one should you pick?
A public chatbot or support assistant
Lakera Guard or Bedrock Guardrails on input, plus personal-data masking on output. Try both on a sample of real traffic, including a set of known attacks, and compare catch rate and false alarms.
Lakera Guard or Bedrock GuardrailsAn agent that calls tools
NeMo Guardrails for execution rails over tool inputs and outputs, with a detector such as Lakera screening tool results for injected instructions. Pair both with narrow tool permissions.
Output must be valid and on-policy
Guardrails AI. Validators plus structured output from a Pydantic model cover "return valid JSON, never mention a competitor, no personal data" in a few lines. Pin versions while the post-acquisition roadmap settles.
You use several model providers and want one policy
Bedrock Guardrails through ApplyGuardrail, or NeMo Guardrails if you would rather not route text through AWS. Either way the policy lives in one place instead of in each provider's settings.
Frequently Asked Questions
What is the best AI guardrails tool?
There is no single best one, because they do different jobs. Lakera Guard and Amazon Bedrock Guardrails are hosted services you call to screen text for attacks, harmful content and personal data. NVIDIA NeMo Guardrails is an open-source framework for programmable rules over input, output, dialog flow, retrieval and tool execution. Guardrails AI is an open-source Python framework of validators that also forces structured output. Many production systems combine a fast screening service with a framework for their own policies.
What are AI guardrails?
Guardrails are checks placed around a model call. Input guardrails screen what users send (prompt injection, jailbreaks, personal data, off-topic requests). Output guardrails check what the model returns (harmful content, leaked data, invented facts, wrong format). For agents, guardrails also check tool calls and the results that come back, since a web page or email the agent reads can carry hidden instructions.
Can guardrails stop prompt injection completely?
No. Detection lowers the success rate of known attack patterns, but new phrasings keep appearing, and AWS itself describes Bedrock Guardrails as blocking up to 88% of harmful content. The reliable defence for agents is to limit what a successful injection could do: give tools the narrowest permissions, keep credentials out of the model, and require a human to confirm destructive or irreversible actions.
Is Guardrails AI still open source after the Harvey acquisition?
The framework is still on GitHub under Apache-2.0 and was being updated in October 2026. Harvey, the legal AI company, announced on September 9, 2026 that it had acquired Guardrails AI, and has not said publicly what happens to the open-source project. Separately, Guardrails moved its validators to ordinary PyPI packages and ended hosted remote inference on August 25, 2026. If you depend on it, pin versions and watch the repository.
Does Amazon Bedrock Guardrails work with OpenAI or other models?
Yes. The ApplyGuardrail API checks text against a guardrail without calling a model, so you can screen inputs and outputs for any model, including OpenAI, Gemini and self-hosted ones. You need an AWS account, and you pay per 1,000 text units (up to 1,000 characters each) for each policy you enable, on input and output separately.
How much do AI guardrails cost?
The open-source frameworks are free, but rails that ask a model to judge each message cost model tokens on every call. Amazon Bedrock Guardrails publishes per-use prices: $0.15 per 1,000 text units for content filters (including prompt attacks) and denied topics, $0.10 for personal-data filters and grounding checks, with word and regex filters free. For a million short messages a month with content and personal-data filters on both input and output, that is about $500. Lakera Guard has a free Community plan; production pricing is by quote.