LLM guardrails are runtime checks that sit between users and a language model, blocking prompt injection, data leakage, harmful content and off-policy answers before they reach anyone. You can run an open source library yourself, switch on the filters built into your cloud AI platform, or buy a security platform. Ten options follow in no particular order.
Guardrails are the part of an AI app that says no in real time. A user sends a prompt, a check screens it for injection attempts or sensitive data, the model answers, and a second check screens the output for leaks, harmful content or claims your policy doesn't allow. It all happens while the app runs, which is what makes this different from testing.
This list covers runtime enforcement only, not attack testing before launch. The ten options below are listed alphabetically and in no particular order, and each description comes from the vendor's own website or documentation, read as of Oct 2026. For the full picture of what an agent needs around it, see my AI agent guardrails checklist.
Guardrail libraries, cloud filters and security platforms compared
I checked the free plan column on each vendor's own website, as of Oct 2026. Yes means the page names a free plan, a free version or an open source edition. Trial only means it names a time-limited free trial. Not stated means the page I read named neither, so check the vendor's own site before you sign up.
| Tool | Type | Good for | Free plan |
|---|---|---|---|
| Amazon Bedrock Guardrails | Cloud built-in (AWS) | Configurable safeguards for Bedrock apps | Not stated |
| Arthur | Agent security and governance | Agent discovery with real-time guardrails | Not stated |
| Azure AI Content Safety | Cloud built-in (Microsoft) | Blocking harmful inputs and outputs | Not stated |
| F5 AI Guardrails | AI security (F5) | Data security and governance for AI apps | Not stated |
| Galileo | Eval and observability platform | Evals that become live guardrails | Not stated |
| Guardrails AI | Guardrails framework and hub | Runtime checks across any LLM | Not stated |
| HiddenLayer | AI security platform | Policy guardrails plus red teaming | Not stated |
| NeMo Guardrails | Open source library (NVIDIA) | Programmable guardrails in Python | Yes |
| Prompt Security | AI security (SentinelOne) | Sensitive data, secrets and injection flags | Not stated |
| Straiker | Agentic AI security | Runtime protection against tool manipulation | Not stated |
Ten LLM guardrail options for live AI apps
Amazon Bedrock Guardrails
Best for: AWS teams who want configurable safeguards matched to their own application requirements and responsible AI policies, inside Amazon Bedrock.
Arthur
Best for: Security and governance teams finding every agent wherever it runs, then deploying guardrails and anomaly alerts in real time.
Azure AI Content Safety
Best for: Microsoft Foundry users blocking harmful inputs and outputs in generative AI apps, with content monitoring from the same service.
F5 AI Guardrails
Best for: Enterprises wanting data security, threat management and governance for AI models, apps and agents from a network and security vendor.
Galileo
Best for: Teams turning pre-production evals into production guardrails, so the same eval scores control what an agent is allowed to do live.
Guardrails AI
Best for: Developers who want a guardrails framework and hub for any LLM, deploying runtime checks for policy breaches, hallucinations and data leakage.
HiddenLayer
Best for: Security teams covering the whole AI stack, with policy-based guardrails against prompt injection and data leakage beside red teaming and AI discovery.
NeMo Guardrails
Best for: Python developers adding programmable guardrails to LLM apps with an open source package documented as part of the NVIDIA NeMo stack.
Prompt Security
Best for: SentinelOne customers who want guardrails for sensitive data, secrets and prompt injection, with flags reported per organisation.
Straiker
Best for: Agentic AI apps that need runtime guardrails against prompt injection, data leakage and tool manipulation, plus continuous red teaming of agents.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
The independent guardrail names are being bought
Here's the thing most guardrail roundups miss. When I opened the vendor pages, the CalypsoAI address went to a page titled F5 AI Guardrails, the Prompt Security page carried the words From SentinelOne, and the Protect AI address opened Prisma AIRS from Palo Alto Networks. Even a developer framework changed hands: the Guardrails AI home page now opens with a banner announcing it joins Harvey.
So the stand-alone guardrail is turning into a feature of bigger security and network platforms. Meanwhile the clouds ship their own: Microsoft and Amazon both build guardrails into their AI platforms, and NVIDIA publishes its version as an open source Python package rather than a hosted service. If you already run on one cloud, its built-in filters are the obvious first test.
Three ways to add guardrails to an LLM app
- Open source library. You add programmable rules to your own code and host them yourself. You get full control, but your team maintains the rules and the infrastructure.
- Cloud built-in. Content filters and safeguards configured inside the AI platform you already use. They're quick to switch on, but tied to that cloud's models and services.
- Security platform. A vendor product that discovers every AI app and agent in the company and enforces one policy across them, usually bought by the security team rather than developers.
What a guardrail should catch at runtime
- Prompt injection, including instructions hidden in documents or web pages the model reads.
- Sensitive data and secrets leaving in a prompt or coming back in an answer.
- Harmful or off-topic content your policy doesn't allow.
- Hallucinated claims, checked against your source material before the user sees them.
- Tool misuse, where an agent calls a tool or MCP server it shouldn't, or passes it the wrong data.
Hallucination is the hardest one to filter, because a wrong answer often sounds right. My explainer on why AI agents hallucinate covers where it comes from.
Do you make an LLM guardrail product? Tool makers can ask to be considered for a featured place on this list.
My plain advice on LLM guardrails
Start with the guardrails you already own. If you're on one cloud, switch on its filters and measure how many real attacks they block and how many good prompts they wrongly stop. Add an open source library when you need custom rules, and talk to a security platform once several teams are shipping AI apps and agents.
Whatever you choose, log every block. You'll want those traces when something slips through, which is why guardrails and LLM observability tools usually run together.
Want your tool on this list? Featured spots and reviews here are paid partnerships. Here's how to partner with me.
Frequently asked questions
What are LLM guardrails?
They're runtime checks on the prompts going into a language model and the answers coming out, used to block injection, data leakage, harmful content and policy breaches.
What's the difference between guardrails and red teaming?
Red teaming attacks your AI app before launch to find weaknesses. Guardrails enforce rules on every live request after launch. Most teams need both.
Is there an open source LLM guardrails library?
Yes. One option on this list is documented as an open source Python package for adding programmable guardrails to LLM apps, shown in the free plan column.
Do guardrails slow down an AI app?
Every check adds a step to each request, so ask any vendor how long its checks take and test with your own traffic before you go live.
Who should own LLM guardrails?
Developers usually start them, but once several apps and agents are live, security teams tend to take over so one policy applies everywhere.
