Answers
Guardrails decide what reaches your model and what reaches your users, yet AWS describes even Bedrock's sensitive information detection as probabilistic. Choose one by where it runs and how it performs on your own prompts, and pair it with least privilege and output handling that treats model text as untrusted.
LLM guardrails are checks around a language model that block, alter or validate unsafe, off-topic or policy-violating inputs and responses. NVIDIA describes NeMo Guardrails as a Python package for adding programmable guardrails to LLM-based applications, and AWS describes Bedrock Guardrails as configurable safeguards for user inputs and model responses. They are a control layer outside the model, so you can change them without retraining it.
They name different layers that products often bundle. In our analysis, guardrails are the policy checks, an AI firewall applies detections to traffic in front of the application, and an AI gateway is a proxy between the application and model providers. Cloudflare shows the split: its Firewall for AI detections complement existing WAF rules, while AI Gateway proxies traffic to providers and has its own guardrails feature.
Choose open source when you need control over where checks run and how they are configured, and a managed service when you want the provider to operate them. NeMo Guardrails is a Python package, and Guardrails AI can run as a standalone service you host. Bedrock Guardrails and Azure AI Content Safety are cloud services. Check maintenance status on each tool page first: some open-source projects we list are archived.
Guardrails usually run twice: on the input before the model sees it, and on the output before a user or downstream system does. NeMo Guardrails runs input, retrieval, dialog, execution and output rails at different stages of an LLM interaction, and Bedrock Guardrails evaluates input prompts and model completions. A gateway such as Cloudflare AI Gateway applies the same two checks as a proxy between the application and model providers.
They reduce leakage but cannot stop it alone. AWS says Bedrock blocks or masks sensitive information based on probabilistic detection, and Presidio's documentation says there is no guarantee it finds all sensitive information. OWASP adds that system prompt restrictions on data may not be honored and can be bypassed through prompt injection. Combine filtering with data minimization and access controls.
Several work independently of the model provider. Bedrock's ApplyGuardrail API evaluates content without invoking a foundation model, NVIDIA says NeMo Guardrails adds checks before and after LLM calls without changing the application LLM, and Cloudflare says its firewall detections work regardless of which LLM you use. Cloudflare AI Gateway guardrails apply across providers such as OpenAI, Anthropic and DeepSeek. Confirm language and model support on each vendor's page.
Yes, in Bedrock Guardrails. For retrieval-augmented generation (RAG) and chat applications, AWS lets you tag the user input so the guardrail evaluates that section and skips system instructions, search results, conversation history or examples. AWS says this selective evaluation works through the AWS SDK, not the console or playground. Retrieved text still needs screening somewhere, because indirect prompt injection arrives in it.
Run it on your own prompts, languages and failure cases, because a feature list does not measure accuracy. Microsoft says to do your own testing to confirm Azure AI Content Safety works for your application, and the Bedrock console has a built-in test window for guardrail settings. Add adversarial probes from a scanner such as garak, and track both missed attacks and blocked legitimate requests. Our Coverage Score does not measure detection accuracy.