Guardrails are checks in the request path that screen what goes into and comes out of a model: libraries, open-weight safety models, cloud APIs and gateways. They exist because an injected instruction or a leaked secret in live traffic is stopped only if something inspects it. No detector catches every attack.
Checks in the request path that screen prompts, retrieved content and model responses for prompt injection, jailbreaks, sensitive data and unsafe output, sold as libraries, safety models, cloud APIs or gateways.
The risk
A model that reads untrusted text can be steered into ignoring its instructions, leaking data or producing output that a browser, database or tool then acts on. OWASP says fool-proof prevention of prompt injection may not exist.
What to buy or do
Put one screening point, owned by a named team, in front of every production LLM endpoint. Pick the deployment shape first, then evaluate shortlisted tools on your own traffic for misses, false alarms and latency.
Quick picks
The highest Coverage Scores in this category. The score measures what each vendor documents publicly; it is not an
endorsement and it does not measure detection quality.
Decide the deployment shape first: it sets who runs the check, where your prompts go and how much you can tune. Then match tools to the risks your application faces.
Setup
Pick a shape. Libraries run inside your code, open-weight safety models run on your hardware, cloud APIs and hosted platforms run on the vendor's side, and gateways sit in the request path. The table above lists each tool's deployment, license and pricing model.
Decide what to screen. Input checks catch injected instructions before the model sees them. Output checks are needed wherever model text reaches a browser, a database or a tool call (LLM05 improper output handling).
Choose the risks. We weigh LLM01 prompt injection, LLM02, LLM05, LLM07, LLM09 and LLM10 in this category. Rank them by your application's exposure and shortlist tools that document checks for your top two or three.
Integration
Check the integrations listed on each tool page for your model provider, gateway and agent framework.
A hosted service processes your prompts and responses. Read the vendor's data handling pages before you route production traffic through it.
Detection is probabilistic. OWASP says it is unclear whether fool-proof prevention of prompt injection exists, and its mitigations put least privilege, validated output formats and human approval for high-risk actions next to input and output filtering. The Coverage Score measures how much a vendor documents, not detection accuracy, false positives or latency, so evaluate shortlisted tools on your own traffic before you commit. See how the score works.
Guardrails FAQ
What is the difference between an LLM guardrail and an LLM firewall?
Both screen traffic to and from a model. Some products use the firewall label when the check sits in the request path, as a gateway or a web application firewall rule, but the checks can be the same. Compare what each product documents, not the label.
Do guardrails stop prompt injection?
They reduce it, but they cannot be the only control. OWASP says it is unclear whether fool-proof prevention of prompt injection exists. Pair detection with least privilege, validated output formats and human approval for high-risk actions.
Should I use an open-source library or a managed service?
Choose by who will run and tune the checks. A library or model you host keeps traffic in your environment, and your team operates it. A managed service leaves less to run but processes your traffic. The table on this page lists license, deployment and pricing model for each option.
Where do guardrails sit in the request path?
Input checks run before the prompt reaches the model. Output checks run before the response reaches the user or a downstream system. A gateway can apply both in one place, while a library runs inside your application code.
Can guardrails stop sensitive data from leaking?
They can screen prompts and responses for personal data and secrets, which helps with LLM02. They do not replace access control: OWASP's mitigations for that risk also include least-privilege access to data and keeping user data out of training.
Does the Coverage Score show which guardrail detects attacks best?
No. The Coverage Score measures how much a vendor documents publicly, such as capabilities, deployment options and documentation. We do not run these products, so it says nothing about detection accuracy, false positives or latency.
Sources & last reviewed
Last reviewed . We compile from the vendors' own public
pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.
We may use analytics and, later, show ads. They stay off until you choose, wherever you are. Declining
never limits what you can read. See our privacy policy and
cookie policy.
Privacy settings
Choose what you allow. Your choice is stored on this device for 13 months. You can change it later from the
"Privacy choices" link in the footer.
