Layer 6 of 8, Protect what runs

Runtime guardrails: screen live prompts and outputs

This layer screens prompts, retrieved content and model output in the request path, validates output before other systems use it, and caps request rates and spend.

25 tools + 11 also cover it
Last reviewed October 21, 2026

See the tools How the eight layers work

Executive summary

What it is: This layer screens prompts, retrieved content and model output in the request path, validates output before other systems use it, and caps request rates and spend.
The risk: Direct and indirect prompt injection, jailbreaks, harmful content, leaked system prompts and model output that a browser, database or tool then acts on unchecked. Unmetered endpoints add denial of service and runaway cost.
What to buy or do: Put a guardrail API, LLM firewall or AI gateway in front of every public LLM app, start in log-only mode to tune false positives, then block. First check what your cloud, edge or API gateway provider already includes.

Our analysis Our editorial model, not a standard: OWASP, MITRE and NIST did not create or endorse it. Layer placements are our analysis, based on documented capabilities. How the model works.

The question this layer answers

When a prompt attack or unsafe output hits a live AI app, what catches it and what happens next?

Budget line
An LLM firewall, guardrail API or AI gateway, often bought from an API gateway, edge, WAF or cloud provider.

What it protects against

Our analysis

Direct and indirect prompt injection and jailbreaks, including instructions in retrieved content and tool output
Harmful content
Unvalidated output reaching browsers, databases or tools
System prompt leakage
Ungrounded answers
Malicious links
Denial of service and runaway cost

Typical controls

Our analysis

Input screening classifiers
Output validation with schemas and deterministic checks
Content moderation and topic control
Grounding checks
Malicious URL checks
PII redaction in the request path
Rate, token and spend limits
Gateway routing with policy and logs
Open safety classifier models
Custom policies

How it maps to standards

Source states means the framework's own text names the control or outcome this layer delivers. Our analysis means we drew the link. OWASP LLM ids are the 2025 edition; the ATLAS hub holds the MITRE data version.

Runtime guardrails: standards entries, basis, where the source says it and how it applies
Framework	Entry	Basis	Where the source says it	How it applies
OWASP LLM Top 10 (2025)	LLM01 Prompt Injection	Source states	Prevention list	Filter inputs and outputs, and check output formats with deterministic code.
OWASP LLM Top 10 (2025)	LLM02 Sensitive Information Disclosure	Source states	Prevention list	Pattern-based redaction before the model processes content.
OWASP LLM Top 10 (2025)	LLM05 Improper Output Handling	Source states	Prevention list	Treat model output as untrusted input and validate it.
OWASP LLM Top 10 (2025)	LLM07 System Prompt Leakage	Source states	Prevention list	Independent guardrails that inspect model outputs.
OWASP LLM Top 10 (2025)	LLM09 Misinformation	Source states	Prevention list	Validate key outputs automatically.
OWASP LLM Top 10 (2025)	LLM10 Unbounded Consumption	Source states	Prevention list	Input size limits, rate limits and quotas, timeouts and throttling.
OWASP Agentic Top 10 (2026)	ASI01 Agent Goal Hijack (opens in a new tab) OWASP relates it to LLM01, LLM06.	Source states	Mitigations 1, 6	Route inputs through the LLM01 safeguards, and filter content from connected data sources.
OWASP Agentic Top 10 (2026)	ASI05 Unexpected Code Execution (RCE) (opens in a new tab) OWASP relates it to LLM01, LLM05.	Source states	Mitigation 1	Input validation and output encoding for agent-generated code.
OWASP Agentic Top 10 (2026)	ASI06 Memory & Context Poisoning (opens in a new tab) OWASP relates it to LLM01, LLM04, LLM08.	Source states	Mitigation 2	Scan memory writes and model outputs for malicious content.
MITRE ATLAS	AML.M0020 Generative AI Guardrails	Source states	Mitigation name	The mitigation's name is the control.
MITRE ATLAS	AML.M0004 Limit AI Service Query Volume and Rate	Source states	Mitigation name	The mitigation's name is the control.
MITRE ATLAS	AML.T0051 LLM Prompt Injection	Our analysis	Not named by the source	Runtime screening and limits address this technique.
MITRE ATLAS	AML.T0054 LLM Jailbreak	Our analysis	Not named by the source	Runtime screening and limits address this technique.
MITRE ATLAS	AML.T0056 Extract LLM System Prompt	Our analysis	Not named by the source	Runtime screening and limits address this technique.
MITRE ATLAS	AML.T0060 Publish Hallucinated Entities	Our analysis	Not named by the source	Runtime screening and limits address this technique.
MITRE ATLAS	AML.T0070 RAG Poisoning	Our analysis	Not named by the source	Runtime screening addresses manipulation through retrieved content.
MITRE ATLAS	AML.T0077 LLM Response Rendering	Our analysis	Not named by the source	Runtime screening and limits address this technique.
MITRE ATLAS	AML.T0029 Denial of AI Service	Our analysis	Not named by the source	Runtime screening and limits address this technique.
MITRE ATLAS	AML.T0034 Cost Harvesting	Our analysis	Not named by the source	Runtime screening and limits address this technique.
NIST AI RMF	MANAGE Manage (opens in a new tab)	Our analysis	Related: MANAGE 1.3	Responses to high-priority risks are developed and documented, and runtime controls are one response.

Tools in this layer (25)

Tools whose category is LLM firewalls & guardrails, listed by name. Compare them with Coverage Scores on the Guardrails hub.

Alice WonderSuite

Alice · AI safety suite with a runtime guardrail

Commercial
Amazon Bedrock Guardrails

Amazon Web Services · managed AWS guardrail service for generative AI

Commercial
Azure AI Content Safety

Microsoft · cloud API for harmful content and prompt attacks

Commercial Freemium Renamed
CalypsoAI (F5 AI Guardrails)

F5 (CalypsoAI) · runtime guardrail for AI models and agents

Commercial Now F5 AI Guardrails
Cisco AI Defense

Cisco · AI validation and runtime protection suite

Commercial
Cloudflare AI Gateway

Cloudflare · edge gateway for LLM traffic

Commercial Freemium
Cloudflare Firewall for AI (AI Security for Apps)

Cloudflare · set of WAF detections for LLM-powered apps

Commercial Now AI Security for Apps
Google Cloud Model Armor

Google Cloud · managed screening service for LLM traffic

Commercial
Guardrails AI

Guardrails AI · open-source Python guardrails framework
7,552 GitHub stars as of Oct 21, 2026; last push Oct 21, 2026

Open sourceApache-2.0
HiddenLayer AI Runtime Security (AIDR)

HiddenLayer · runtime threat detection module for AI apps

Commercial
IBM Granite Guardian

IBM · open safety and risk-detection model family
188 GitHub stars as of Oct 21, 2026; last push Oct 16, 2026

Open sourceApache-2.0
Kong AI Gateway

Kong · AI gateway built on Kong Gateway
44,287 GitHub stars as of Oct 21, 2026; last push Oct 19, 2026

Open sourceApache-2.0
Lakera Guard

Check Point (Lakera) · hosted guardrail API for prompt and data risks

Commercial Now Check Point AI Guardrails
Lasso Security

Lasso Security · runtime security layer for LLM apps and agents

Commercial
Meta Llama Protections

Meta · open suite of LLM safety models and tools
4,444 GitHub stars as of Oct 21, 2026; last push Oct 12, 2026

Open, custom license
NVIDIA NeMo Guardrails

NVIDIA · open-source programmable guardrails toolkit
7,341 GitHub stars as of Oct 21, 2026; last push Oct 22, 2026

Open sourceApache-2.0
OpenAI gpt-oss-safeguard

OpenAI · open-weight policy-following safety model family
61 GitHub stars as of Oct 21, 2026; last push Jan 14, 2026

Open sourceApache-2.0
Pangea AI Guard

CrowdStrike (Pangea) · hosted guardrail API for prompts and responses

Commercial
Portkey AI Gateway

Palo Alto Networks (Portkey) · AI gateway with built-in guardrails
13,245 GitHub stars as of Oct 21, 2026; last push May 25, 2026

Open sourceMIT Freemium Now Prisma AIRS AI Gateway
Prompt Security

SentinelOne (Prompt Security) · AI firewall and usage control platform

Commercial
Qwen3Guard

Alibaba Cloud · open multilingual safety moderation model family
525 GitHub stars as of Oct 21, 2026; last push Oct 21, 2025

Open sourceApache-2.0
Radware LLM Firewall

Radware · inline prompt-level LLM firewall

Commercial
Vigil

deadbits · experimental prompt injection scanner
507 GitHub stars as of Oct 21, 2026; last push Jan 31, 2024 inactive

Open sourceApache-2.0
LLM Guard

Palo Alto Networks (Protect AI) · open-source input and output scanner toolkit
3,217 GitHub stars as of Oct 21, 2026; last push Jul 8, 2026 archived

Open sourceMIT Archived
Rebuff

Palo Alto Networks (Protect AI) · archived prompt injection detector prototype
1,531 GitHub stars as of Oct 21, 2026; last push Aug 7, 2024 archived

Open sourceApache-2.0 Archived

Also cover this layer (11)

Our analysis Tools from other categories that document a capability in this layer. Each row names the layer the tool belongs to first and the documented capability our placement rests on.

Tools from other categories that also cover Runtime guardrails, with the capability each placement rests on
Tool	Its primary layer	How it applies	Based on
Amazon Bedrock AgentCore Policy	L7 Agent access	Guardrail conditions screen tool input and output for prompt attacks and sensitive data through Bedrock Guardrails.	Guardrail conditions call Bedrock Guardrails for prompt attack, content and sensitive data scores; a policy can deny a call or suppress a tool response
Google Cloud Agent Gateway	L7 Agent access	Optional Model Armor screening checks prompts and tool responses for prompt injection and data leakage.	Optional Model Armor scans prompts and tool responses for prompt injection, data leakage and harmful content on ingress and egress
Invariant Guardrails472 GitHub stars as of Oct 21, 2026; last push Jan 12, 2026	L7 Agent access	Documents rules that flag prompt injection in tool output.	Example rules flag prompt injection in tool output
Lasso MCP Gateway396 GitHub stars as of Oct 21, 2026; last push Jan 22, 2026	L7 Agent access	Documents prompt injection checks on content that passes through the gateway.	The lasso plugin sends content to Lasso's API to check for prompt injection, among other risks, and needs a Lasso API key
mcp-context-protector226 GitHub stars as of Oct 21, 2026; last push Apr 14, 2026	L7 Agent access	Documents quarantine of tool responses that a guardrail provider flags for prompt injection.	With a guardrail provider such as LlamaFirewall, scans tool responses for prompt injection and quarantines flagged ones
NeuralTrust15 GitHub stars as of Oct 21, 2026; last push Oct 21, 2026	L7 Agent access	Documents inline prompt inspection that detects jailbreaks, injections and policy violations.	Inline prompt inspection that detects jailbreaks, injections and policy violations
Operant AI	L7 Agent access	Documents prompt injection detections.	Shows prompt injection risks and detections in its dashboards
Orca Security AI-SPM	L2 Discovery	Documents a sensor that flags prompt injection patterns at runtime.	Gives runtime visibility into LLM and MCP activity through the Orca Sensor and flags prompt injection patterns
Palo Alto Networks Prisma AIRS	L2 Discovery	Documents real-time blocking and gateway policy for AI traffic.	Detects and blocks AI-specific attacks and data loss in real time; Centralizes AI access policy, governance and observability through an AI Gateway
SandboxAQ AQtive Guard AI-SPM	L2 Discovery	Documents guardrails enforcement on every AI interaction without code changes.	Enforces guardrails on every AI interaction with no code changes; An on-premises AI Gateway blocks or masks jailbreaks, prompt injection, toxicity, PII and secrets for agents and browser AI use
Wiz AI Security Posture Management (AI-SPM)	L2 Discovery	Documents AI runtime protection against prompt injection and rogue agents.	Offers AI runtime protection against prompt injection and rogue agents

What this layer will not do

Guardrails reduce risk; they do not remove it. OWASP's LLM01 page says it is unclear whether fool-proof prevention of prompt injection exists, and attacks can be hidden in other languages, encodings or images that a filter was not trained on. OWASP's LLM07 page says a system prompt should not be considered a secret or used as a security control. A filter judges content, not authority: it cannot decide whether an agent may send an email or delete a record, which is layer 7. Every check adds latency and some false positives, so tune it on your own traffic.

Related guides

Runtime guardrails FAQ

Can a guardrail stop all prompt injection?

No. The OWASP LLM01 page says it is unclear whether fool-proof prevention methods exist, and that research shows retrieval-augmented generation and fine-tuning do not fully mitigate it. Treat input and output filtering as one control, and pair it with least-privilege tools and human approval for high-risk actions (layer 7) and with regular adversarial testing (layer 4).

Guardrail API, LLM firewall or AI gateway: which do we need?

Our analysis: a guardrail API or library screens content when your code calls it, an LLM firewall sits in front of the app in the network path, and an AI gateway routes model traffic and applies limits, logging and policy in one place. Pick by where you can insert the control. Some products combine two of these; each tool page lists the deployment its sources document.

Do guardrails help against denial of service and runaway cost?

When they include limits. The OWASP LLM10 page lists input validation with size limits, rate limiting, and timeouts and throttling among its prevention steps, and MITRE ATLAS lists Limit AI Service Query Volume and Rate as a mitigation. Check each tool page for documented rate, token or spend limits.

Framework sources & last reviewed

Last reviewed October 21, 2026. We compile from the vendors' own public pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.

Drafted with AI assistance; facts checked against primary sources on October 21, 2026.

OWASP Top 10 for LLM Applications 2025 (list page) (1 sources)