AI Defense Stack

LLM firewalls & guardrails

Google Cloud Model Armor: managed screening service for LLM traffic

Model Armor is a managed screening service for LLM traffic from Google Cloud. It is a commercial product offered as: API, Cloud-native, Managed service. Pricing model: usage-based.

  • Last reviewed
Visit Model Armor (opens in a new tab) Documentation (opens in a new tab)
Commercial Layer 6: Runtime guardrails

Best for

Teams on Google Cloud that want managed prompt and response screening in front of Gemini Enterprise Agent Platform or their own model endpoints

Consider instead if

  • You build on AWS and want a comparable managed service. See Bedrock Guardrails.
  • You want an open-source toolkit you can run on your own infrastructure. See NeMo Guardrails.

What Model Armor does

Model Armor is a Google Cloud service that screens the prompts sent to LLMs and the responses they return. The documentation lists filters for prompt injection and jailbreaks, Sensitive Data Protection, malicious URLs and responsible AI categories, plus screening of text in documents. You set filters and confidence levels in templates, apply floor settings across a project, and choose inspect-only or inspect-and-block enforcement. The overview says it can help protect AI deployed in Google Cloud or on other cloud providers. It is a closed-source managed service. Each prompt and response is inspected independently, without conversation history, and Model Armor does not decode Base64 content.

This summary is our own wording of the sourced facts on this page.

Key facts

Each value links to the page that states it, with the date we checked it.

Vendor
Google Cloud Source, checked October 21, 2026: docs.cloud.google.com (opens in a new tab)
Status
Active Source, checked October 21, 2026: docs.cloud.google.com (opens in a new tab)
Open source
No: closed source (proprietary) Source, checked October 21, 2026: docs.cloud.google.com (opens in a new tab)
Latest release
Not documented in the sources we checked
Deployment
API, Cloud-native, Managed service Source, checked October 21, 2026: docs.cloud.google.com (opens in a new tab)
Pricing model
Usage-based Source, checked October 21, 2026: docs.cloud.google.com (opens in a new tab)
Website
docs.cloud.google.com Source, checked October 21, 2026: docs.cloud.google.com (opens in a new tab)
Documentation
docs.cloud.google.com Source, checked October 21, 2026: docs.cloud.google.com (opens in a new tab)
API reference
Not documented in the sources we checked
Quickstart
Not documented in the sources we checked
Security page
Not documented in the sources we checked
Attestations or disclosure
Not documented in the sources we checked

Capabilities

As documented by the vendor or project. The tag is our label from a controlled vocabulary.

Integrations

Where Model Armor fits in our AI security layers

Our analysis

Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.

AI security layers that Model Armor covers, with the role, how each applies and what it rests on
LayerRoleHow it appliesBased on
L6 Runtime Runtime guardrails Primary Screen what goes into and comes out of a model in live traffic, and limit abuse of the model endpoint. Follows its category, LLM firewalls & guardrails
L5 Data Data protection Also covers Documents detection and redaction of personal data through Sensitive Data Protection. Detects and can redact PII and other sensitive data with Sensitive Data Protection
L8 Monitoring Monitoring and response Also covers Documents detections logged to Cloud Logging in inspect-only or inspect-and-block mode. Logs detections to Cloud Logging in inspect-only or inspect-and-block mode

OWASP LLM Top 10 mapping

Our analysis

The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.

OWASP LLM risks mapped to Model Armor, with the capabilities each mapping rests on
RiskHow it appliesBased on
LLM01 Prompt Injection A filter detects prompt injection and jailbreak attempts in prompts. Detects prompt injection attempts that try to bypass system guardrails; Detects jailbreak attempts as part of the same filter
LLM02 Sensitive Information Disclosure Sensitive Data Protection detects and can redact PII and other sensitive data. Detects and can redact PII and other sensitive data with Sensitive Data Protection

Not mapped in our analysis: LLM05, LLM07, LLM09, LLM10. These are risks we expect tools in this category to cover; the sources we checked do not document a matching capability.

Alternatives and related tools

More in LLM firewalls & guardrails, ranked within the category by Coverage Score.

NVIDIA NeMo Guardrails

NVIDIA

Open sourceApache-2.0
  • Library
  • Self-hosted
  • API

Adds programmable input, dialog, retrieval, execution and output rails to LLM applications.

Best for: Teams that want to script rules for one LLM application in Python and run them in their own infrastructure

Coverage Score 76 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM05 Improper Output Handling
  • LLM06 Excessive Agency

Reviewed

Portkey AI Gateway

Palo Alto Networks (Portkey)

Open sourceMIT Freemium Now Prisma AIRS AI Gateway
  • SaaS
  • Self-hosted
  • API

Routes LLM traffic through one gateway API and runs input and output guardrail checks on each request.

Best for: Teams that want a single gateway for several LLM providers with guardrail checks, available as open source or as a hosted service

Coverage Score 69 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM05 Improper Output Handling
  • LLM09 Misinformation

Reviewed

Kong AI Gateway

Kong

Open sourceApache-2.0
  • Self-hosted
  • SaaS
  • API

Routes LLM traffic through Kong with prompt guards, PII sanitization, spend limits and observability.

Best for: Teams that already run Kong as an API gateway and want LLM routing and prompt controls on the same data plane

Coverage Score 65 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM10 Unbounded Consumption

Reviewed

Head-to-head comparisons

Model Armor FAQ

Is Model Armor open source?

No. It is a managed Google Cloud service, and the documentation links no source repository for it.

Does Model Armor only work with Google models?

No. The overview says it can help protect AI deployed in Google Cloud or on other cloud providers, and its REST API screens the prompts and responses that you send to it.

What are the known limits?

The documentation says each prompt and response is inspected independently without conversation history, Base64 content is not decoded, and audio and video are not supported.

Key facts you can cite

We have no commercial relationship with Google Cloud.

Sources & last reviewed

Last reviewed . We compile from the vendors' own public pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.