Guardrails and AI Safety
Input Guardrails — Stack
Input guardrails › Stack
Technology landscape as of 2026-10-10. Knowledge cutoff May 2026.
Selection criteria
What you are choosing is a component that runs on one hundred per cent of traffic and adds its cost to the part of latency users feel most.
- Pre-generation latency. Added milliseconds before the first token can be requested. This budget is unforgiving because there is nothing to stream over it.
- Admitted surface. Whether the component can see attachments, images, audio transcripts, and pasted documents, or only a string field.
- Transform support. Whether it can return a repaired request as well as a verdict, which is the capability that separates a filter from a wall.
- Threshold control. Per-rule, per-tenant, per-locale operating points that can be changed without a release, and a recorded history of what they were.
- Concurrency and short-circuiting. Whether independent checks can be issued in parallel and whether the first refusal can cancel the rest.
- Record quality. Whether a decision can be reconstructed later: which rule fired, on which span, with which model revision.
- Normalisation ownership. Whether the component canonicalises text itself or expects the caller to have done it, which is where most evasions enter.
Options
| Option | Best for | Watch out for |
|---|---|---|
| Deterministic validators in the request path (length and schema limits, denylists, encoding and character-class rules) | Catching malformed and obviously abusive requests at negligible cost | Trivially evaded by rewording; denylists age into a maintenance burden nobody owns |
| In-process guardrail libraries (Guardrails AI, LLM Guard, NeMo Guardrails) | Teams wanting several checks composed behind one call without new infrastructure | Each bundled check has its own quality and its own licence; the composition hides which one blocked |
| Hosted moderation and safety endpoints from model providers | Getting a credible baseline on day one with no serving to operate | A network hop before your own first token, a separate availability budget, and a taxonomy you do not control |
| Self-hosted classifier served beside the application (Prompt Guard, ShieldGemma, Llama Guard, Granite Guardian) | High volume where per-request fees or data residency rule out a hosted call | GPU capacity planning for a component that must never be the slow path; model updates are your problem |
| A full guard-model call before the main call | Nuanced judgements no small classifier makes well | Doubles the model calls on every request, and the guard reads attacker-chosen text inside its own prompt |
| Gateway or service-mesh request policy | Enforcing one admission policy across many services without touching them | Infrastructure-level rules are hard for product teams to test and easy to forget during an incident |
| Web application firewall and abuse platform in front of the application | Volumetric abuse, credential stuffing, and automation that never reaches the model | Blind to meaning; blocks by address and signature, which punishes shared egress points |