Guardrails and AI Safety
Output Guardrails — Stack
Output guardrails › Stack
Technology landscape as of 2026-10-10. Knowledge cutoff May 2026.
Selection criteria
The deciding properties here are about timing and about what the receiving surface will do with the bytes, not about classification quality.
- Streaming compatibility. Whether the component can consume a token stream and emit a running verdict, or whether using it forces the product to buffer.
- Withdrawal support. Whether the delivery path can retract or overwrite content already sent, which determines how much may be streamed ahead of a verdict.
- Evidence intake. Whether the component accepts the request, the sources, and the tool results alongside the response, or scores an isolated string.
- Mutation. Whether it can return a corrected artifact — redacted, escaped, with a required addition — rather than only a pass or fail.
- Post-generation latency. Milliseconds added after the last token, which is pure dead time with nothing to overlap it with.
- Render-target coverage. Whether the sanitiser understands the exact dialect your surface renders, including the extensions your framework enables.
- Reach. Whether the same component can be placed on every egress path, including the ones that are not the chat surface.
Options
| Option | Best for | Watch out for |
|---|---|---|
| Provider-side response filtering (Bedrock Guardrails, Azure AI Content Safety, Vertex AI safety settings) | Getting a coherent policy applied to everything issued through one platform | Taxonomy and thresholds are the vendor's, change without your release, and differ between the providers you multi-home across |
| Self-hosted output classifier invoked after generation (Llama Guard, ShieldGemma, WildGuard) | Products needing one consistent judgement across several model vendors | Runs after the last token with nothing to hide the latency behind; needs its own capacity and upgrade path |
| Streaming validators in a guardrail framework (Guardrails AI, NeMo Guardrails) | Teams who need partial-output checking without building the buffering machinery | Chunk-boundary semantics are subtle; a violation spanning two chunks is the case these are weakest at |
| Markup and HTML sanitisers (DOMPurify, bleach, ammonia) | Any surface that renders model output as rich text | A sanitiser configured for one dialect misses what a different renderer accepts; allowlists drift as the surface adds features |
| Content Security Policy and render-side controls | Neutralising exfiltration through images, links, and embeds regardless of what the text says | Only protects the surface you control; an export, an email, or a partner's renderer has its own rules |
| Schema and value validation (JSON Schema, Pydantic, typed decoders) | Structured responses consumed by code rather than read by people | Conformance is not acceptability; a valid object can carry an unacceptable instruction |
| Gateway-level response inspection | Applying one egress policy to services that each emit model output | Sees serialised bytes without the request context, which is exactly what the harder judgements need |
| Asynchronous post-hoc scoring over delivered responses | Measurement, incident discovery, and tuning operating points without adding latency | Finds violations after delivery; useful as a monitor and never as a gate |