Guardrails

Vital signs

Why it's on the table

On the table, Guardrails (Gd) is seat 51 of 58, in the Trust & Compliance family. It is an experimental element — promising, volatile, and worth a contained experiment rather than a commitment. Budget curiosity, not dependence. It is optional: plenty of companies run without it — until a specific trigger (scale, regulation, cost, or customers) makes it essential for them. The price of entry is zero, which makes trying it a decision that needs no meeting.

Guardrails: the top 5 — v2026.Q3

Edition v2026.Q3 · ranking, pricing and status verified 2026-08-06.

1. 1PromptfooPromptfoo, Inc. → OpenAI (acquired Mar 9, 2026)

   Community free (all evals, all providers, 10k red-team probes/mo, self-hosted) · Enterprise custom · On-Premise custom

   Best for Finding the guardrail you forgot — adversarial testing of prompts, agents and tool calls, run locally and wired into CI.

   The canon red-team practice with the adoption to match: 350,000+ developers, 130,000 monthly actives, and teams at 25%+ of the Fortune 500 as of the March 2026 acquisition post. It generates attacks per plugin (harmful content, BOLA/BFLA authorization bypass, tool-based privilege escalation) rather than replaying a static jailbreak list, which is what catches agent-specific holes. OpenAI bought it to secure its own agents and committed publicly to keeping it open source under the current license.

   Watch It tests; it does not enforce. A green promptfoo run is not a runtime control, and nothing here blocks a live request. The OpenAI acquisition also puts the category's most-used neutral scanner inside a frontier lab — the OSS pledge is a pledge, not a governance structure.

   350,000+ developers, 130,000 monthly actives, 25%+ of the Fortune 500 (Mar 9, 2026) [src] · OpenAI to acquire Promptfoo, announced Mar 9, 2026; stays open source, feeds OpenAI Frontier agentic security testing [src] · Free Community tier includes 10,000 red-team probes/month and full self-hosting (pricing page, Aug 2026) [src]
   Site →Docs →

2. 2sandbox-runtimeAnthropic (Apache-2.0, beta research preview)

   Free · Apache-2.0 · no service, no account

   Best for Putting a hard filesystem and network boundary around any agent process — coding agents especially — without containers or a cloud bill.

   The layer that actually held in 2026. It wraps arbitrary processes in OS-native primitives (sandbox-exec on macOS, bubblewrap on Linux, WFP on Windows in alpha) so an agent's blast radius is deterministic rather than a function of how well a classifier read the prompt. Anthropic reports an 84% reduction in permission prompts after moving Claude Code from approval-gating to sandboxing — the rare control that makes agents both safer and less annoying. 4.6k stars and v0.0.64 shipping Jul 7, 2026.

   Watch Explicitly a "beta research preview": Windows support is alpha, and the API is not stable. It does nothing about content — no injection detection, no PII, no topic control. And a sandbox with an over-broad network allowlist is theatre; the config is the product.

   4.6k stars, Apache-2.0, v0.0.64 released Jul 7, 2026 [src] · 84% reduction in permission prompts after OS-level sandboxing replaced approval-gating in Claude Code [src] · "GuardFall" (Jun 2026): pattern-based command guards bypassed in 10 of 11 open-source AI coding agents via shell quote-removal and parameter expansion [src]
   Site →Docs →

3. 3NVIDIA NeMo GuardrailsNVIDIA (Apache-2.0)

   Free · Apache-2.0 · self-hosted; NemoGuard NIM microservices require NVIDIA AI Enterprise licensing (not publicly priced)

   Best for Teams that want programmable, self-hosted rails — including rails on tool calls — rather than a hosted moderation endpoint.

   The most complete open guardrail toolkit: five distinct rail stages (input, retrieval, dialog, execution, output), where execution rails let you validate a tool call before the agent makes it — the control that maps to the actual 2026 failure mode. Colang gives you deterministic dialog policy instead of prompt-begging, and the NemoGuard NIMs (Safety Guard 8B, Jailbreak Detection, Topic Control) drop in as classifiers if you'd rather not train your own. 6.9k stars, 802 forks, v0.23.0, Python 3.10–3.13.

   Watch Colang is a language you have to learn, and the config surface sprawls fast. Every rail is another LLM call, so latency and token cost stack; teams routinely ship with rails disabled in the hot path. The best detectors are NVIDIA NIMs behind enterprise licensing, so the free tier is the scaffolding, not the models.

   6.9k stars, 802 forks, 3,765 commits, Apache-2.0, v0.23.0 (Aug 2026) [src] · Five rail types including execution rails that validate tool calls and external interactions [src] · NemoGuard NIMs available for content safety (Llama 3.1 NemoTron Safety Guard 8B), jailbreak detection and topic control [src]
   Site →Docs →

4. 4Amazon Bedrock GuardrailsAWS

   Usage-based, no subscription: content filters & denied topics $0.15/1k text units · sensitive-info filters $0.10 · contextual grounding $0.10 · Automated Reasoning $0.17 per policy · word filters and regex free · standalone InvokeGuardrailChecks prompt-attack $0.08/1k (1 text unit = 1,000 characters)

   Best for Shipping a managed filter today without building one — including in front of models you don't host on AWS.

   The ApplyGuardrail API is the quiet win: AWS lets you apply the same policy to any foundation model, "whether hosted on Amazon Bedrock or self-hosted models, including third-party models such as OpenAI and Google Gemini." It's also the only mainstream rail with formal verification — Automated Reasoning checks (GA Aug 2025) translate your policy into logic and produce auditable, mathematically verifiable validation decisions, which is a different category of evidence from a classifier's confidence score.

   Watch The headline numbers — "blocks up to 88% of harmful content", "99% accuracy" on Automated Reasoning — are AWS's own, with no independent benchmark to check them against. Per-1k-character billing gets expensive on long agent contexts, every enabled policy is a separate charge and a separate round trip, and you're inside an AWS account. It filters text, not actions: it will not stop an agent from calling the wrong tool.

   ApplyGuardrail works with any foundation model including self-hosted and third-party (OpenAI, Google Gemini) — vendor page, Aug 2026 [src] · Exact list pricing: $0.15/1k text units content filters; $0.17/1k per Automated Reasoning policy; word filters free (AWS pricing page, Aug 2026) [src] · Automated Reasoning checks GA in Bedrock Guardrails, Aug 2025 — formal policy verification, not classification [src]
   Site →Docs →

5. 5Lakera GuardLakera → Check Point Software (announced Sep 16, 2025)

   Not published — enterprise via Check Point sales; SaaS and self-hosted deployment options

   Best for Startups selling into enterprises that want a named vendor, an SLA and a real adversarial dataset behind the injection filter.

   The best-sourced commercial detector in the category. Lakera's Gandalf game turned prompt-injection into crowdsourced R&D — 80M+ adversarial patterns and 1M+ contributing hackers feeding the detector, across 100+ languages. Check Point states >98% detection at sub-50ms runtime latency with <0.5% false positives, and made Zurich its Global Center of Excellence for AI Security. Post-acquisition the product line broadened past the filter into workforce AI security, agent security and red-teaming services.

   Watch No public pricing at all — the least startup-friendly entry on this list, and you're now buying from a large network-security vendor whose roadmap answers to CloudGuard, not to you. All performance figures are first-party. Detection percentages on prompt injection are also structurally soft: there is no accepted public benchmark, so >98% is a claim about Lakera's own test set.

   Gandalf network: 80M+ adversarial patterns; >98% detection, sub-50ms latency, <0.5% false positives (Check Point release, Sep 16, 2025) [src] · Vendor site (Aug 2026): 1M+ hackers, 100+ languages, sub-50ms latency, 0.01% production false-positive rate [src] · Deal reported at ~$300M by Swiss and Israeli press; Check Point did not disclose terms [src]
   Site →Docs →

Guardrails: the top 8 compared

Edition v2026.Q3 · ranking, pricing and status verified 2026-08-06.

How to choose your guardrails

If your agent can run a shell, write files or reach the network

Sandbox first, filter second. Adversa's GuardFall work (Jun 2026) bypassed pattern-based command guards in 10 of 11 open-source coding agents; sandbox-runtime or an E2B-class VM sandbox is the boundary that doesn't depend on reading intent correctly.

If you have no guardrails and one afternoon

Run Promptfoo's red-team against your own agent and fix what it finds. It's free, self-hosted, and the exercise tells you which of the other four picks you actually need — instead of buying a filter for a hole you don't have.

If you want a managed filter and you're not on AWS

Bedrock's ApplyGuardrail API or Google Model Armor both work in front of third-party models. Model Armor is the cheaper start — 2M tokens/month free, then $0.10 per million — and covers indirect prompt injection and malicious URLs; Bedrock wins if you need denied topics or formally verified policy.

If your agent consumes MCP servers or third-party tools

Treat the tool registry as untrusted input: pin and scan servers (Snyk agent-scan, ex-Invariant MCP-Scan), gate them behind an MCP gateway, and put an allowlist on egress. GitGuardian found 24,008 secrets in public MCP configs in 2026, 2,117 of them still valid.

If a customer's security review is what's blocking the deal

Buy a named vendor — Lakera Guard/Check Point, Prisma AIRS or Cisco AI Defense — and map your controls to the OWASP Top 10 for Agentic Applications (Dec 9, 2025). The document is what enterprise reviewers are grading against; the filter is what they'll ask to see evidence for.

Guardrails: the whole field

30 more tools tracked in this category, including 8 dead, renamed, or sunsetting — a reference that hides the graveyard isn't one. Verified 2026-08-06.

Guardrails: the category in numbers

Edition v2026.Q3 · ranking, pricing and status verified 2026-08-06.

• 65% of organizations had at least one security incident in the past year caused by AI agents on their network; 60% cannot terminate a misbehaving agent, 63% cannot enforce purpose limitations, only 19% treat agents as equivalent to human insiders (Cloud Security Alliance + Token Security, Apr 21, 2026) [src]
• Enterprises spend 17x more on AI-powered security than on securing AI itself: $49B "AI-amplified security" vs $2.8B "securing AI" (2025), against $244.2B total infosec spend forecast for 2026 (Gartner, 4Q25 forecast, Dec 18 2025) [src]
• OWASP's State of Agentic AI Security and Governance v2.01 calls prompt injection "the universal joint" and maps it to 6 of the 10 categories in the Agentic Top 10; the top repos by security advisory count are n8n (57), Claude Code (22), AutoGPT (15), Dify (13), Roo-Code (11) (Jun 11, 2026) [src]
• The category consolidated rather than scaled: Palo Alto/Protect AI (~$500M, closed Jul 22 2025), Snyk/Invariant Labs (Jun 24 2025), SentinelOne/Prompt Security (~$250M), Check Point/Lakera (~$300M, Sep 2025), Cato/Aim Security (~$350M), OpenAI/Promptfoo (Mar 9 2026) — six of the best-known independents gone in twelve months [src]
• MCP is the soft underbelly: 24,008 unique secrets exposed in public MCP configs (2,117 still valid, GitGuardian 2026); 82% of 2,614 MCP implementations vulnerable to path traversal and 67% to code injection (Endor Labs); only ~$40M of venture funding across four MCP-security startups [src]
• Money is arriving at the agent-action layer, not the text-filter layer: Zenity raised $125M Series C led by Norwest on Aug 3, 2026, with revenue tripled in each of the past two years [src]

Guardrails: method & sources

Ranking criteria, in order: (1) risk actually removed per hour of setup, (2) cost at startup scale — this element is nominally free and the free options are genuinely the strongest, (3) verifiable adoption, (4) whether the control survives an adversary who reads your config. Editorial picks; no affiliate consideration. Conflicts resolved: Lakera's deal value is reported at ~$300M by Calcalist and venturelab.swiss but Check Point disclosed no terms — we cite the range and flag it. Detection-rate claims (Lakera >98%, Bedrock 88% harmful-content blocking, Bedrock Automated Reasoning 99% accuracy, Lakera 0.01% false positives) are all first-party with no accepted public benchmark to arbitrate them; there is no Terminal-Bench equivalent for guardrails, and the closest thing — Guardrails AI's own Guardrails Index (Feb 2025, 24 guardrails across 6 categories) — is published by a vendor in the field and is now 18 months old. Treat every percentage in this dossier's product claims as vendor-stated unless the source is a survey or a repo. Sourcing weaknesses: the CSA/Token Security 65% figure is reported via Kiteworks rather than the CSA primary PDF and the sample size is not published; the GuardFall and JADEPUFFER incident details come from a community-maintained incident timeline (webpro255/awesome-ai-agent-attacks) rather than the original vendor advisories — the timeline cites sources per entry but a human should confirm the CVE numbers before quoting them. Daytona, Permit.io/Auth0 and Docker MCP Gateway field entries are dated by secondary coverage, not by a fetched vendor pricing page. Scope boundaries: measuring whether your agent works, tracing runs and scoring quality is Ev · Evals & Observability — Langfuse, LangSmith and Braintrust are not here even though several ship "guardrails" features. SOC 2 and security questionnaires are Cm · Compliance. EU AI Act classification is Ai. Static and PR-time code security review is Cq · Code Review. MCP server discovery and connection is Mc; we cover only the security controls around it. Promptfoo straddles Gd and Ev by design — we rank it here for its red-team half, which is this element's canon practice, and it would also earn a place in Ev for its eval half. One editorial position worth stating plainly: 2026's worst agent incidents — Cursor's DuneSlide RCE chain (CVE-2026-50548/50549, Jun 2026), the Semantic Kernel RCEs (CVE-2026-26030/25592, May 2026), the MCP STDIO design flaw reaching 200,000+ instances (Apr 2026) — were not caught or would not have been caught by a content classifier. They were containment failures. Budget accordingly: the free sandbox is a better first purchase than the paid filter. Ranking criteria: verified commercial traction, independent satisfaction surveys, agent benchmarks, and founder-fit (price floor, lock-in, surfaces). Editorial, never paid — the charter. Machine-readable twin: gd.json.

Our take

Every incident story of 2026 is a missing-guardrail story. Scope permissions like you'd scope a new hire's.

Combines with

Appears in compounds

The Agent Stack · The Trust Stack