# Gd · Guardrails — element 51 of 58 > The seatbelt for agents. Turns agent autonomy into bounded autonomy. - **Group:** 11 · Trust & Compliance - **Necessity:** Optional - **Price band:** Free - **Maturity:** Experimental - **Edition:** v2026.Q3 · verified 2026-09-13 ## Leading tools (v2026.Q3) - **Promptfoo** — break it before users do - **sandbox-runtime** — os-level agent containment - **NVIDIA NeMo Guardrails** — programmable rails, open source - **Amazon Bedrock Guardrails** — managed rails, any model - **Lakera Guard** — enterprise injection defense ## Our take Every incident story of 2026 is a missing-guardrail story. Scope permissions like you'd scope a new hire's. ## Combines with Ev, Ag ## The top 5 — deep dossier (verified 2026-09-13) Guardrails is a stack, not a product — and the free bottom two layers buy you more safety than any paid filter. Start with Promptfoo to find out which guardrail you're missing (free, open source, 350k developers, and OpenAI paid for it in March 2026), then put Anthropic's sandbox-runtime or an E2B-class sandbox underneath every agent that touches a shell — 2026's worst incidents were containment failures, not classifier failures. Add NeMo Guardrails when you need programmable tool-call rails you can self-host; Bedrock Guardrails when you want a managed filter that works with any model, including OpenAI and Gemini; Lakera Guard (now Check Point) when a buyer demands a vendor SLA and sub-50ms injection detection you didn't build. 1. **Promptfoo** (Promptfoo, Inc. → OpenAI (acquired Mar 9, 2026)) — Community free (all evals, all providers, 10k red-team probes/mo, self-hosted) · Enterprise custom · On-Premise custom. Best for: Finding the guardrail you forgot — adversarial testing of prompts, agents and tool calls, run locally and wired into CI. Why: The canon red-team practice with the adoption to match: 350,000+ developers, 130,000 monthly actives, and teams at 25%+ of the Fortune 500 as of the March 2026 acquisition post. It generates attacks per plugin (harmful content, BOLA/BFLA authorization bypass, tool-based privilege escalation) rather than replaying a static jailbreak list, which is what catches agent-specific holes. OpenAI bought it to secure its own agents and committed publicly to keeping it open source under the current license. Watch: It tests; it does not enforce. A green promptfoo run is not a runtime control, and nothing here blocks a live request. The OpenAI acquisition also puts the category's most-used neutral scanner inside a frontier lab — the OSS pledge is a pledge, not a governance structure. [https://www.promptfoo.dev](https://www.promptfoo.dev) 2. **sandbox-runtime** (Anthropic (Apache-2.0, beta research preview)) — Free · Apache-2.0 · no service, no account. Best for: Putting a hard filesystem and network boundary around any agent process — coding agents especially — without containers or a cloud bill. Why: The layer that actually held in 2026. It wraps arbitrary processes in OS-native primitives (sandbox-exec on macOS, bubblewrap on Linux, WFP on Windows in alpha) so an agent's blast radius is deterministic rather than a function of how well a classifier read the prompt. Anthropic reports an 84% reduction in permission prompts after moving Claude Code from approval-gating to sandboxing — the rare control that makes agents both safer and less annoying. 4.6k stars and v0.0.64 shipping Jul 7, 2026. Watch: Explicitly a "beta research preview": Windows support is alpha, and the API is not stable. It does nothing about content — no injection detection, no PII, no topic control. And a sandbox with an over-broad network allowlist is theatre; the config is the product. [https://github.com/anthropic-experimental/sandbox-runtime](https://github.com/anthropic-experimental/sandbox-runtime) 3. **NVIDIA NeMo Guardrails** (NVIDIA (Apache-2.0)) — Free · Apache-2.0 · self-hosted; NemoGuard NIM microservices require NVIDIA AI Enterprise licensing (not publicly priced). Best for: Teams that want programmable, self-hosted rails — including rails on tool calls — rather than a hosted moderation endpoint. Why: The most complete open guardrail toolkit: five distinct rail stages (input, retrieval, dialog, execution, output), where execution rails let you validate a tool call before the agent makes it — the control that maps to the actual 2026 failure mode. Colang gives you deterministic dialog policy instead of prompt-begging, and the NemoGuard NIMs (Safety Guard 8B, Jailbreak Detection, Topic Control) drop in as classifiers if you'd rather not train your own. 6.9k stars, 802 forks, v0.23.0, Python 3.10–3.13. Watch: Colang is a language you have to learn, and the config surface sprawls fast. Every rail is another LLM call, so latency and token cost stack; teams routinely ship with rails disabled in the hot path. The best detectors are NVIDIA NIMs behind enterprise licensing, so the free tier is the scaffolding, not the models. [https://github.com/NVIDIA-NeMo/Guardrails](https://github.com/NVIDIA-NeMo/Guardrails) 4. **Amazon Bedrock Guardrails** (AWS) — Usage-based, no subscription: content filters & denied topics $0.15/1k text units · sensitive-info filters $0.10 · contextual grounding $0.10 · Automated Reasoning $0.17 per policy · word filters and regex free · standalone InvokeGuardrailChecks prompt-attack $0.08/1k (1 text unit = 1,000 characters). Best for: Shipping a managed filter today without building one — including in front of models you don't host on AWS. Why: The ApplyGuardrail API is the quiet win: AWS lets you apply the same policy to any foundation model, "whether hosted on Amazon Bedrock or self-hosted models, including third-party models such as OpenAI and Google Gemini." It's also the only mainstream rail with formal verification — Automated Reasoning checks (GA Aug 2025) translate your policy into logic and produce auditable, mathematically verifiable validation decisions, which is a different category of evidence from a classifier's confidence score. Watch: The headline numbers — "blocks up to 88% of harmful content", "99% accuracy" on Automated Reasoning — are AWS's own, with no independent benchmark to check them against. Per-1k-character billing gets expensive on long agent contexts, every enabled policy is a separate charge and a separate round trip, and you're inside an AWS account. It filters text, not actions: it will not stop an agent from calling the wrong tool. [https://aws.amazon.com/bedrock/guardrails/](https://aws.amazon.com/bedrock/guardrails/) 5. **Lakera Guard** (Lakera → Check Point Software (announced Sep 16, 2025)) — Not published — enterprise via Check Point sales; SaaS and self-hosted deployment options. Best for: Startups selling into enterprises that want a named vendor, an SLA and a real adversarial dataset behind the injection filter. Why: The best-sourced commercial detector in the category. Lakera's Gandalf game turned prompt-injection into crowdsourced R&D — 80M+ adversarial patterns and 1M+ contributing hackers feeding the detector, across 100+ languages. Check Point states >98% detection at sub-50ms runtime latency with <0.5% false positives, and made Zurich its Global Center of Excellence for AI Security. Post-acquisition the product line broadened past the filter into workforce AI security, agent security and red-teaming services. Watch: No public pricing at all — the least startup-friendly entry on this list, and you're now buying from a large network-security vendor whose roadmap answers to CloudGuard, not to you. All performance figures are first-party. Detection percentages on prompt injection are also structurally soft: there is no accepted public benchmark, so >98% is a claim about Lakera's own test set. [https://www.lakera.ai/](https://www.lakera.ai/) ### How to choose - If Your agent can run a shell, write files or reach the network → Sandbox first, filter second. Adversa's GuardFall work (Jun 2026) bypassed pattern-based command guards in 10 of 11 open-source coding agents; sandbox-runtime or an E2B-class VM sandbox is the boundary that doesn't depend on reading intent correctly. - If You have no guardrails and one afternoon → Run Promptfoo's red-team against your own agent and fix what it finds. It's free, self-hosted, and the exercise tells you which of the other four picks you actually need — instead of buying a filter for a hole you don't have. - If You want a managed filter and you're not on AWS → Bedrock's ApplyGuardrail API or Google Model Armor both work in front of third-party models. Model Armor is the cheaper start — 2M tokens/month free, then $0.10 per million — and covers indirect prompt injection and malicious URLs; Bedrock wins if you need denied topics or formally verified policy. - If Your agent consumes MCP servers or third-party tools → Treat the tool registry as untrusted input: pin and scan servers (Snyk agent-scan, ex-Invariant MCP-Scan), gate them behind an MCP gateway, and put an allowlist on egress. GitGuardian found 24,008 secrets in public MCP configs in 2026, 2,117 of them still valid. - If A customer's security review is what's blocking the deal → Buy a named vendor — Lakera Guard/Check Point, Prisma AIRS or Cisco AI Defense — and map your controls to the OWASP Top 10 for Agentic Applications (Dec 9, 2025). The document is what enterprise reviewers are grading against; the filter is what they'll ask to see evidence for. ### The field (30 more) Google Model Armor, Microsoft Foundry guardrails (renamed), Meta LlamaFirewall, Llama Guard 4 / Prompt Guard 2, Guardrails AI, OpenAI Guardrails, OpenAI Moderation API, Prisma AIRS (acquired), Snyk Agent Scan / MCP-Scan (acquired), Prompt Security (acquired), Aim Security (acquired), Cisco AI Defense, Zenity, HiddenLayer, WitnessAI, Pillar Security, NeuralTrust TrustGate, garak, PyRIT, DeepTeam, Giskard, Mindgard, Gray Swan AI, E2B, Daytona, Docker MCP Gateway / Runlayer, Auth0 for AI Agents / Permit.io, LLM Guard (dead), Rebuff (dead), Robust Intelligence (renamed) Full dossier data: https://elems.ai/e/gd.json --- Source: [elems.ai](https://elems.ai/e/gd.html) — the periodic table of the AI-led startup. Data: https://elems.ai/elements.json (CC BY 4.0, cite elems.ai).