AI Agent Guardrails: NeMo vs Guardrails AI vs Llama Guard

If you have shipped anything on top of an LLM, you have probably typed “NeMo Guardrails vs Llama Guard” into a search bar and come away more confused. The names get thrown around as if they are rival products competing for the same slot in your stack. They are not. AI agent guardrails come in three distinct layers, and most of the confusion in this space comes from comparing tools that were never meant to compete.

Quick verdict

The single most useful thing to understand about LLM guardrails is that they are layers you mix and match, not competitors you choose between. There are three:

1. Orchestration frameworks - open-source libraries that chain checks together (NeMo Guardrails, Guardrails AI, LLM Guard, LlamaFirewall).
2. Safety classifier models - model weights you host that label content (Llama Guard, ShieldGemma) plus hosted classifiers (OpenAI Moderation, Perspective).
3. Managed security APIs - hosted services you call (Azure AI Content Safety, AWS Bedrock Guardrails, Lakera Guard).

Here is the fast answer to “which do I use”:

The right answer for a production agent is almost never one tool. It is defense in depth - an input classifier for injection, an output validator for structure and PII, and a content classifier, ideally enforced at the gateway. More on that below.

What are the three layers of AI agent guardrails?

Think of it like a security stack. One layer decides the logic of what to check and when. Another provides the intelligence that actually labels a piece of text as safe or unsafe. A third packages both into a managed service so you do not run anything yourself.

Getting this framing right saves you weeks. A team that adopts Llama Guard expecting it to block prompt injection, or adopts Guardrails AI expecting it to script a conversation, has picked the wrong layer for the job.

Layer 1: which orchestration framework fits?

These are the OSS libraries that wrap your LLM calls and run a pipeline of checks. This is where the “vs” debates usually happen, so it is worth being precise about what each one is actually good at.

NeMo Guardrails is the differentiated one because it models conversation flow, not just individual messages. It offers five rail types: input rails (jailbreak and injection detection, moderation), dialog rails (topical control and scripted flows - the part nothing else does well), retrieval rails (filter RAG chunks), execution rails (guard tool calls), and output rails (moderation, self-check for hallucination, PII). The catch is Colang, its own domain-specific language, which is powerful but a real learning curve, and the extra embedding and self-check LLM calls add latency.

Guardrails AI is the most-starred pure guardrails library and it owns output validation. Its core pattern is validate-then-fix-or-reask: you wrap an LLM call in composable validators (“Guards”), define an output contract with Pydantic (or legacy RAIL XML), and set per-validator on-fail actions - reask, fix, filter, refrain, or raise an exception. The Guardrails Hub is effectively a package manager for guardrails, an installable registry of pre-built validators. What it does not do is model a conversation, and reask retries cost you extra tokens and latency.

LLM Guard is the batteries-included security stack, but read the fine print. It bundles input and output scanners - PromptInjection, Anonymize/PII, BanTopics, Secrets, Toxicity, MaliciousURLs and more - built from transformer classifiers, regex, and Microsoft Presidio, and it ships as a FastAPI service you can drop in front of your app. The important 2026 caveat: the repo is now archived and frozen. Protect AI was acquired by Palo Alto Networks (completed July 2025) and its technology anchors PANW’s Prisma AIRS. It is stable, but for anything new lean to a maintained path.

LlamaFirewall is the notable newer entrant for agentic pipelines. From Meta’s PurpleLlama project, it is designed as a final defense layer for agents and combines Prompt Guard 2 (jailbreak detection), AlignmentCheck (the first OSS guardrail to audit an agent’s chain-of-thought in real time for goal hijacking and injection-induced misalignment), and CodeShield (static analysis of generated code). If your agents write code or chain tool calls, it is worth a look.

A quick note on the graveyard and the adjacencies: Rebuff is archived, LangKit is dormant, Semantic Router is a cheap embedding-based topical gate rather than a full guardrail, and LangChain now ships built-in middleware guardrails you may already have on hand.

Layer 2: which safety classifier model should you host?

These are model weights, not frameworks. They take text (and sometimes images) and return labels. You run them yourself, or call a hosted version, and you plug the result into a framework from Layer 1.

Llama Guard 4 is the 2026 flagship for self-hosted moderation. It is natively multimodal (text and image), pruned from Llama 4 Scout, and uses the MLCommons-aligned 14-hazard taxonomy. Llama Guard 3, in 1B, 8B, and 11B-Vision sizes, is still widely used where you want something lightweight or edge-friendly. The key limitation: Llama Guard is a content classifier, so it will not catch prompt injection on its own - pair it with Prompt Guard 2, which is a tiny, cheap injection classifier meant for input pre-filtering. Together they cost nothing per call, run on-prem, and can be fine-tuned to your policy.

If you want a fully managed, zero-cost content check, OpenAI’s Moderation API flags 13 categories across text and image for free, though it does nothing for injection, PII, or grounding. Perspective API is a free toxicity-only classifier if that is all you need.

Layer 3: which managed security API covers the most?

If you would rather not host classifiers or wire up a framework, the cloud vendors sell guardrails as a policy-driven service.

Azure AI Content Safety is the breadth play and the obvious pick if you already live in Azure. Its Prompt Shields catch both direct jailbreaks and indirect, cross-domain injection hidden in documents and RAG context - the kind of attack we dig into in our post on prompt injection in enterprise AI - and Groundedness detection flags (and can optionally correct) hallucinations.

AWS Bedrock Guardrails is the policy play, model-agnostic and driven by denied topics, content filters including prompt attacks, and PII across 50+ entity types. Its real differentiator is Automated Reasoning checks, which use formal verification to test factual claims rather than another probabilistic model. The ApplyGuardrail API even works against models outside Bedrock.

Lakera Guard is the dedicated, continuously red-teamed vendor, strong on prompt injection, PII, and agent, RAG, and MCP defense, with its detection backed by the famous Gandalf dataset. Heads up: Lakera was acquired by Check Point (announced September 2025), so product naming is in flux.

The coverage matrix: what actually catches what?

This is the table to keep. A check mark means the tool addresses that concern out of the box; a dash means it does not, or needs another layer to do it.

Notice that no single row is all green. That is the point.

What changed in 2026?

Three shifts matter for anyone choosing guardrails this year.

Guardrails moved to the gateway. The cleanest place to enforce policy is a centralized AI gateway or proxy running guardrail hooks, so every call from every team passes through the same checks. If you are already routing traffic through one, add guardrails there - see our breakdown of LLM gateways compared.

A big M&A wave reshaped the map. Lakera went to Check Point, Protect AI (LLM Guard) went to Palo Alto, and promptfoo went to OpenAI. Acquisitions change roadmaps, pricing, and support commitments, so factor the owner into any multi-year bet.

Red-teaming is table stakes. Shipping a guardrail without adversarially testing it is shipping a guess. Bake attack simulation into your pipeline the same way you bake in evaluation - our guide on how to evaluate and test AI agents covers the workflow, and pairing guardrails with strong agent observability is how you know they are working in production.

So which AI agent guardrails should you pick?

Stop thinking “which one” and start thinking “which combination”. A solid default for a production agent looks like this:

• Input: an injection classifier (Prompt Guard 2, Azure Prompt Shields, or Lakera) on every incoming message.
• Output: a validator (Guardrails AI) for structure and a PII scanner before anything reaches a user or a downstream tool.
• Content: a classifier (Llama Guard 4, ShieldGemma, or a managed moderation API) to catch harmful content in both directions.
• Flow, if you need it: NeMo Guardrails when the conversation itself has to stay on rails.
• Placement: enforce it all at the gateway so nothing bypasses the checks.

That is defense in depth. Any one layer will fail eventually; the stack is what keeps a single failure from becoming an incident.

Getting the layering right for a real agent - and keeping it tuned as new attacks appear - is exactly the kind of work we do. If you are building agents that need to be safe in production, our AI Agent Development team can design the guardrail stack with you, and Enterprise AI Integration can wire it into the tools and gateway you already run.