Guardrail products are probabilistic filters bought to solve an architecture problem: useful as a detection layer on top of a cut trifecta leg, dangerous as the only line of defence.

What this category solves (and what you did before it)

Input and output classification for injection attempts, PII, banned topics and policy violations. Before it: regex DLP and hope. The category is real and worth money. It is also routinely bought to do a job it structurally cannot do.

What actually differentiates products

Out-of-process versus in-process. This is the buying criterion nobody puts on the comparison sheet and the one that decides whether a firm has a control. Guardrails implemented inside the agent run within the agent’s own process and under its own authority. An agent that can write code can in principle write code that bypasses its own guardrails, and in-process guardrails cannot be audited, updated or enforced independently of the agent they constrain. That makes them self-regulation rather than governance. A proxy or gateway sitting outside the agent’s authority is a different product, whatever the marketing calls both.

Content evaluation versus trajectory evaluation. The clearest statement of the boundary: a content filter can detect that an email contains a Social Security number; it cannot detect that the email was sent after the agent read confidential deal data from a restricted database. The violation is in the trajectory, not the content. Two independent 2026 papers, different authors and institutions, land on the same limit: per-step content evaluation misses cross-step sequences.

Deployment mode and tunability against the firm’s own corpus. Published catch rates differentiate least, because attackers move and vendors benchmark themselves.

Tier

Day 2. Layer them on after the architectural controls. A filter in front of an uncut lethal trifecta is theatre with a dashboard.

Named examples

Amazon Bedrock Guardrails is the incumbent platform option and its scope is stated plainly by its own vendor: it evaluates input prompts and model completions (content filters, denied topics, word filters, sensitive-information filters, contextual grounding checks) and explicitly excludes reasoning content blocks. No tool-call, trajectory or sequence evaluation appears anywhere in the product surface, and that is the product doing what it says rather than a shortfall.

Llama Guard is the most-cited open classifier, and worth naming for a reason its citers rarely mention: it is a December 2023 chat-era safety classifier for human-AI conversations, still being offered in 2026 as a representative agent guardrail, a measure of how thin the incumbent layer is.

LlamaFirewall is the counterexample, the category starting to move toward trace inspection, and it gets miscategorized constantly, including by academic papers. Rather than a text-level filter, it combines a jailbreak detector with a chain-of-thought auditor that inspects agent reasoning for injection and goal misalignment, plus static analysis of generated code.

Invariant is the clearest trace-level example: a rule-based guardrail layer deployed as a proxy between the application and its tools, evaluating Python-like rules over agent traces. Its own worked example is exactly the trajectory case above: block an email send that follows a suspicious web request. It is Apache-2.0 licensed, still active, and now owned by Snyk (acquired 24 June 2025).

The honest verdict on detection

The most authoritative statement comes from the people best placed to be self-serving about it and who weren’t. A fourteen-author paper spanning Invariant Labs, Google, Microsoft, IBM, ETH and EPFL (including people who ship guardrail products) concludes that detection-based defences raise the bar for attackers, who must now deceive both the primary model and the detector, while remaining heuristic at bottom and unable to guarantee prevention of all attacks; the same section calls the family heuristic three separate times.

OWASP is equally direct in its own prompt-injection guidance: given the stochastic nature of these models, it is unclear whether any fool-proof prevention method exists, and filtering is one of seven layers rather than a solution. Practitioner decks aimed at this audience recommend “implement prompt-injection detectors to identify and block” with no such qualifier, and the qualifier is the important part.

One claim circulating in consulting material (that the exposed organizations are precisely those who deployed content filters without architectural input separation) is an empirical assertion about who got hurt, with no incident data, breach set or survey behind it, and the attribution to the model vendor misstates that vendor’s framing. The underlying point is right and better made from the primary literature above.

The enterprise bar

SOC 2 Type II, ISO 27001, deployment mode (self-host matters more here than in most categories, because prompts are the most sensitive thing a firm holds), SSO and SCIM, RBAC, environment separation, exportable audit logs, zero retention, no-training terms, audit rights, viability and exit path.

Two category-specific questions. Does the product run outside the agent’s authority? And what is the false-positive rate at the chosen operating point? A defence that blocks 95% of attacks at a 40% false-positive rate is unusable, and most published evaluations omit the second number entirely.

M&A state and category maturity

Young and consolidating fast, into gateways, application-security platforms and model-provider stacks. The pattern is stark: the independent trace-guardrail vendor that an October 2024 academic paper named as the example of runtime scanning was acquired by an AppSec incumbent within eight months. Across the adjacent red-teaming and guardrail space, most of the recognizable independent names of 2024–25 have been bought by security incumbents or model providers, with several deals closing in late 2025 and the first half of 2026 (state of the market as verified 2026-07-27; check current ownership before signing, because this list ages in months).

The standalone guardrail vendor is a feature waiting to be acquired. Price the contract accordingly: short term, exportable configuration, and no dependence on a proprietary policy language that would have to be rewritten.

Where the category is immature

It sees text well and sequences badly. Nothing in the shipping mainstream evaluates which application of a tool is permitted, and the products that inspect traces are the newest and least proven. Buy them for defence in depth on top of a cut trifecta leg, never as the leg itself. See dual-LLM quarantine and friends for the architectural alternatives that have provable properties instead of measured catch rates.

See also

• Prompt injection and goal hijack — the concern these products claim to answer, and why they only partly do.
• The lethal trifecta — the mental model that assigns guardrails their correct, secondary place.
• Dual-LLM quarantine and friends — the architectural alternatives with provable properties.
• Runtime guardrails and policy enforcement — the control family; this page is who sells it.
• AI gateways (and MCP gateways) — the deployment point guardrails usually sit behind.
• Agent runtime security — the adjacent category promising the trajectory evaluation this one lacks.