AI Guardrails Compared: Bedrock vs Azure vs Model Armor vs NeMo

If you build on AWS, start with Amazon Bedrock Guardrails. It has the widest set of policies and works with outside models too. If you build on Azure, use Azure AI Content Safety. Choose Google Model Armor if you want the lowest price per volume and one screening layer across clouds. Choose NeMo Guardrails if your engineers want open source, self-hosted control.

Key takeaways

• Guardrails screen what goes into a model and what comes out. They are one layer of AI safety, not the whole thing.
• All four products detect prompt injection and harmful content. They differ in hallucination checks, data protection, pricing units and where they run.
• Amazon Bedrock Guardrails is the only one with Automated Reasoning checks, which test answers against logical rules you define.
• Google Model Armor is free up to 2 million tokens a month and can scan Office files and PDFs.
• NeMo Guardrails has no license fee, but you host it and write the rules yourself.

Prices below come from each vendor's own pricing page and are as of October 2026.

What are AI guardrails, and why do B2B teams need them?

A guardrail is a check that runs on each prompt before it reaches the model, on each response before it reaches the user, or both. It can block the message, mask part of it (a phone number, say) or just log it.

The risks are well documented. The OWASP Top 10 for LLM Applications 2025 puts Prompt Injection first, followed by Sensitive Information Disclosure. The list also includes Excessive Agency, System Prompt Leakage and Misinformation. A support bot that leaks a customer's details, or an agent that follows instructions hidden in a web page, causes these problems in practice.

You may not need a separate product for every use. If your staff use a chat assistant, the vendor's built-in filters and a clear AI usage policy do most of the work. Guardrails matter most when you ship AI features to customers or run agents that take actions. In both cases you want your own policies and logs, whichever model sits underneath.

How do the four guardrail tools compare?

Amazon Bedrock Guardrails: the most complete policy set

Bedrock Guardrails covers six policy types. Content filters catch hate, insults, sexual content, violence, misconduct and prompt attacks in text and images. Denied topics block subjects you name. Word filters block exact words, such as competitor names. Sensitive information filters block or mask PII and custom patterns. Contextual grounding checks flag answers that are not supported by your source or not relevant to the question. Automated Reasoning checks use formal logic to test answers against rules you define.

Two features matter for larger companies. The ApplyGuardrail API checks content without calling a model, and AWS says it works with self-hosted and third-party models such as OpenAI and Gemini. Cross-account safeguards let a security team enforce one guardrail across an AWS organization. The Standard tier also finds harmful content hidden in code, including comments, variable names and string literals.

AWS claims guardrails "block up to 88% of harmful content". The page gives no test method, so treat that figure as the vendor's own.

Pricing as of October 2026: content filters and denied topics cost $0.15 per 1,000 text units each. Contextual grounding and sensitive information filters cost $0.10. Automated Reasoning costs $0.17 per 1,000 text units per policy. Word filters and regex filters are free. A text unit is up to 1,000 characters, so a 5,600 character input counts as 6 units.

Azure AI Content Safety: the Microsoft stack choice

Microsoft now presents the product as Content Safety in Microsoft Foundry. It detects hate, sexual, violence and self-harm content in text and images. You can set the severity threshold for each category. Prompt Shields catch direct attacks (jailbreaks) and indirect attacks, where instructions are hidden in documents or emails the model reads. Groundedness detection checks answers against source material and can correct ungrounded output. Protected material detection flags known text, such as lyrics and articles, and code that matches public GitHub repositories.

Custom categories let you train a new filter from examples. Microsoft says they currently work well in English only. The core models were trained and tested in English, German, Spanish, Japanese, French, Italian, Portuguese and Chinese.

Pricing as of October 2026: the free tier covers 5,000 text records and 5,000 images a month, and stops at the limit. The Standard tier is pay as you go per 1,000 text records and per 1,000 images. The pricing page did not show the Standard rates when we checked, so get a quote from the Azure calculator. A text record is up to 1,000 characters.

Google Model Armor: cross-cloud screening at a low price

Model Armor screens prompts and responses for prompt injection and jailbreaks, sensitive data through Google's Sensitive Data Protection service, malicious URLs and files, and harmful content such as hate speech, harassment and sexually explicit material. Google says it works with any model, including Gemini, OpenAI, Anthropic and Llama, and with any cloud through a REST API.

Its setup suits security teams. Templates hold the filters and confidence levels. Floor settings define a minimum baseline that every project template must meet. You can start in "Inspect only" mode, which logs without blocking, then switch to "Inspect and block". It can also scan PDF, CSV, TXT, Word, PowerPoint and Excel files up to 4 MB. Integrations include Apigee, Firebase, LangChain and Google's MCP servers.

Pricing as of October 2026: free up to 2 million tokens a month, then $0.10 per additional million tokens. Security Command Center subscriptions include 3 billion tokens a month, and Gemini Enterprise includes it. Google counts a token as roughly four characters.

NeMo Guardrails: open source control for engineering teams

NeMo Guardrails is an open source Python toolkit from NVIDIA, licensed under Apache 2.0. It sits between your code and the LLM. It has five rail types: input rails, dialog rails that shape the conversation, retrieval rails that filter chunks in RAG, execution rails for tool calls, and output rails. You define flows in Colang, a language with Python-like syntax.

It ships with self-check jailbreak detection and heuristics. It can also call NVIDIA's NemoGuard models for jailbreak detection, topic control and content safety, such as Llama 3.1 NemoGuard 8B Content Safety. For production, NVIDIA offers a NeMo Guardrails microservice that runs on Kubernetes with Helm and uses the same configuration.

The trade-off is effort. You get full control and no license fee, but your team writes the rules, hosts the service and keeps it current.

What about OpenAI's free moderation endpoint?

If you build on the OpenAI API, the moderation endpoint is a free baseline. The omni-moderation-latest model classifies text and images across 13 categories, such as harassment, hate, illicit, self-harm, sexual and violence. Six of those categories also apply to images. It is a classifier, not a full guardrail layer. It does not mask PII, check grounding or apply your own topic rules.

What does screening cost at volume?

Take one million prompts of about 2,000 characters each, screened on input only, at October 2026 list prices.

• Bedrock Guardrails: each prompt is 2 text units. Content filters plus denied topics cost $0.30 per 1,000 units. That is about $600.
• Model Armor: 2,000 characters is roughly 500 tokens, so 500 million tokens. After the free 2 million, that is about $50.
• NeMo Guardrails: no license fee. The cost is the compute for the service and any safety models it calls.

This is a rough comparison. The units differ, and the products do not check the same things. Add output screening, and price each extra policy you turn on.

How to choose an AI guardrail tool

1. Start with your cloud. Billing, identity and logs are simpler when the guardrail runs where your models do.
2. List your top three risks. For customer-facing bots, it is usually prompt injection, PII leaks and made-up answers. Check that each risk maps to a specific policy in the product.
3. Test on your own data. Run a few hundred real prompts, including known attacks, in log-only mode before you block anything. Track false positives as closely as misses.
4. Check language coverage. Azure and Model Armor list the languages their models were tested in. Confirm yours is there.
5. Plan for agents. Guardrails catch bad text. They do not replace narrow permissions, human approval for risky actions and audit logs, especially once agents connect to tools through MCP.
6. Ask the vendor the same safety questions you ask any AI supplier. Our AI vendor security checklist covers data retention, training on your data and contract terms.

Bottom line

There is no single best guardrail product. There is the best fit for your stack. AWS teams get the broadest policy set in Bedrock Guardrails. Microsoft teams get Prompt Shields and groundedness detection in Azure AI Content Safety. Model Armor is the low-cost choice for screening across clouds and models. NeMo Guardrails suits engineers who want open source code they can change. Whichever you pick, test it on your own traffic first, and treat it as one layer in your AI safety plan. To see which tools are gaining ground this week, check the rankings.