| QWED | Deterministic engines: SymPy, Z3, SQLGlot, AST rules and JSON Schema. On the natural-language paths a model translates the text into a formal statement; that step is not verified, and no model decides the verdict. | Stopped by defaultAn error comes back BLOCKED · DENY. A claim that no engine can prove comes back UNVERIFIABLE · DENY. Only a proven claim is admitted. | Your integration, or a QWED product such as QWED Security, acts on the decision. QWED does not stop anything by itself. |
|---|
| NVIDIA NeMo Guardrails | Whatever each rail is configured with: Colang flows, Python actions, an LLM checking itself, NVIDIA safety models, jailbreak heuristics or third-party services. Tool-call validation against a JSON Schema in the IORails engine uses no model. | Depends on configurationThe docs say no library-wide failure policy applies to every rail. The IORails engine blocks when a rail fails; the default LLMRails engine returns a fixed internal-error reply; some third-party rails offer a fail-open setting. | The library, on the paths the app routes through it. With check(), the app receives a passed, modified or blocked status and acts on it. The app runs tools and handles identity. |
|---|
| Guardrails AI | Validators chosen per guard. Some are rules, such as regular expressions; some run machine-learning models, such as PII or toxic-language detectors; some call an LLM. | Depends on configurationA failed validation raises an exception by default (on_fail is EXCEPTION). A validator that errors re-raises to the app. No error or timeout policy is documented, so the result of an error depends on the validator. | The Guard object in the app’s process raises, filters, fixes or asks again, as each validator’s on_fail says. The app must catch the exception. |
|---|
| Meta LlamaFirewall | PromptGuard 2, a classifier model, for prompt injection. AlignmentCheck, an LLM judge, for the agent’s trace. CodeShield, built on Semgrep and regular expressions, for code. | Depends on configurationNot documented; the code differs by scanner. When AlignmentCheck’s model call fails, it holds the trace for a person. When the trace or the user message is missing, it allows with an error status. | The app. scan() returns a decision, a reason and a score; the library does not halt the agent itself. |
|---|
| OpenAI Guardrails and Agents SDK guardrails | The library: per check, an LLM, the OpenAI Moderation API, rules such as keyword and URL filters, or Presidio for PII. The SDK: the developer’s own guardrail function, which may call a model or run plain code. | Goes through by defaultThe library’s default mode passes content on when a check errors; raising instead is an opt-in setting. The SDK re-raises an error in a guardrail and ends the run, but input guardrails run in parallel by default, so tools may already have run. | The library’s client wrapper raises a tripwire exception that the app catches. The SDK’s Runner raises and halts the run. |
|---|
| Microsoft Agent Governance Toolkit | A policy engine: Open Policy Agent Rego, Cedar, or one the host supplies. Optional annotators, including an LLM, add labels that the policy reads. | Stopped by defaultThe specification says any error during evaluation yields a deny, and an annotator timeout fails closed. When no rule matches, the policy’s own default decides; the quick-start example allows. | The host, through AGT’s SDKs, adapters or govern() wrapper. The specification calls a host that ignores a deny non-conformant. The engine runs in the agent’s process. |
|---|
| Amazon Bedrock Guardrails: Automated Reasoning checks | Several foundation models translate the text into formal logic; their agreement sets a confidence score. Formal logic validation against the policy then returns a finding such as VALID, INVALID or TRANSLATION_AMBIGUOUS. The policy itself is extracted by models from your own document. | Goes through by defaultThe checks return findings and do not block content. When nothing can be translated, AWS recommends serving the response without validation. A request without the guardrail tag skips the check with no error. | The application decides what to do with the findings. Other Bedrock Guardrails policies can block; these checks do not. |
|---|