Choosing a Guardrail Provider
Guardrails enforce content policy before a request reaches an upstream model, after the model responds, or at both hook points. Choose a guardrail based on where content can be evaluated, what it must detect, and whether matching content should be blocked or masked.
The same gateway guardrails are available through AISIX Cloud and the open-source AISIX gateway, and both scope a guardrail the same way: an attachment binds it to an environment or to selected resources, and a guardrail nothing attaches inspects no traffic. AISIX Cloud writes the attachment when you pick a scope; the resources file declares it in a guardrail_attachments collection.
Before configuring a provider, review Guardrail Behavior to choose hook points, enforcement, scoping, and failure policies. Then use the provider's setup guide for its configuration fields, detection rules, and verification requests. The built-in keyword and PII guides provide complete procedures for both products.
Provider Comparison
Use the comparison to identify where a guardrail evaluates content and whether it supports the action your policy requires:
| Kind | Provider | Evaluation Location | Detects | Actions |
|---|---|---|---|---|
keyword | Built-in | Inside AISIX | Literal and regular-expression patterns | Block |
semantic | Built-in | AISIX compares embeddings locally; selected text is sent to the configured embedding model endpoint | Text semantically similar to your examples, including reworded attempts that share no keywords | Block |
pii | Built-in | Inside AISIX | Rule-based PII, such as email addresses, phone numbers, IDs, cards, keys, and custom patterns | Mask or block |
presidio | Presidio | Self-hosted Presidio service | Rule-based and NER/ML PII entities, such as PERSON and LOCATION | Mask with replace, mask, hash, or redact operators; or block |
lakera | Lakera Guard | Lakera API | Prompt injection, jailbreaks, unsafe content, and PII | Block; mask PII-only detections |
azure_content_safety | Azure AI Content Safety | Azure API | Prompt injection and jailbreaks through Prompt Shield | Block |
azure_content_safety_text_moderation | Azure AI Content Safety | Azure API | Hate, sexual, self-harm, and violence severity categories, plus blocklists | Block |
openai_moderation | OpenAI Moderation | OpenAI API | Harassment, hate, violence, sexual, self-harm, and other content categories | Block |
bedrock | AWS Bedrock Guardrails | AWS Bedrock service | Content filters, denied topics, sensitive information, and word filters | Block; mask PII configured with ANONYMIZE |
aliyun_text_moderation | Alibaba Cloud Content Moderation | Alibaba Cloud API | Risk-level content moderation | Block |
aliyun_ai_guardrail | Alibaba Cloud AI Guardrails | Alibaba Cloud API | Console-policy composite checks: content compliance, prompt attacks, and sensitive data | Block; mask sensitive data per console policy |
custom | Your own script | Wherever your script calls, from inside your gateway | Whatever you implement, for a screening service AISIX has no built-in integration with | Block or mask, as your script decides |
Every listed guardrail can inspect caller requests, model responses, or both. Guardrail Behavior explains their shared hook points, enforcement modes, scoping, streaming behavior, failure handling, and caller responses.
Choose a Guardrail by Goal
After narrowing the available providers, match the policy goal to a practical starting point:
| Goal | Start With | Consider Also |
|---|---|---|
| Detect or redact PII | Built-in PII, which runs inside AISIX and supports rule-based detectors plus custom patterns. | Presidio for entities that regular expressions cannot express, such as names, locations, or nationalities. Presidio also supports self-hosted evaluation and hash or placeholder replacement. Consider AWS Bedrock or Lakera when you already use those providers. |
| Detect prompt injection and jailbreaks | Lakera Guard or Azure Prompt Shield. | Attach both when a security review requires independent providers. Both can screen indirect injection carried in retrieved documents or tool results included in a conversation. |
| Moderate content categories | OpenAI Moderation for its standard category set. | Azure Text Moderation for per-category severity thresholds and server-side blocklists, or the Alibaba Cloud guardrails within that provider ecosystem — AI Guardrails for console-managed composite policy with sensitive-data masking, Content Moderation for AISIX-side risk thresholds. |
| Enforce organization-specific rules | Built-in keyword guardrail. | Match literal or regular-expression patterns without an external dependency. |
| Catch attempts that are rephrased to evade a pattern list | Built-in semantic screening guardrail. | Match by meaning rather than wording; candidate texts from one hook are sent in one batched embedding request. |
| Screen against a service AISIX has no integration with | Custom script guardrail. | Write the translation as a script the gateway runs, rather than deploying an adapter service in front of your own. See Qwen3Guard Guardrails for a worked example that screens with an open-source guard model you run yourself. |
Detection-based guardrails can produce false positives and false negatives, so evaluate a new policy in monitor mode before enforcing it on production traffic. See Guardrail Behavior.
What the Gateway Records
Usage records identify the applied guardrails, monitor-mode observations, blocked decisions, and the fail-open bypass reason. Every route's usage event carries the bypass reason; the rest of the guardrail evidence varies by endpoint. See The Bypass Reason.
Caller-facing error responses do not include the matched request or response body. Guardrail-specific fields in usage records created by gateways with the current telemetry behavior do not copy the matched body or script-provided reasons and counts. A telemetry exporter configured with content_mode: full can still capture the request body when an input guardrail blocks it; protect that destination as content-bearing. AISIX Cloud stores guardrail usage detail verbatim, so records created by older gateways can retain script-provided values derived from request content or secrets; upgrading does not rewrite those records. Keep access to legacy usage data restricted accordingly. Operator logs can include the matched literal or regular-expression rule for a built-in keyword block. The provider guides show the redaction tokens and block-response shapes for each guardrail kind.
Next Steps
Review Guardrail Behavior, then open the selected provider's setup guide from the comparison table.