Choosing a Guardrail Provider

AISIX enforces content policy through guardrails: checks that run on a caller request before it reaches the upstream model, on a model response before it reaches the caller, or both. Each guardrail is one kind with its own provider, capabilities, and configuration.

The comparison below helps narrow the choice before you follow a provider-specific setup guide.

Provider Comparison

Kind	Provider	Evaluation Location	Detects	Actions
keyword	Built-in	Inside AISIX	Literal / regex patterns	block
pii	Built-in	Inside AISIX	Rule-based PII (email, phone, ID, card, keys, …) + custom regex	mask, block
presidio	Microsoft Presidio	Self-hosted Presidio service	Rule-based and NER/ML PII entities (PERSON, LOCATION, …)	mask (replace / mask / hash / redact operators), block
lakera	Lakera Guard	Lakera API	Prompt injection, jailbreak, content, PII	block; PII-only detections mask
azure_content_safety	Azure AI Content Safety	Azure API	Prompt injection / jailbreak (Prompt Shield)	block
azure_content_safety_text_moderation	Azure AI Content Safety	Azure API	Category severity (hate, sexual, self-harm, violence) + blocklists	block
openai_moderation	OpenAI Moderation	OpenAI API	Content categories (harassment, hate, violence, sexual, self-harm, …)	block
bedrock	AWS Bedrock Guardrails	AWS Bedrock service	Content filters, denied topics, sensitive information, word filters	block; PII ANONYMIZE masks
aliyun_text_moderation	Alibaba Cloud AI Guardrails	Alibaba Cloud API	Risk-level content moderation	block

All listed guardrail kinds can run on caller requests, model responses, or both. They share the same platform controls for hook points, enforcement modes, remote failure handling, and caller responses. See Guardrail Behavior.

Choose a Guardrail by Goal

Goal	Start With	Consider Also
Detect or redact PII	Built-in PII guardrail, because it runs inside AISIX with no external calls and covers rule-based detectors plus custom regex.	Presidio for entities a regex cannot express, such as person names, locations, or nationalities. Presidio also supports a self-hosted compliance posture and hash or placeholder replacement. AWS Bedrock and Lakera are options when you already use those providers.
Detect prompt injection and jailbreaks	Lakera Guard or Azure Prompt Shield.	Attach both if your security review calls for independent providers. Both can screen indirect injection carried in retrieved documents or tool results that appear in the conversation.
Moderate content categories	OpenAI Moderation for the standard category set.	Azure Text Moderation for per-category severity thresholds and server-side blocklists. Alibaba Cloud is the natural choice inside that ecosystem.
Enforce organization-specific rules	Built-in keyword guardrail.	Use it for literal or regex patterns with no external dependency.

Detection-based guardrails can produce false positives and false negatives, so evaluate a new policy in monitor mode before enforcing it on production traffic. See Guardrail Behavior.

What the Gateway Records

Every request records which guardrails governed it, whether one blocked it, and why a guardrail was skipped for fail-open bypasses. Matched content never appears in gateway logs, usage records, or error responses. AISIX records only detector, entity, or category names. See the per-kind guides for the exact redaction-token and block-envelope shapes.

Next Steps

After you choose a provider, open its setup guide from the comparison table.