Choosing a Guardrail Provider
Guardrails enforce content policy before a request reaches an upstream model, after the model responds, or at both hook points. Choose a guardrail based on where content can be evaluated, what it must detect, and whether matching content should be blocked or masked.
Before configuring a provider, review Guardrail Behavior to choose hook points, enforcement, scoping, and failure policies. Then use the provider's setup guide to configure credentials, detection rules, and verification requests.
Provider Comparison
Use the comparison to identify where a guardrail evaluates content and whether it supports the action your policy requires:
| Kind | Provider | Evaluation Location | Detects | Actions |
|---|---|---|---|---|
keyword | Built-in | Inside AISIX | Literal and regular-expression patterns | Block |
pii | Built-in | Inside AISIX | Rule-based PII, such as email addresses, phone numbers, IDs, cards, keys, and custom patterns | Mask or block |
presidio | Microsoft Presidio | Self-hosted Presidio service | Rule-based and NER/ML PII entities, such as PERSON and LOCATION | Mask with replace, mask, hash, or redact operators; or block |
lakera | Lakera Guard | Lakera API | Prompt injection, jailbreaks, unsafe content, and PII | Block; mask PII-only detections |
azure_content_safety | Azure AI Content Safety | Azure API | Prompt injection and jailbreaks through Prompt Shield | Block |
azure_content_safety_text_moderation | Azure AI Content Safety | Azure API | Hate, sexual, self-harm, and violence severity categories, plus blocklists | Block |
openai_moderation | OpenAI Moderation | OpenAI API | Harassment, hate, violence, sexual, self-harm, and other content categories | Block |
bedrock | AWS Bedrock Guardrails | AWS Bedrock service | Content filters, denied topics, sensitive information, and word filters | Block; mask PII configured with ANONYMIZE |
aliyun_text_moderation | Alibaba Cloud Content Moderation | Alibaba Cloud API | Risk-level content moderation | Block |
aliyun_ai_guardrail | Alibaba Cloud AI Guardrails | Alibaba Cloud API | Console-policy composite checks: content compliance, prompt attacks, and sensitive data | Block; mask sensitive data per console policy |
Every listed guardrail can inspect caller requests, model responses, or both. Guardrail Behavior explains their shared hook points, enforcement modes, scoping, streaming behavior, failure handling, and caller responses.
Choose a Guardrail by Goal
After narrowing the available providers, match the policy goal to a practical starting point:
| Goal | Start With | Consider Also |
|---|---|---|
| Detect or redact PII | Built-in PII, which runs inside AISIX and supports rule-based detectors plus custom patterns. | Presidio for entities that regular expressions cannot express, such as names, locations, or nationalities. Presidio also supports self-hosted evaluation and hash or placeholder replacement. Consider AWS Bedrock or Lakera when you already use those providers. |
| Detect prompt injection and jailbreaks | Lakera Guard or Azure Prompt Shield. | Attach both when a security review requires independent providers. Both can screen indirect injection carried in retrieved documents or tool results included in a conversation. |
| Moderate content categories | OpenAI Moderation for its standard category set. | Azure Text Moderation for per-category severity thresholds and server-side blocklists, or the Alibaba Cloud guardrails within that provider ecosystem — AI Guardrails for console-managed composite policy with sensitive-data masking, Content Moderation for AISIX-side risk thresholds. |
| Enforce organization-specific rules | Built-in keyword guardrail. | Match literal or regular-expression patterns without an external dependency. |
Detection-based guardrails can produce false positives and false negatives, so evaluate a new policy in monitor mode before enforcing it on production traffic. See Guardrail Behavior.
What the Gateway Records
Guardrail telemetry varies by endpoint. Where supported, usage records identify applied guardrails, monitor-mode observations, blocked decisions, and remote fail-open bypass reasons. Not every endpoint populates every field.
Usage records and caller-facing error responses do not include the matched request or response body. Operator logs can include the matched literal or regular-expression rule for a built-in keyword block. The provider guides show the redaction tokens and block-response shapes for each guardrail kind.
Next Steps
Review Guardrail Behavior, then open the selected provider's setup guide from the comparison table.