F5 AI Guardrails vs Guardrails AI (2026)

Proxy integrations route the OpenAI and Anthropic SDKs, Claude Code, OpenAI Codex and Google Gemini through the platform, along with Slack and Microsoft Teams integrations and a SIEM connection. These route model traffic and send events, and no connector lets an agent take authenticated action in an outside system. F5 says it audits and blocks agents' tool calls, which governs actions that other systems take.

SourceF5 AI Security, docs.aisecurity.f5.com (docs index and integration guides) and /reference/roles-permissions.htmlread 2026-09-25

The framework connects to 100+ LLMs through LiteLLM, integrates with LangChain and sends telemetry to Grafana, MLflow and Arize. These integrations wrap model calls and move telemetry out. No connector lets an agent take authenticated action in an outside system. Validators that check SQL, URLs or code inspect what an agent produced and do not act.

SourceGuardrails AI, guardrailsai.com/guardrails/docs/how-to-guides/using_llms, /guardrails/docs and /guardrails/docs/concepts/telemetryread 2026-09-25

The platform sits in front of the customer's models and agents and does not run their workflows. Guardrails scan each call inline, and red team campaigns are ordered attack runs against a target, not agent work in several steps that the customer builds. There is no workflow model.

SourceF5 AI Security, docs.aisecurity.f5.com/api-docs/about-api.html and /red-team/managing-campaigns.htmlread 2026-09-25

A guard chains validators around one LLM call as a validation pipeline. The customer's own code or framework, LangChain for example, runs the workflow, and Guardrails AI names no workflow model of its own.

SourceGuardrails AI, guardrailsai.com/guardrails/docsread 2026-09-25

AI Red Team campaigns run on a schedule. The campaign schedules API sets the start and end time, frequency and interval, along with the number of occurrences and the target providers, and it can run remediation automatically. So a schedule starts the platform's own adversarial testing with no person present. Guardrails work inline, starting when the customer's application sends a scan or a proxied prompt, so they add no trigger of their own, and blocks and alerts are outputs, not triggers.

SourceF5 AI Security, docs.aisecurity.f5.com/operations/post_campaign_schedules.html and /api-docs/about-api.htmlread 2026-09-25

Guards run inline when the customer's code calls them, or when an application calls a self hosted Guardrails Server. Nothing starts on a schedule, webhook or channel event.

SourceGuardrails AI, guardrailsai.com/guardrails/docsread 2026-09-25

Prompts and responses are scanned and the customer's models attacked, but none of the documented API resources, which cover admin, roles, campaigns, license, projects, prompts, scanners, scans, tokens and users, indexes or retrieves the customer's documents for an agent to ground its answers on.

SourceF5 AI Security, docs.aisecurity.f5.com/api-docs/about-api.htmlread 2026-09-25

Guards check the inputs and outputs of an LLM call. The framework does not index or retrieve the customer's documents for an agent to ground on. Provenance and relevance validators score an answer against sources the customer supplies, and the framework provides no retrieval structure of its own.

SourceGuardrails AI, guardrailsai.com/guardrails/docs and /hubread 2026-09-25

The platform keeps records about the customer's agents, not memory for them. Prompt history, agent sessions and the audit log are read by people and by the scanners' enforcement, and the agent never reads them as context to decide. There is no memory layer or state the agent carries between runs.

SourceF5 AI Security, docs.aisecurity.f5.com/operations/get_agent_sessions.html and /api-docs/about-api.htmlread 2026-09-25

Guards validate each call on its own and keep nothing an agent reads as context later. Guardrails AI names no memory layer or state kept across runs.

SourceGuardrails AI, guardrailsai.com/guardrails/docsread 2026-09-25

AI Guardrails runs structured guardrails inline on prompts and responses. Admins build guardrail packages from prebuilt and custom scanners, switch each one on or off and choose block or audit mode. They can also customize the response a blocked user sees and enforce guardrail use across projects. F5 adds that it explains and traces why each interaction was blocked or allowed, and audits and blocks unauthorized tool calls and agent actions. These guardrails stop an output outright, and there is no human approval step.

SourceF5 AI Security, docs.aisecurity.f5.com/reference/roles-permissions.html and f5.com/products/ai-guardrailsread 2026-09-25

Input and output guards run in the customer's application to detect, quantify and mitigate specific risks. They are built from validators for attacks and leaks (Detect Jailbreak, Detect Prompt Injection, Detect System Prompt Leakage, Detect PII and Secrets Present) and for content and scope (Toxic Language, Llama Guard, ShieldGemma and Restrict to Topic), each with an action on failure. One such action raises an exception. These guardrails stop an output outright, and Guardrails AI names no human approval step.

SourceGuardrails AI, guardrailsai.com/guardrails/docs, /hub and /guardrails/docs/concepts/telemetry; guardrailsai.com/hubread 2026-09-25

The AI Security platform, formerly CalypsoAI and now sold by F5 (calypsoai.com redirects to f5.com), has a deep access surface. Admins create custom roles from granular permissions over the organization, guardrails, model connections and secrets, projects, users, red team campaigns, reports and attack types, down to API access, which is off by default for basic users. MFA and user blocking are there too.

Admins can switch data retention and prompt history logging on or off, and an audit endpoint records activity. No SSO or SAML integration is named. No attestation scoped to these products appears. The F5 Trust Center describes a product certification program (FIPS, NIST, ISO) without naming the AI Security products, and no certificate scoped to AI Guardrails or AI Red Team is shown. F5 owns the product, so a scoped F5 certificate would apply.

SourceF5 AI Security, docs.aisecurity.f5.com/reference/roles-permissions.html and f5.com/company/trust-centerread 2026-09-25

A SafeBase trust center at trust.guardrailsai.com lists SOC 2 and HIPAA items, with the SOC 2 type and report behind the portal. The framework runs inside the customer's own code. Guardrails AI names no roles, permissions, SSO or SAML for Snowglobe or any hosted service. The security validators for PII, prompt injection and secrets guard outputs, not access.

SourceGuardrails AI, trust.guardrailsai.com and guardrailsai.com/guardrails/docsread 2026-09-25

The platform records the agent's own traffic. Prompt history logs, which admins can switch on or off, can be read in the product and through the API. Agent sessions show agent and tool counts and first and last prompt times, along with errors and the peak outcome, and a dashboard shows token use by project and guardrail. A separate audit log records user and configuration activity, and admins can send events to a SIEM.

SourceF5 AI Security, docs.aisecurity.f5.com/operations/get_agent_sessions.html, /guardrails/guardrails-dashboard.html and /reference/roles-permissions.htmlread 2026-09-25

OpenTelemetry instruments the framework. Traces and metrics cover guard and LLM latency, guard success rates and validator pass and fail rates, with deep dives into single guard and validator calls. They export to any OTLP endpoint, such as Grafana, New Relic, Prometheus or Splunk, or to a self hosted collector. The telemetry covers only the guard layer the customer wraps around its LLM calls. Guardrails AI names no audit log separate from traces, no hosted dashboard and no retention by plan.

SourceGuardrails AI, guardrailsai.com/guardrails/docs/concepts/telemetryread 2026-09-25

The platform runs as SaaS, usually at us1.calypsoai.app, or inside the customer's own environment. The CAI-Deploy installer provisions or installs all AI Security products into AWS, Azure or Google Cloud accounts, into Oracle Cloud, or into an existing Kubernetes cluster, with separate guides for Helm, GCP and OpenShift. F5 also offers private cloud and fully air gapped on premises deployment with full functionality. Hosting it yourself needs your own GPUs, at least 24 GB for Guardrails and 48 GB for Red Team.

SourceF5 AI Security, docs.aisecurity.f5.com/get-started/ai-security-install.html and f5.com/products/ai-guardrailsread 2026-09-25

The framework is Apache 2.0 open source and runs wherever the customer runs it, inside the application or as a self hosted Guardrails Server. Telemetry can go to a collector inside the customer's own VPC. The free hosted remote inference service for validators has been discontinued, so customers deploy the framework by hosting it themselves.

SourceGuardrails AI, guardrailsai.com/guardrails/docs, /guardrails/docs/concepts/telemetry and the repository LICENSEread 2026-09-25

Security content ships rather than agents or workflows. Monthly attack packs feed red team campaigns, prebuilt scanners go into guardrail packages the customer assembles, and country PII guardrail sets cover core, France, Japan, Korea and Spain, alongside prompt templates. These are libraries the customer assembles into its own guardrails and campaigns, not packaged assets a customer adopts as working units.

SourceF5 AI Security, docs.aisecurity.f5.com/red-team/managing-campaigns.html, /reference/roles-permissions.html and the docs index (PII guardrail references)read 2026-09-25

The Hub is a browsable catalog of prebuilt validators that the customer combines into its own guards, with ban list, toxicity, bias, competitor check, jailbreak, PII, prompt injection, provenance and valid JSON among dozens more. These are components the customer assembles, and Guardrails AI offers no packaged agents or workflows to adopt as working units.

SourceGuardrails AI, guardrailsai.com/hubread 2026-09-25

Admins add model connections with their own stored secrets, set a default provider for each project and switch providers on or off per project. The API sends a prompt to a chosen provider through endpoints compatible with OpenAI, Anthropic and Google, and custom providers can be created too. So admins and users choose the model with their own keys inside the product, and the proxy endpoints do route model traffic.

SourceF5 AI Security, docs.aisecurity.f5.com/api-docs/about-api.html and /reference/roles-permissions.htmlread 2026-09-25

A Guard takes a model property and the customer's own API key in Guardrails' call API. It supports 100+ LLMs, OpenAI and Anthropic among them, through its built in LiteLLM integration, with streaming and tool calling. The customer picks the provider inside Guardrails' own SDK.

SourceGuardrails AI, guardrailsai.com/guardrails/docs/how-to-guides/using_llmsread 2026-09-25

The AI Security API covers almost everything the platform does, including admin backup and import, roles and permissions, red team campaigns, license, projects, prompts and prompt templates, scanners (which can be created and versioned, exported and imported), scans, tokens and users. It is a REST API with bearer tokens and a full endpoint reference. A Python SDK, the calypsoai package, wraps it, and every sample in the docs uses it. There is no MCP server.

SourceF5 AI Security, docs.aisecurity.f5.com/api-docs/about-api.html and /api-reference/read 2026-09-25

As a Python framework, its SDK is the product's interface. Guard objects, validators and actions on failure come with an API reference, and a Guardrails Server quickstart covers running guards as a standalone service. Guardrails AI names no MCP server.

SourceGuardrails AI, guardrailsai.com/guardrails/docs (introduction, Guardrails Server quickstart, API reference)read 2026-09-25

AI Red Team tests the customer's own models, applications and agents. Campaigns bundle attacks of several types, from standard and operational to agentic and custom, each defined by technique, vector and severity, with converters, and drawn from monthly attack packs. They run against the customer's providers, with reports and results the customer reads and compares across runs, and datasets and dataset runs are documented in the API too. Evaluating models is what this module sells, and the model under test is the customer's.

SourceF5 AI Security, docs.aisecurity.f5.com/red-team/managing-campaigns.html and /api-docs/about-api.htmlread 2026-09-25

Snowglobe, Guardrails AI's simulation product, generates evaluation datasets aimed at edge cases and risky outcomes, simulates large numbers of realistic synthetic users against the customer's agent, and quantifies failure modes before real users meet them. Hub validators such as LLM Critic, Response Evaluator and QA Relevance also score outputs against criteria.

SourceGuardrails AI, guardrailsai.com homepage and /blog/guardrails-ai-joins-harvey, and /hubread 2026-09-25

The platform secures and tests AI models, apps and agents and does not operate a browser or computer itself.

SourceF5 AI Security, f5.com/products/ai-guardrails and docs.aisecurity.f5.comread 2026-09-25

Neither the input and output validators nor Snowglobe's simulated users operate a browser or computer, and Guardrails AI names no other capability of that kind.

SourceGuardrails AI, guardrailsai.com homepage and /guardrails/docsread 2026-09-25