Guardrails AI

The framework connects to 100+ LLMs through LiteLLM, documents a LangChain integration and sends telemetry to Grafana, MLflow and Arize. These wrap model calls and move telemetry out; no connector lets an agent take authenticated action in an outside system. Validators that check SQL, URLs or code inspect what an agent produced rather than letting it act.

SourceGuardrails AI, guardrailsai.com/guardrails/docs/how-to-guides/using_llms, /guardrails/docs and /guardrails/docs/concepts/telemetryread 2026-09-25

A guard chains validators around one LLM call, which is a validation pipeline, not work in several steps or across agents; the customer's own code or framework, LangChain for example, runs the workflow. No workflow model is documented.

SourceGuardrails AI, guardrailsai.com/guardrails/docsread 2026-09-25

Inputs and outputs of an LLM call are checked, but the customer's documents are not indexed or retrieved for an agent to ground on. Provenance and relevance validators score an answer against sources the customer supplies, which checks output rather than providing a retrieval structure.

SourceGuardrails AI, guardrailsai.com/guardrails/docs and /hubread 2026-09-25

Input and output guards run in the customer's application to detect, quantify and mitigate specific risks. They are built from validators for attacks and leaks (Detect Jailbreak, Detect Prompt Injection, Detect System Prompt Leakage, Detect PII and Secrets Present) and for content and scope (Toxic Language, Llama Guard, ShieldGemma and Restrict to Topic), each with an action on failure; the telemetry guide's example raises an exception. These guardrails stop an output outright; no human approval step is documented.

SourceGuardrails AI, guardrailsai.com/guardrails/docs, /hub and /guardrails/docs/concepts/telemetry; guardrailsai.com/hubread 2026-09-25

A SafeBase trust center at trust.guardrailsai.com lists SOC 2 and HIPAA items, with the type and report behind the portal. No access surface is documented: the framework runs inside the customer's own code, and no roles, permissions, SSO or SAML for Snowglobe or any hosted service appear. The security validators for PII, prompt injection and secrets are guardrails on outputs, not access controls.

SourceGuardrails AI, trust.guardrailsai.com and guardrailsai.com/guardrails/docsread 2026-09-25

OpenTelemetry instruments the framework: traces and metrics cover guard and LLM latency, guard success rates and validator pass and fail rates, with deep dives into single guard and validator calls, exportable to any OTLP endpoint such as Grafana, New Relic, Prometheus or Splunk, or a self hosted collector.

That covers export to existing monitoring and part of step by step inspection, but only for the guard layer the customer wraps around its LLM calls. No audit log separate from traces is documented, and no hosted dashboard or retention by plan; the Guardrails Pro dashboard does not appear on the current site.

SourceGuardrails AI, guardrailsai.com/guardrails/docs/concepts/telemetryread 2026-09-25

Guards validate each call on its own and keep nothing an agent reads as context later. No memory layer or state across runs is documented.

SourceGuardrails AI, guardrailsai.com/guardrails/docsread 2026-09-25

The framework is Apache 2.0 open source, as the repository LICENSE confirms, and runs wherever the customer runs it: inside the application or as a self hosted Guardrails Server, with telemetry able to go to a collector inside the customer's own VPC. The change log records that the free hosted remote inference service for validators was discontinued in August 2026, so self hosting is how the framework is deployed.

SourceGuardrails AI, guardrailsai.com/guardrails/docs, /guardrails/docs/concepts/telemetry and the repository LICENSEread 2026-09-25

The Hub is a browsable catalog of prebuilt validators that the customer combines into its own guards, with ban list, toxicity, bias, competitor check, jailbreak, PII, prompt injection, provenance and valid JSON among dozens more. They are components the customer assembles, not packaged agents or workflows a buyer adopts as working units.

SourceGuardrails AI, guardrailsai.com/hubread 2026-09-25

Guards run inline when the customer's code calls them, or when an application calls a self hosted Guardrails Server; nothing wakes on a schedule, webhook or channel event.

SourceGuardrails AI, guardrailsai.com/guardrails/docsread 2026-09-25

A Guard takes a model property and the customer's own API key in Guardrails' call API, and it supports 100+ LLMs, OpenAI and Anthropic among them, through its built in LiteLLM integration, with streaming and tool calling. So the customer picks the provider inside the vendor's own SDK.

SourceGuardrails AI, guardrailsai.com/guardrails/docs/how-to-guides/using_llmsread 2026-09-25

As a Python framework, its SDK is the product's interface: Guard objects, validators and actions on failure are documented with an API reference, and a Guardrails Server quickstart covers running guards as a standalone service. No MCP server is documented.

SourceGuardrails AI, guardrailsai.com/guardrails/docs (introduction, Guardrails Server quickstart, API reference)read 2026-09-25

Snowglobe, Guardrails AI's simulation product, generates evaluation datasets aimed at edge cases and risky outcomes, simulates large numbers of realistic synthetic users against the customer's agent, and quantifies failure modes before real users meet them. So the customer's agent is tested against datasets before production. Hub validators such as LLM Critic, Response Evaluator and QA Relevance also grade outputs against criteria.

SourceGuardrails AI, guardrailsai.com homepage and /blog/guardrails-ai-joins-harvey, and /hubread 2026-09-25

Neither the input and output validators nor Snowglobe's simulated users operate a browser or computer, and no capability of that kind is documented.

SourceGuardrails AI, guardrailsai.com homepage and /guardrails/docsread 2026-09-25