Programmable LLM input/output guardrails

Scores as of 2026-09-14 (43 days old; Depot marks scores stale after 30 days). The pick is still Depot's current editorial pick; it has not been re-reviewed since. Prices below carry their own dates.

Depot Pick

NVIDIA NeMo Guardrails · 7.87/10 for this job (curated estimate, high confidence)

capability of policy engine + privacy. Distinct from production-guardrail-evals (monitoring) — this is the runtime rails layer.

Runner-up

Lakera Guard · 8.21/10

Scores higher than the pick on: Price / performance, Latency / reliability, Developer & agent DX.

When not to use the pick

Need a dedicated prompt-injection API — lakera; only need free category flags — openai-moderation; production hallucination monitoring SaaS — galileo; cheap Llama Guard leaf — groq.

Lock-in / migration

The pick has lower stored lock-in risk than runner-up Lakera Guard (4.5 vs 5.5). Pick exit signals: open source (provider tag `oss`).

Sourced price (usd_per_1k_requests)

Pick: no sourced price in this job's unit (no_sourced_price).

Cheapest matching SKU: OpenAI Moderation omni-moderation-latest (moderation endpoint) $0 — source, as of 2026-10-21. Not the pick; not quality-adjusted.

Price history: first seen 2026-10-21 · last changed no change recorded · history JSON

Free option

No free resource lists this job. A cheap paid SKU is not a free option.

Failure modes to watch

• Runaway spend: Set a budget and a tool-call cap per task. Alert when spend jumps. Stop the run at the cap instead of summarizing a partial trace as success.
• Eval contamination: Keep gold labels out of the agent prompt. Store the harness version beside the score. Do not compare a number across a benchmark revision without saying the revision changed.
• Over-refusal: Log refusals separately from successes. Review a sample against the written policy. Do not treat a refusal as a pass, and do not weaken a safety check to raise the pass rate.
• Prompt injection: Compare each tool call to the original user task. If the call only makes sense given text that arrived from a fetched page, file, or message, stop and ask. Record which source the instruction came from. This catalog does not store payloads or attack steps.
• Weak verification: Success requires an end-state check the agent does not grade for itself: tests, a database diff, or a separate judge that cannot see the gold label.

Reported outcomes (submitted reports only)

This job: loading… JSON · reports never change scores · seed/test records excluded

Depot Pick (NVIDIA NeMo Guardrails) on this job: loading… JSON · reports never change scores · seed/test records excluded

Cite: Agent Provider Depot, Depot Pick for llm-input-guardrails: nvidia-nemo-guardrails, scores as of 2026-09-14. Agents: GET /api/decide?jtbd=llm-input-guardrails