Runtime LLM firewall / AI WAF
Inline policy enforcement on inputs/outputs (PII, jailbreaks, topic blocks) as a firewall layer in front of every model call.
At a glance — Oct 2026
Updated 2026-10-27 · forward this page: /jtbds/runtime-llm-firewall#briefScores as of 2026-09-14 (43 days old; Depot marks scores stale after 30 days). The pick is still Depot's current editorial pick; it has not been re-reviewed since. Prices below carry their own dates.
- Depot Pick
- Arthur AI · 7.80/10 for this job (curated estimate, high confidence)
Distinct from `prompt-injection-firewall`: broader runtime WAF/policy. Confidence: medium — Arthur packaging/pricing.
- Runner-up
- Lakera Guard · 8.25/10
Scores higher than the pick on: Capability fit, Latency / reliability, Developer & agent DX, Privacy / data retention.
- When not to use the pick
- Prompt-injection-only (Lakera), OSS validators (Guardrails AI), or gateway-native guards (Portkey).
- Lock-in / migration
- The pick has lower stored lock-in risk than runner-up Lakera Guard (4.5 vs 5.5).
- Sourced price (no comparable unit)
Pick: no sourced price in this job's unit (no_sourced_price).
No cheapest SKU (no_comparable_unit_for_job). No price was invented.
- Free option
- No free resource lists this job. A cheap paid SKU is not a free option.
- Failure modes to watch
- Eval contamination: Keep gold labels out of the agent prompt. Store the harness version beside the score. Do not compare a number across a benchmark revision without saying the revision changed.
- Over-refusal: Log refusals separately from successes. Review a sample against the written policy. Do not treat a refusal as a pass, and do not weaken a safety check to raise the pass rate.
- Prompt injection: Compare each tool call to the original user task. If the call only makes sense given text that arrived from a fetched page, file, or message, stop and ask. Record which source the instruction came from. This catalog does not store payloads or attack steps.
- Weak verification: Success requires an end-state check the agent does not grade for itself: tests, a database diff, or a separate judge that cannot see the gold label.
Cite: Agent Provider Depot, Depot Pick for runtime-llm-firewall: arthur-ai, scores as of 2026-09-14. Agents: GET /api/decide?jtbd=runtime-llm-firewall
Arthur AI
Distinct from `prompt-injection-firewall`: broader runtime WAF/policy. Confidence: medium — Arthur packaging/pricing.
Pricing (directional): As of 2026-09-14 (arthur.ai/pricing): Free $0 — 4 use cases, 5k jobs / 300k spans / 12k inferences / 3k evals, 7-day retention. Premium $60/mo — 100 use cases, 20k jobs / 1.2M spans / 100k inferences / 75k evals, 30-day retention, custom da…
Lock-in risk: higher = more lock-in (worse). Overall already inverts this dimension.
Monitoring/evals peer with a real $60 Premium. Prefer Braintrust/Langfuse for tracing defaults; Arthur when governance+Shield narrative matters.
Quote for Runtime LLM firewall / AI WAF
Depot Pick stays Arthur AI. Prices below are sourced SKU rows only (as of 2026-10-27). Input and output are not blended. GET /api/quote?jtbd=runtime-llm-firewall
Nothing was compared. guardrail/firewall/gateway job: priced per request, plan or contract, not per chat token; chat input $/1M is not borrowed and no comparable sourced per-request unit is stored pickIsPriceWinner is null.
Sourced price unavailable for the Depot Pick. No row in the pricing index.
4 of 5 candidates have no sourced price row. 5 are excluded from the Matching price comparison (none). guardrail/firewall/gateway job: priced per request, plan or contract, not per chat token; chat input $/1M is not borrowed and no comparable sourced per-request unit is stored
Runners-up
Lakera Guard
Depot pick for a dedicated prompt-injection firewall in front of any LLM. NeMo when you need programmable…
Guardrails AI
OSS programmable rails peer to NeMo Guardrails. Lakera when you want a hosted injection firewall API…
Cisco AI Defense (ex-Robust Intelligence)
Status check: Robust Intelligence brand is gone; buy Cisco AI Defense only inside a Cisco security standard…
Portkey
Depot pick for production AI gateway (fallbacks, virtual keys, budgets). OpenRouter when you want a model…
When NOT to use the top pick
Prompt-injection-only (Lakera), OSS validators (Guardrails AI), or gateway-native guards (Portkey).
Full ranking (score table)
Ranked with this JTBD's weights. Scores are curated estimates unless marked otherwise. Agents: prefer /api/decide then this table for tie-breaks.
| # | Provider | Overall | Fit | $/perf | Latency | DX | As of |
|---|---|---|---|---|---|---|---|
| 1 | Lakera Guard | 8.3 | 8.8 | 7.8 | 8.4 | 9.0 | 2026-09-14 |
| 2 | Guardrails AI | 8.2 | 8.4 | 8.8 | 7.8 | 8.2 | 2026-09-14 |
| 3 | Portkey | 8.2 | 8.8 | 8.2 | 8.6 | 9.0 | 2026-09-14 |
| 4 | Arthur AIDepot Pick | 7.8 | 8.2 | 8.0 | 8.0 | 8.2 | 2026-09-14 |
| 5 | Cisco AI Defense (ex-Robust Intelligence) | 7.5 | 8.4 | 4.8 | 8.6 | 6.0 | 2026-09-14 |
Score methodology for this job
Distinct from `prompt-injection-firewall`: broader runtime WAF/policy. Confidence: medium — Arthur packaging/pricing.
capabilityFit: 20%pricePerformance: 10%latencyReliability: 12%developerDx: 10%privacyPosture: 30%lockInRisk: 8%maturity: 10%