• September 27, 2026
• 5 min read

Guardrails AI — Input & Output Guards for LLMs¶

Open-source Python framework (Apache-2.0) that wraps LLM calls with validators: checks run on the prompt before it reaches the model and on the answer before it reaches the user. It also turns free text into validated structured output (Pydantic) and can re-ask the model to fix what failed.

flowchart LR
    U[User / test] --> IG[Input guard<br/>on='messages']
    IG -->|blocked| X[Exception / refusal]
    IG --> LLM[LLM via LiteLLM]
    LLM --> OG[Output guard<br/>validators + schema]
    OG -->|fail + reask| LLM
    OG -->|fix / filter / noop| A[Validated output]
    OG -->|exception / refrain| X

Installation¶

uv add guardrails-ai                            # core: Guard, Validator, CLI, LiteLLM
uv add guardrails-ai-regex-match guardrails-ai-detect-pii   # validators = normal PyPI packages
guardrails configure --disable-metrics --disable-remote-inferencing --token ""   # optional, non-interactive

Also avoid guardrails-ai==0.10.1 — that release was a malicious upload (May 2026) and was quarantined. Pin the version in the lockfile.

Section Map¶

Minimal Example¶

from guardrails import Guard, OnFailAction
from guardrails.errors import ValidationError
from guardrails_ai.secrets_present import SecretsPresent
from guardrails_ai.valid_choices import ValidChoices

# Output guard for a ticket-triage bot: the label must be one of three values
triage_guard = Guard(name="ticket-label").use(
    ValidChoices(choices=["bug", "feature", "question"], on_fail=OnFailAction.EXCEPTION),
)

outcome = triage_guard.validate("bug")                  # no LLM call — validate a fixed string
assert outcome.validation_passed and outcome.validated_output == "bug"

try:
    triage_guard.validate("urgent")
except ValidationError as e:
    print(e)   # Validation failed for field with errors: Value urgent is not in choices [...]

# Same guard around a real model call (routed through LiteLLM)
support_guard = Guard().use(SecretsPresent(on_fail=OnFailAction.FIX))
result = support_guard(
    model="anthropic/claude-haiku-4-5",
    messages=[{"role": "user", "content": "How do I rotate my API key?"}],
)
print(result.validated_output)                          # secrets masked as ********

Quick Commands¶

Guardrails AI vs Alternatives¶

They combine well: provider filters as a baseline, gateway checks for org-wide policy, Guardrails AI for feature-specific rules and typed output.

Where Guardrails Help (OWASP LLM Top 10)¶

Quick Rules¶

1. Guards are one layer, not the fix — combine with least privilege, output encoding and human approval for risky actions.
2. Install validators as pinned PyPI packages (guardrails-ai-<name>) — no more guardrails hub install.
3. Run ML validators locally or on your own endpoint — hosted remote inference is gone.
4. Pick on_fail deliberately: exception for input, fix for redaction, reask for format errors, noop while tuning.
5. Check validation_summaries, not only validation_passed — a fix action returns validation_passed=True even though a validator failed.
6. Cap num_reasks (0–2) — every reask is a full extra LLM call.
7. Unit-test every guard with validate() on fixed strings — no keys, no network, fast CI.
8. Measure false positives and false negatives on labelled datasets before switching a guard from noop to blocking.
9. Disable anonymous metrics in CI and production (guardrails configure --disable-metrics or guard.configure(allow_metrics_collection=False)).

See also¶

• Digital Garden: Knowledge Base
• Python Libraries
• LiteLLM — One API for 100+ LLM Providers
• Pydantic
• OWASP LLM Security Guide
• LLM Evaluation