Phase 5: Guardrails & Defensive Controls · 55 min · Guardrails AI · Lakera Guard · AWS Bedrock

Guardrails AI & Hosted Guardrail Platforms

The framework you self-host and the API you call are solving the same problem from opposite ends of the ops trade-off.

Hiring signal: Job postings for AI security roles routinely name-drop Lakera, Bedrock Guardrails, or Guardrails AI directly. Being able to say which one you'd pick for a given constraint — self-hosted vs. hosted, output-schema validation vs. injection detection, cloud-native vs. framework-agnostic — and back it up with a working integration pattern is what separates a resume line from a real answer in a system-design interview.

What you will learn

Distinguish Guardrails AI (a Python output-validation framework) from hosted guardrail APIs (Lakera Guard, Bedrock Guardrails, Azure Prompt Shields) by what each actually validates and where it runs
Implement a Guardrails AI-style validator pipeline for structured output validation
Design an integration pattern for a hosted guardrail API call, including latency, availability, and data-residency trade-offs
Choose the right guardrail product for a given constraint (self-hosted vs. hosted, output schema vs. input threat detection, cloud lock-in vs. portability)

The Problem

Lesson 2 covered NeMo Guardrails: a self-hosted runtime that shapes conversation scope. That's one slice of the guardrail landscape. The other slice is everything that validates output structure and everything that outsources threat detection to someone else's model and someone else's uptime SLA. Those are different engineering decisions with different failure modes, and job postings for AI security roles routinely name specific products — Lakera, Bedrock Guardrails, Guardrails AI — because interviewers want to know you've actually weighed the trade-off, not just read a comparison blog post.

Split the landscape into two families:

Guardrails AI is a Python framework. You install a library, define validators in code, and run your LLM's output through them before it reaches a user or a downstream system. It runs in your process, on your infrastructure, with no network hop and no per-request bill to a third party.
Hosted guardrail APIs — Lakera Guard, AWS Bedrock Guardrails, Azure Prompt Shields — are services you call over HTTPS. Someone else trains and maintains the detection model; you send text, you get a verdict back.
Llama Guard sits in between: it's an open-source model (not a hosted API, not a validation framework) that you self-host and run inference against directly, like any other model.

None of these compete on some abstract "which is more secure" axis — they solve different problems, and a mature guardrail stack usually uses more than one at once. This lesson is about knowing what each one actually validates, where it runs, and which constraint (latency, cost, data residency, cloud lock-in, schema enforcement vs. threat detection) should decide your pick.

Guardrails AI: validation as a code-level contract

Guardrails AI (GitHub) is an open-source Python framework built around one object: a Guard. You construct a Guard from a list of Validators — each one checks a value and either passes it through, "fixes" it (returns a corrected value), "reasks" the LLM with a corrective prompt, filters the offending content, or raises, depending on the on_fail policy you configure.

from guardrails import Guard
from guardrails.hub import DetectPII, ToxicLanguage

guard = Guard().use(DetectPII, on_fail="fix").use(ToxicLanguage, on_fail="exception")
result = guard.validate(llm_output)

The validators themselves mostly come from the Guardrails Hub — a registry of pre-built, community- and Guardrails-maintained validators you install individually with guardrails hub install hub://guardrails/<validator> (detect_pii, toxic_language, competitor_check, regex_match, and many more). Some Hub validators and the hosted validation service around them sit behind a paid Guardrails Pro tier; the core open-source framework and many Hub validators are free.

The critical thing to internalize: Guardrails AI validates values, not conversations. It doesn't know about dialog state or topical scope the way Colang rails do — it's the layer you put directly around a single LLM call's input or output, most commonly to enforce a structured-output contract (this field must be valid JSON matching this schema, this string must not contain PII, this response must not match a competitor-mention pattern). Because it's a library, not a network service, it adds no per-request latency to an external host and there's no third party in your data path — the trade-off is that you own patching it, running it, and keeping its models/patterns current.

Unlock the full lesson

You've read the first 2 sections. The rest of this lesson covers Hosted Guardrail APIs: outsourcing detection, not architecture, Choosing the right layer for the constraint, Build It, What to Practice — plus a hands-on lab, quiz, and project artifact.

Create a free account to unlock Phase 0 and Phase 1 of every course — no credit card.