Guardrails AI is an open-source Python framework for validating LLM outputs against defined rules. You specify validators (checks that output must pass), and Guardrails applies them to model responses, triggering corrective actions (retry, fix, filter, or raise an error) when validation fails. For AI projects, Guardrails addresses a critical production concern: ensuring that LLM outputs meet quality, safety, and format requirements before they reach end users or downstream systems.

Official documentation: https://www.guardrailsai.com/docs

Core Concepts

Guard - The primary object. A Guard wraps an LLM call and applies validators to the output. You configure a Guard with validators and call it instead of calling the LLM directly. The Guard manages the validation loop: call the LLM, validate the output, and if validation fails, retry with corrective instructions.

Validator - A check applied to LLM output. Validators can check individual fields (string length, regex match, value range), semantic properties (toxicity, relevance, factual consistency), or structural properties (valid JSON, valid SQL, valid Python). Each validator has an on_fail action: raise an exception, retry the LLM call, apply a fix (modify the output), or filter (remove the offending content).

Guardrails Hub - A registry of community-contributed validators. The Hub provides validators for common needs: PII detection, profanity filtering, competitor mention detection, reading level enforcement, SQL injection prevention, and many others. Install validators from the Hub with a single command.

RAIL (Reliable AI Language) - An XML-based specification format for defining output schemas with embedded validators. While still supported, the programmatic Python API is now the recommended approach for defining Guards.

Validation Patterns

Structural validation - Ensure output matches a defined format. The LLM must return valid JSON conforming to a Pydantic model, with specific fields present, correct types, and values within bounds. Similar to Instructor but with additional validator extensibility.

Content safety - Apply toxicity detection, PII redaction, or custom content filters. The ToxicLanguage validator checks for harmful content. The DetectPII validator identifies and can redact personally identifiable information. These validators run locally or call external services.

Factual consistency - The ProvenanceV1 validator checks whether the LLM output is supported by provided reference text. This is a grounding check for RAG applications: if the model generates a claim not supported by the retrieved context, the validator flags it.

Business rules - Custom validators encode domain-specific rules. For a financial application: amounts must be positive, dates must be in the future, account numbers must match a format. Custom validators are Python functions decorated with the @register_validator decorator.

Integration with LLM Providers

Guardrails supports OpenAI, Anthropic, Cohere, Hugging Face, and LiteLLM (which proxies to many providers). The Guard wraps the provider’s client and handles validation transparently:

from guardrails import Guard
from guardrails.hub import ToxicLanguage

guard = Guard().use(ToxicLanguage(on_fail="fix"))
result = guard(
    model="gpt-4o",
    messages=[{"role": "user", "content": "Summarize this document..."}]
)

Guardrails Server

Guardrails Server provides a REST API for running Guards, enabling validation from non-Python applications. Deploy the server as a standalone service, and call it from any language via HTTP. This is useful for polyglot architectures where the AI validation logic is centralized but consumed by applications in multiple languages.

Comparison with NVIDIA NeMo Guardrails

Guardrails AI focuses on output validation: checking and correcting model responses after generation. NeMo Guardrails focuses on conversational safety rails: controlling the flow of conversation, topic boundaries, and input screening. They are complementary: use NeMo Guardrails to control what the model discusses and Guardrails AI to validate the format and content of what it produces.

When to Use Guardrails AI

Guardrails AI fits when you need to enforce specific output quality rules in production, when you want to catch and correct LLM failures automatically, and when you need a layered safety approach (combining content filtering, structural validation, and business rules). It adds latency (validation time plus potential retries), so evaluate the trade-off for latency-sensitive applications.

Pricing

Guardrails AI is open-source (Apache 2.0 license). The Guardrails Hub is free to use. Some Hub validators call external APIs (for NLP tasks like toxicity detection) that may have their own costs. Self-hosted validators have no additional cost beyond compute.