AI Firewall Placement: Lakera, NeMo, Bedrock, Azure

The AI firewall market has consolidated around four credible options for production deployments: Lakera Guard (now under Check Point), NVIDIA NeMo Guardrails, AWS Bedrock Guardrails, and Azure AI Content Safety. None of them covers the OWASP LLM Top 10 in full, because defenses are layered by design, but each one sits at a different point in the request path and fits a different deployment context. This post is about that placement decision, plus Azure AI Content Safety, which is the option missing from the ranked shortlist in Best AI Guardrail Tools 2026. Read the ranking there; read this if you already have a shortlist and need to decide where the filter goes. It is aimed at the AppSec lead or MLOps engineer making a procurement decision, not at a first look for someone new to the category.

Short answer on placement: Bedrock Guardrails runs inside the model call, so it adds no separate hop but only exists where Bedrock does. Lakera Guard and Azure AI Content Safety are network hops you insert on either side of inference. NeMo Guardrails runs in your own process and can also sit between retrieval and context assembly, which is the one position the other three cannot occupy without custom plumbing. Layering two is common; layering all four is not.

Where Each Tool Sits in the Request Path

All four tools operate at the runtime layer. They inspect data in flight, not at build time. The canonical placement is a pre-LLM input scan followed by a post-LLM output scan. Lakera Guard and Azure AI Content Safety are network hops: your application sends the content to the classifier API, waits for a verdict, then either passes or blocks before proceeding. NeMo Guardrails wraps this logic as in-process Python, reducing network round-trips but adding model-inference calls locally. Bedrock Guardrails is evaluated synchronously inside the InvokeModel or Converse API call, so there is no separate network hop from the application’s perspective.

NeMo’s retrieval rail inserts a filter stage between the vector store retrieval and the context assembly step, which is the relevant position for RAG pipelines where poisoned chunks are the threat vector (OWASP LLM08, Vector and Embedding Weaknesses). None of the other three tools in this comparison operate at that retrieval layer without custom plumbing. The attack pattern that position defends against is catalogued in the indirect injection work on aisec.blog.

Placement, and what each position can and cannot see:

Position	Lakera Guard	NeMo Guardrails	Bedrock Guardrails	Azure AI Content Safety
Pre-model input scan	Yes (network hop)	Yes (in-process input rail)	Yes (inside the model call)	Yes (network hop)
Between retrieval and context assembly	No	Yes (retrieval rail)	No	No
Around a tool or function call	Off-Task Action detector	Yes (execution rail)	No	Task adherence API (preview)
Post-model output scan	Yes	Yes (output rail)	Yes	Yes
Runs where	Vendor infrastructure	Your infrastructure	Your AWS account	Azure region you pick
Works with non-Bedrock models	Yes	Yes	Via ApplyGuardrail	Yes

The row that eliminates candidates fastest is the second one. If poisoned retrieval is in your threat model and you are not prepared to write the filter yourself, the retrieval rail is the reason to run NeMo alongside whatever else you deploy. For the wider taxonomy of what a guardrail can be asked to do at each of these positions, see the guardrail category breakdown on guardml.io.

Azure AI Content Safety: The One Missing From the Ranking

Azure AI Content Safety applies Microsoft’s harm classifiers to both prompt and completion content, with configurable severity thresholds and custom blocklists. Per Microsoft Learn, the service exposes separate APIs rather than a single filter, and the split matters when you are deciding placement:

• Prompt Shields scans text for user input attacks against an LLM, and accepts up to five documents alongside the prompt, so it can be pointed at retrieved context as well as at the user’s message.
• Analyze text and Analyze image score content for sexual, violent, hate, and self-harm categories at multiple severity levels. Image moderation is native, which NeMo and Lakera Guard do not offer on the image side without add-ons.
• Groundedness detection (preview) checks whether a completion is supported by the source material supplied with the call, which is the Azure counterpart to Bedrock’s contextual grounding.
• Protected material detection flags known text and code in generated output, a copyright control rather than a security one.
• Task adherence (preview) flags agent tool use that is misaligned or premature, which is the closest thing Azure offers to an execution rail.

Two operational constraints are worth checking before committing. Feature availability is regional and uneven: the Microsoft Learn region table shows groundedness detection in a minority of regions while Prompt Shields and text analysis are broadly available. And rate limits are per tier, with the free F0 tier capped at 5 requests per second, which is a proof-of-concept ceiling rather than a production one. Audit logging integrates with Azure Monitor out of the box, and the service is LLM-agnostic at the API level, though teams already on Azure OpenAI Service will attach it with less integration work.

The Other Three, Briefly

Lakera Guard is a hosted REST API that classifies prompt and completion content before it reaches or leaves your LLM. Its primary detection surface is OWASP LLM01 (Prompt Injection), including indirect injection, jailbreak attempts, and prompt leakage, plus PII detection and content moderation. Lakera was acquired by Check Point in late 2025; per Lakera’s documentation, the service holds SOC 2 Type II and GDPR compliance, though the data-processor relationship persists regardless of certification. Deployment is a single API call inserted into your inference pipeline, with no self-hosting.

NVIDIA NeMo Guardrails is an open-source Python toolkit (Apache 2.0) that runs as middleware between your application and any LLM. It defines five rail types: input rails filter or modify user messages before they reach the model; dialog rails influence conversational flow; retrieval rails filter chunks in RAG pipelines; execution rails control tool call inputs and outputs; output rails filter or modify completions. Because it runs entirely within your infrastructure, prompt content never leaves your environment, which is a decisive property for regulated or classified workloads.

AWS Bedrock Guardrails is a managed service integrated directly into the Bedrock inference API. Per AWS documentation, it provides content filters across six harm categories (Hate, Insults, Sexual, Violence, Misconduct, and Prompt Attack), denied-topic blocking, exact-match word filters, PII redaction via entity detection and custom regex, contextual grounding checks for RAG responses, and automated reasoning checks that validate completions against a set of logical rules. Data stays within the AWS account boundary. The ApplyGuardrail API decouples the filter from Bedrock-hosted models, so the real constraint is the AWS dependency and the per-policy billing model, not the model you are running.

Trade-offs: Latency, False Positives, and Integration Cost

Latency is the most operationally visible cost, and it follows directly from placement. Lakera Guard is a hosted classifier, so its cost is one extra network round-trip plus classification time; Lakera describes the service as a low-latency architecture but publishes no p50 figure, so measure it from your own region before committing. Azure AI Content Safety carries the same round-trip shape, with the added variable of which region actually hosts the feature you need. Bedrock Guardrails adds latency inside the same synchronous API call, eliminating a separate network hop. NeMo Guardrails incurs the highest latency in default configurations because each rail may invoke one or more LLM calls, so a conservative multi-rail configuration adds a model round-trip per rail rather than a single classifier call.

False-positive rate is where trade-offs bite hardest. A guardrail that blocks 20% of legitimate business prompts is not a security control; it is an outage. NeMo’s self-check rails, which ask the LLM to judge its own output, are accurate but slow. Lakera Guard’s classifiers are trained on a diverse prompt-injection corpus, but the rate rises on domain-specific jargon that resembles injection syntax, such as security research prompts or SQL-heavy analyst queries. Bedrock Guardrails’ content filters are configurable by severity level, which gives you a threshold dial but puts the tuning burden on you. Whichever you pick, the number that matters is the one measured on your own benign traffic, using the method in benchmarking prompt injection detectors rather than a vendor’s clean-data figure.

Detection is not a ceiling you can trust. An empirical evaluation of evasion attacks against six prompt-injection and jailbreak detection systems, including Azure Prompt Shield and Meta Prompt Guard, reports up to 100% evasion success using character injection and adversarial machine learning techniques (arXiv:2504.11168). Treat every classifier in this comparison as a filter that raises attacker cost, not as a boundary.

Integration effort ranges from one SDK call (Bedrock, if already on Bedrock) to a full Python middleware refactor (NeMo). Lakera Guard sits in the middle: a REST API call you can add in an afternoon, but every inference path needs the wrapper. Azure AI Content Safety requires an Azure account and an additional endpoint per content type, which adds IAM and network configuration surface.

Picking a Position

One hop in front of the model is the default, and Lakera Guard or Azure AI Content Safety fill it. Pick Lakera if prompt injection is the dominant risk and a SOC 2 SaaS data processor is acceptable. Pick Azure if you are standardized on Microsoft’s stack or need native image moderation.

Inside the model call is the cheapest position if your inference already runs on Bedrock, and Bedrock Guardrails is the only option that occupies it.

Inside your own process, at several positions at once is what NeMo Guardrails is for: on-prem data handling, programmable dialog rails, and the retrieval-layer filter nothing else provides.

More than one position is the honest answer for multi-model, multi-cloud pipelines with agents that invoke external tools. That architecture needs controls at the input, output, and tool-execution layers simultaneously, likely NeMo Guardrails for the framework layer plus a classification API such as Lakera for the high-throughput paths. Before you decide how many layers you need, measure the agent surface itself using the approach in measuring prompt injection robustness in agents.

For the ranked shortlist, pricing shapes, and the Guardrails AI open-source option, see Best AI Guardrail Tools 2026.

Related across the network

• Best LLM Firewall Tools in 2026: A Buying Guide — aisecweekly.com
• How to Detect Prompt Injection: Four Approaches Ranked — aiattacks.dev
• AI Defense Techniques for LLMs: A Practitioner’s Guide — aidefense.dev
• Jailbreak Detection for LLMs Explained: How Runtime Filters Work — aidefense.dev
• How to Detect Jailbreak Prompts: A Practitioner’s Guide — aimoderationtools.com