Guardrails AI: Framework for Validating LLM Inputs and Outputs
Guardrails AI is a Python-based framework designed to enhance the reliability of AI applications by validating inputs and outputs of large language models (LLMs). It achieves this through two primary functions: enforcing Input/Output Guards to detect, quantify, and mitigate risks, and ensuring structured data generation from LLMs. The framework is built on an open-source model under the Apache 2.0 license, making it accessible for integration into various AI projects since its launch in 2023.
The framework operates by intercepting LLM inputs and outputs, applying pre-built validators to identify risks such as personally identifiable information (PII), toxicity, prompt injection, and topic restrictions. These validators are sourced from Guardrails Hub, a public repository of composable risk measures. Developers can combine multiple validators into custom Input and Output Guards, tailoring them to specific use cases.
This is particularly useful for applications requiring precise data structures, such as APIs or automated workflows. The framework achieves this through two methods: function calling for LLMs that support it, and prompt optimization for those that do not.
As of August 2026, Guardrails has transitioned its validators to standard PyPI packages, discontinuing its previously hosted remote inferencing service. This shift simplifies installation and maintenance, as users can now directly install validators via pip. The framework continues to evolve, with recent updates addressing security vulnerabilities, improving dependency management, and enhancing integration with other tools like MLflow for deterministic safety evaluations.
Guardrails is compatible with both proprietary and open-source LLMs, offering flexibility in deployment. The framework also supports custom validator development, allowing users to contribute to Guardrails Hub or create private validators for specialized needs.
The latest release, version 0.11.0, includes security patches for dependencies such as aiohttp and anyio, addressing template injection vulnerabilities in GitHub workflows.
Guardrails AI is actively maintained, with contributions from the community and regular updates to address emerging risks and technical challenges. The project welcomes developers to participate in its open-source ecosystem, whether by reporting issues, contributing code, or proposing new validators. Documentation and guides are available to support integration with various LLMs and deployment scenarios.
How It Works
Guardrails AI functions through a modular architecture that allows developers to define and apply Input and Output Guards. These guards are constructed using validators from Guardrails Hub, which are pre-built modules designed to detect specific risks. For example, a validator for PII detection can be combined with a toxicity checker to create a comprehensive guard for user inputs in a chatbot application.
The process begins with the installation of the guardrails-ai package via pip, followed by configuration using the guardrails configure command. Developers then select and install specific validators from Guardrails Hub, such as guardrails-ai-regex-match for pattern validation or guardrails-ai-toxic-language for detecting harmful content. These validators are then integrated into a Guard object, which defines the validation rules and corrective actions for failed validations.
When validating inputs or outputs, Guardrails evaluates the content against the configured validators. If a validation fails—for instance, if toxic language is detected—the framework triggers a predefined action, such as raising an exception, logging the issue, or modifying the input/output to comply with the rules.
When an LLM generates output, Guardrails either uses function calling (for supported models) or optimizes the prompt to include the schema, ensuring the response adheres to the specified structure. This approach is particularly valuable for applications requiring JSON or other structured formats, such as data extraction or API integrations.
This setup involves creating a configuration file with the desired validators, starting the server with guardrails start, and interacting with it via the Guardrails client or directly through the OpenAI SDK.
The framework’s design emphasizes composability, allowing developers to combine validators in various ways to address complex risk scenarios. This modularity extends to custom validator development, enabling organizations to address unique risks specific to their use cases.
Use Cases
Guardrails AI is widely applicable across industries and AI-driven applications where input and output validation is critical.
By integrating Guardrails, developers can create robust moderation pipelines that adapt to evolving risks.
Guardrails also supports structured data generation for applications requiring precise outputs, such as automated report generation, data extraction from unstructured text, or API integrations. This capability is invaluable for workflows where data consistency and reliability are critical.
The framework’s compatibility with both proprietary and open-source LLMs makes it versatile for research and development environments.
Guardrails has been integrated into tools like MLflow for deterministic safety evaluations, where validators are used as scorers to assess the reliability of AI models. This integration allows organizations to embed safety checks into their model evaluation workflows, ensuring that only validated models proceed to production. Additionally, Guardrails has been used in collaboration with NVIDIA NeMo Guardrails to enhance AI safety in enterprise deployments, demonstrating its adaptability across different ecosystems.
Key Features and Capabilities
Guardrails AI offers a suite of features designed to address the challenges of LLM validation and structured output generation. At its core, the framework provides a collection of pre-built validators through Guardrails Hub, covering risks such as PII, toxicity, prompt injection, and topic restrictions. These validators are modular and composable, allowing developers to create custom guards tailored to their application’s needs.
Guardrails also excels in enforcing structured output schemas, enabling developers to generate and validate JSON or other structured formats from LLM responses. This is achieved through two mechanisms: function calling for LLMs that support it, and prompt optimization for those that do not.
The framework’s server mode allows Guardrails to be deployed as a standalone service, accessible via REST API. The server can be configured using a simple command-line interface, and interactions can occur through the Guardrails client or directly via the OpenAI SDK.
Guardrails Hub serves as a central repository for validators, providing developers with a growing library of pre-built risk measures. Users can browse, install, and combine validators to address specific risks in their applications. The hub also supports custom validator development, enabling organizations to contribute their own measures or create private validators for internal use.
For example, the transition to PyPI packages simplifies validator installation and maintenance, while security patches address vulnerabilities in dependencies such as aiohttp and anyio.
Guardrails AI is designed to be language-agnostic, with primary support for Python and JavaScript, and ongoing efforts to expand compatibility. This versatility allows developers to integrate Guardrails into diverse technical stacks, whether for research, enterprise applications, or open-source projects. The framework’s open-source nature under the Apache 2.0 license further encourages adoption and collaboration within the AI community.
The Guardrails Index, launched in February 2025, provides a benchmark for comparing the performance and latency of 24 validators across six common risk categories. This resource helps developers evaluate the effectiveness of different validators and make informed decisions when selecting measures for their applications.
By combining Guardrails with Snowglobe, organizations can identify edge cases early in development, ensuring their applications are robust and reliable before deployment.