Two halves, and you want both. Guardrails decide what the agent may say and do — injection defence, PII redaction, identity. Containment decides what holds when the guardrails do not: a kernel boundary around code it wrote, a default-deny boundary around everything it can reach. Egress control does not stop prompt injection; it removes the payout.
| Option | Job | What it does | Licence | Self-host |
|---|---|---|---|---|
| Llama Guard | Content filtering | Open-weight classifier for input and output safety. Runs wherever you run it. | Open source | Yes |
| Guardrails AI | Content filtering | Declarative input/output validators with a hub of prebuilt checks. | Open source | Yes |
| NeMo Guardrails | Policy & topic control | NVIDIA's programmable rails — constrain topic, dialogue path and tool use. | Open source | Yes |
| Lakera Guard | Prompt-injection defence | Prompt-injection and jailbreak detection as a low-latency API call. | Proprietary | No |
| Rebuff | Prompt-injection defence | Open-source prompt-injection detector with canary tokens. | Open source | Yes |
| Invariant | Policy & topic control | Policy engine and analyzer for agent traces and MCP tool calls. | Open source | Yes |
| Descope Agentic Identity | Agent identity & delegated auth | Identity, delegated consent and scoped tokens for agents acting on behalf of users. | Proprietary | No |
| Auth0 for AI Agents | Agent identity & delegated auth | Token vault, async user approval and fine-grained authorization for tool calls. | Proprietary | No |
| Oso | Authorization | Authorization-as-a-service — decide what this agent may touch, per record. | Open source | Yes |
| Microsoft Presidio | PII detection & redaction | PII detection and redaction before text ever reaches a model provider. | Open source | Yes |
| Cloudflare AI Gateway | Gateway & spend control | Rate limiting, caching, spend caps and logging in front of any provider. | Proprietary | No |
| iron-proxy | Egress control | Default-deny egress firewall for untrusted workloads. The sandbox holds worthless proxy tokens; real credentials are swapped in at the boundary. | Open source | Yes |
| gVisor | Sandboxing | Google's user-space kernel. Intercepts syscalls before they reach the host, without paying for a full VM. | Open source | Yes |
| Firecracker | Sandboxing | AWS microVMs — a separate Linux kernel per sandbox, booting in about 125ms. | Open source | Yes |
| Kata Containers | Sandboxing | MicroVM isolation behind the ordinary container API — drops into Kubernetes as a RuntimeClass. | Open source | Yes |
| No isolation (host process) | Sandboxing | The agent runs as an ordinary process on the host. Honest default only when it executes no code and reads nothing untrusted. | Open source | Yes |
| E2B | Sandboxing | Firecracker sandboxes for running code the agent wrote, safely. | Open source | Yes |
Only figures with a published source appear here. A blank cell means nobody has published one for that pairing — which, for most of this category, is the honest answer.
| Benchmark | Llama Guard |
|---|---|
| Agent Data Injection — attack success rateShare of injection attacks that still succeed with the guardrail in place. Lower is better.lower is better | 50%peer-reviewedLlama Prompt Guard 2 |
| Agent Data Injection — detection rateShare of instruction-injection attempts the guardrail flags. | 34.9%peer-reviewedLlama Prompt Guard 2 — 326 of 935 |
| Recall @ 1% FPR (English)Injections caught while holding false positives to 1% — the metric that decides whether a filter is usable in production. | 97.5%self-reportedPromptGuard 2 86M |
Two halves, and you want both. Guardrails decide what the agent may say and do — injection defence, PII redaction, identity. Containment decides what holds when the guardrails do not: a kernel boundary around code it wrote, a default-deny boundary around everything it can reach. Egress control does not stop prompt injection; it removes the payout. Every stack needs one — it is not optional.
This registry tracks 17. 13 are open source and 13 can run on your own infrastructure.
It depends on constraints rather than preference: whether you must self-host, whether the budget allows a hosted service, and which language your team writes. Describe what you are building and the advisor fills this layer along with the other 9.
Every page here answers to Accept: text/markdown and returns the same content at roughly a tenth the tokens. No separate site, no toggle — same URL.
curl -s -H "Accept: text/markdown" https://newagent.build/layers/security