AI agent guardrails 2026: tools, costs at 10M requests and architecture

Summary. Managed guardrail prices differ widely in October 2026, but the bigger decision is where you place deterministic controls. On list prices, screening 10 million agent requests a month (about 2,700 characters each) costs roughly $675 on Google Cloud Model Armor ($0.10 per million tokens after 2 million free), $4,700 to $10,000 on Amazon Bedrock Guardrails ($0.07 to $0.17 per 1,000 text units, by policy) and $18,750 on Azure AI Content Safety with Prompt Shields ($0.375 per 1,000 text records, East US). The commercial market has consolidated. Check Point sells Lakera as Check Point AI Guardrails (free Community tier of 10,000 requests a month). Palo Alto Networks folded Protect AI into Prisma AIRS 3.0 and closed its Portkey purchase. F5 sells CalypsoAI as F5 AI Guardrails. CrowdStrike Falcon AIDR reaches end of support on 30 November 2026. For self-hosting, NeMo Guardrails, Granite Guardian 4.1 and Mistral Shieldstral 1.0 are Apache-2.0, Prompt Guard 2 uses the Llama 4 licence, and LLM Guard was archived in July 2026. Pick your cloud's native guardrail if you run on one cloud, a commercial platform for one policy across many agents and SaaS AI tools, and self-hosted models when Indian data residency or very high volume dominates. Whatever you choose, add tool-call authorisation (AgentCore Policy lists $0.000025 per check) and egress control, because classifiers miss attacks.

About this article. Prices, licences, acquisition dates, model cards and regulatory dates were checked against vendor pages, documentation, GitHub, Hugging Face, the EU Official Journal and the Gazette of India on 22 October 2026. Vendors change pricing often, so re-check before you commit. No vendor paid for inclusion or placement. Researched with AI assistance and reviewed by our editorial team.

What changed between mid-2025 and October 2026

Security platforms bought the point products, names changed, and one support deadline lands next month. If you signed a guardrail contract in 2025, check the product name on your renewal.

The Agentic Top 10 runs from Agent Goal Hijack to Rogue Agents, and the 2026 LLM list moves Excessive Agency from sixth to third. Guardrails AI announced its move to Harvey on 9 September, after the Hub install path closed on 25 August.

On pricing, AWS cut Bedrock Guardrails content filters by 80% and denied topics by 85%, to $0.15 per 1,000 text units, from 1 December 2024, and now lists a cheaper InvokeGuardrailChecks API tier. Google prices Model Armor per token, which is why it lands an order of magnitude lower in our cost model.

Where each control sits in an enterprise agent deployment

Our prompt injection containment guide covers why injection is unsolved. Here the question is placement: which control runs at which hop, and which product fills it.

Layers 2, 3 and 5 are probabilistic classifiers; layers 1, 4 and 6 are deterministic. In a sponsor statement at the OWASP 2026 LLM Top 10 announcement, Zenity CTO Michael Bargury said Excessive Agency, now third, is where expert judgement and the incident record agree most clearly. A fooled agent that cannot call the refund tool above a limit does little damage, whatever the input classifier missed. The Cedar fragment below is illustrative; names depend on your gateway's schema.

            permit (
  principal in Role::"support_agent",
  action == Action::"issue_refund",
  resource
)
when { context.amount <= 5000 && context.currency == "INR" };
          

AgentCore enforces Cedar policies at AgentCore Gateway for $0.000025 per authorisation request plus $0.005 per 1,000 gateway invocations, so 10 million tool calls cost $250 in policy checks and $50 in gateway invocations. Microsoft Entra Agent ID is open to all Entra customers, but applying Entra security features to agents requires Microsoft Agent 365, licensed per user. For the identity layer in depth, see our guide to AI agent identity governance, and for MCP tools, our MCP authentication comparison.

Managed cloud guardrails

Amazon Bedrock Guardrails

Bedrock bills per policy per 1,000 text units, where a unit is up to 1,000 characters (5,600 characters bill as 6 units). Content filters and denied topics cost $0.15, sensitive-information filters $0.10, contextual grounding $0.10 and Automated Reasoning checks $0.17 per policy; regex PII and word filters are free, and images cost $0.00075 each. Standard and classic tiers cost the same. Through the InvokeGuardrailChecks API, content filters drop to $0.07 and the prompt attack filter is sold separately at $0.08. ApplyGuardrail screens text for models hosted outside Bedrock. The Standard tier requires cross-Region inference, which matters for residency.

Azure AI Content Safety with Prompt Shields

Microsoft now markets the service as Content Safety in Foundry Control Plane. The free tier covers 5,000 text records and 5,000 images a month. Standard pricing in East US is $0.375 per 1,000 text records and $0.75 per 1,000 images; a record is up to 1,000 characters, and Prompt Shields bills on the same text-record meter. A commitment tier starts at $338 a month for 1 million text records. Prompt Shields detects user-prompt and document attacks; spotlighting, agent tool-response scanning and a task adherence API are in preview.

Google Cloud Model Armor

Standalone Model Armor is free up to 2 million tokens a month, then $0.10 per million tokens, with a token defined as four characters excluding whitespace. Sensitive Data Protection inside Model Armor carries no extra charge, and Security Command Center Enterprise and Premium subscriptions include 3 billion tokens a month. Integrations include Apigee, Agent Gateway, Gemini Enterprise, Google Cloud MCP servers and LangChain.

Cloudflare AI Security for Apps and AI Gateway guardrails

The renamed Firewall for AI reached GA on 11 March 2026. It sits in Cloudflare's reverse proxy and detects PII, unsafe topics, custom topics and prompt injection on LLM endpoints. Discovery is free on all plans; detections are an Enterprise add-on with no published price. Separately, AI Gateway guardrails run Llama Guard 3 8B and Prompt Guard 2 on Workers AI, billed as inference at $0.484 per million input tokens for Llama Guard 3 8B, and add about 500 ms. On gateway endpoints, streamed responses are buffered and enforced, then returned unstreamed; through the REST API, responses are evaluated and logged but not blocked.

Commercial platforms after the acquisitions

Check Point AI Guardrails (formerly Lakera Guard)

The Community tier allows 10,000 screening requests a month; Enterprise adds larger request packages, up to 1 MB of context per request, RBAC and SIEM export at quote-based prices. Lakera's site claims under 50 ms latency. It screens tool definitions and tool calls, runs as SaaS or a self-hosted Docker or Kubernetes deployment (including air-gapped), and processes SaaS data in the EU (Spain), the US and Singapore, not India. The docs state SOC 2 Type II.

Palo Alto Networks Prisma AIRS

Prisma AIRS 3.0 (23 March 2026) added agent discovery, red teaming for agents and an AI Agent Gateway in limited preview. It deploys as an API intercept (REST or Python SDK) or a network intercept, a software firewall in any major cloud or on-premises. AWS Marketplace shows $4,353 per 12-month unit of Prisma AIRS API calls without stating how many calls a unit covers, so treat it as quote-based. Palo Alto announced its intent to buy the Portkey AI gateway on 30 April 2026 and completed the deal on 29 May; see our AI gateway comparison for what that means for Portkey users.

F5 AI Guardrails

Built from CalypsoAI, it runs as SaaS or self-hosted on EKS, AKS, GKE or Red Hat OpenShift, with air-gapped installs through the OpenShift operator, according to F5's community introduction. The marketplace price is a placeholder for private offers, so pricing is quote-based.

CrowdStrike Falcon AIDR and Falcon Guardian

Falcon AIDR detects malicious prompts, MCP tool poisoning, PII, secrets and invisible-character obfuscation. Collectors cover browsers, SDKs, AI gateways (Kong, LiteLLM, Portkey, Apigee, Azure API Management, TrueFoundry), Claude Code, Copilot Studio and an MCP proxy, in the US-1, US-2 and EU-1 clouds. AIDR reaches end of support on 30 November 2026, with its capabilities continuing in Falcon Guardian, launched on 1 September 2026. Pricing is quote-based.

HiddenLayer and Cisco AI Defense

HiddenLayer raised a $100 million Series B on 2 September 2026, led by Delta-v Capital, and added Agent Harness Security for coding agents. In February 2026, Cisco expanded AI Defense with an AI bill of materials covering MCP servers, multi-turn red teaming and NeMo Guardrails integration, as reported by Help Net Security. Neither publishes pricing.

Open-source frameworks and guard models

NeMo Guardrails is Apache-2.0, now lives at NVIDIA-NeMo/Guardrails, and shipped v0.24.1 on 16 September 2026. It orchestrates input, retrieval, execution and output rails around any classifier. NVIDIA's NemoGuard NIMs are free for development through the NVIDIA Developer Program but need an NVIDIA AI Enterprise licence in production: $4,500 per GPU per year, or $1 per GPU-hour plus the cloud instance cost. Guardrails AI's core framework stays Apache-2.0, with validators now installed as guardrails-ai-<name> packages from PyPI. Meta's LlamaFirewall (MIT) bundles Prompt Guard 2, AlignmentCheck and CodeShield, but has had no release since version 1.0.3 in May 2025. LLM Guard (MIT) is archived. For red teaming, Promptfoo is now part of OpenAI and remains MIT, and NVIDIA's garak is Apache-2.0.

Sources for the table are the model cards for Prompt Guard 2, Llama Guard 4, Granite Guardian 4.1, Shieldstral, gpt-oss-safeguard, Qwen3Guard and Nemotron 3.5 Content Safety. Prompt Guard 2's sizes are backbone parameters; the full checkpoints are larger. On Mistral's own tables, gpt-oss-safeguard-20B leads 9 of 18 text rows to Shieldstral's 4; our Shieldstral benchmark review covers that in detail. Two hosted classifiers are free: the OpenAI Moderation endpoint and Mistral Moderation 2. Both screen content categories; neither replaces a prompt-injection detector.

Head-to-head comparison

Pick X if

Worked cost example: 10 million agent requests a month

Assumptions. Each request screens 1,800 characters of input (user prompt plus retrieved or tool text, 2 units) and 900 characters of output (1 unit). That gives 20 million input units, 10 million output units and 6.75 billion Model Armor tokens (2,700 characters divided by 4, an upper bound because whitespace is excluded). List prices, US regions, before tax.

EC2 rates are us-east-1 on-demand prices, as listed by Vantage; spot prices are lower but can be interrupted. The GPU rows are eCorpIT assumptions, not measurements: 10 million requests average about 3.9 a second (7.7 screenings a second), and the second instance is for availability. Validate throughput with a load test, and add engineering time and any NVIDIA AI Enterprise fees.

The services detect different things, so cost per request is not cost per blocked attack. Azure bills each API separately, which is why it costs most here. Model Armor's per-token billing favours long retrieved documents, exactly where indirect injection hides.

India, EU and US: residency and regulatory dates

India. The DPDP Rules were notified on 13 November 2025. The consent-manager rule applies from about 13 November 2026, and most data-fiduciary duties, including security safeguards and breach intimation, from about 13 May 2027. Under the Act, failing to keep reasonable security safeguards can cost up to ₹250 crore. Residency by tool:

• Model Armor supports asia-south1 in limited form: with residency enforced, only the Responsible AI, Sensitive Data Protection, and prompt injection and jailbreak filters work.

• Azure lists Prompt Shields in South India, not Central India.

• Bedrock's Standard tier needs cross-Region inference, and the APAC profile from Mumbai can route checks to Tokyo, Seoul, Osaka, Singapore and Sydney as well as Mumbai. Standard-tier contextual grounding is not offered in Mumbai.

• Check Point processes SaaS traffic in the EU, US and Singapore; Falcon AIDR runs in US-1, US-2 and EU-1.

MeitY's India AI Governance Guidelines, released in November 2025, are non-binding.

EU. Regulation (EU) 2026/1744 was published on 24 July 2026 and took effect on 27 July. It moves Annex III high-risk obligations to 2 December 2027 and Annex I product-embedded systems to 2 August 2028, and adds new prohibited practices from 2 December 2026. Under the original AI Act, AI Office enforcement over general-purpose AI models began on 2 August 2026, with fines up to €15 million or 3% of worldwide turnover; the €35 million or 7% tier applies to prohibited practices.

US and standards. NIST AI RMF 1.0 and the AI 600-1 Generative AI Profile (July 2024) remain the reference, though NIST says the RMF is being revised under the White House AI Action Plan. The Cyber AI Profile (NIST IR 8596) is still an initial preliminary draft from December 2025. ISO/IEC 42001:2023 covers AI management systems. For how these fit together in an operating model, see our guide to enterprise AI agent governance layers.

Implementation checklist

1. Inventory every agent, its tools and the data each tool can reach.

1. Put tool-call authorisation in front of every write action, with human approval for irreversible ones.

1. Screen retrieved documents and tool output, not only user prompts.

1. Test one input classifier on your own traffic with Promptfoo or garak before buying.

1. Decide fail-closed or fail-open per tool and budget latency per hop.

1. Restrict agent and sandbox egress to a domain allowlist, as our AI coding agent sandboxes comparison explains.

1. Log every verdict and tool call to your SIEM.

1. Confirm the processing region before routing Indian personal data.

1. Re-run red-team suites on every model, prompt or tool change.

1. Track support dates, including Falcon AIDR and archived open-source dependencies.

How eCorpIT can help

eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our AI agent security and guardrails service designs the layered controls above, from agent identity and tool-call authorisation to retrieval screening and egress policy, tests candidate guardrails on your own traffic and red-teams the result, alongside our wider cybersecurity services. Talk to us at /contact-us/.

Last updated: 22 October 2026.

References

1. Amazon Bedrock pricing, Guardrails section — AWS

1. Falcon AIDR documentation and end-of-support notice — CrowdStrike

1. OWASP Top 10 for Agentic Applications for 2026 — OWASP GenAI Security Project

1. OWASP GenAI LLM Top 10 2026 — OWASP GenAI Security Project

1. Guardrails AI joins Harvey — Harvey

1. Guardrails Hub sunset, issue 1560 — GitHub

1. Amazon Bedrock Guardrails reduces pricing by up to 85% — AWS

1. OWASP GenAI Security Project unveils 2026 Top 10 for LLM applications — OWASP GenAI Security Project

1. Amazon Bedrock AgentCore pricing — AWS

1. What is Microsoft Entra Agent ID — Microsoft Learn

1. GuardrailContentFiltersTierConfig — Amazon Bedrock API Reference

1. Content Safety pricing — Microsoft Azure

1. Prompt Shields — Microsoft Learn

1. Security Command Center and Model Armor pricing — Google Cloud

1. AI Security for Apps is now generally available — Cloudflare

1. Workers AI pricing — Cloudflare documentation

1. AI Gateway guardrails usage considerations — Cloudflare documentation

1. Self-hosting — Check Point AI Guardrails documentation

1. Data regions — Check Point AI Guardrails documentation

1. Palo Alto Networks secures agentic AI with Prisma AIRS 3.0 — Palo Alto Networks

1. Prisma AIRS listing — AWS Marketplace

1. Introducing F5 AI Guardrails — F5 DevCentral

1. HiddenLayer raises $100M Series B — HiddenLayer

1. Cisco expands AI Defense for agentic AI — Help Net Security

1. NeMo Guardrails releases — GitHub

1. NVIDIA AI Enterprise licensing and pricing — NVIDIA

1. LLM Guard repository (archived) — GitHub

1. Llama Prompt Guard 2 model card — Meta

1. Llama Guard 4 12B model card — Hugging Face

1. Granite Guardian 4.1 8B model card — Hugging Face

1. Shieldstral 1.0 3B model card — Hugging Face

1. gpt-oss-safeguard-20b model card — Hugging Face

1. Qwen3Guard-Gen-8B model card — Hugging Face

1. Nemotron 3.5 Content Safety model card — Hugging Face

1. Moderation guide — OpenAI

1. Pricing — Mistral AI documentation

1. g6.xlarge pricing and specs — Vantage

1. Digital Personal Data Protection Rules, 2025, G.S.R. 846(E) — Gazette of India

1. Digital Personal Data Protection Act, 2023 — Gazette of India

1. Model Armor feature availability by region — Google Cloud

1. Content Safety region availability — Microsoft Learn

1. Regulation (EU) 2026/1744, Digital Omnibus on AI — EUR-Lex

1. AI Risk Management Framework — NIST

1. NIST IR 8596, Cyber AI Profile (initial preliminary draft) — NIST CSRC