← Ai Gateway / ai-gateway / features / guardrails

Usage considerations

Guardrails currently uses Llama Guard 3 8B ↗ on Workers AI to perform content evaluations. The underlying model may be updated in the future, and we will reflect those changes within Guardrails.

Since Guardrails runs on Workers AI, enabling it incurs usage on Workers AI. You can monitor usage through the Workers AI Dashboard.

Guardrails evaluate content against the following hazard categories. Each category is identified by a code that appears in your Guardrail configuration and in AI Gateway Logs. You can independently set each category to Flag, Ignore, or Block for prompts and responses.

Guardrails evaluate categories S1 through S13, a subset of the Llama Guard 3 ↗ ↗ hazard categories, using the @cf/meta/llama-guard-3-8b model on Workers AI. The Llama Guard 3 category S14 (Code interpreter abuse) is not evaluated by Guardrails. Category P1 is prompt injection, evaluated separately by the @cf/meta/prompt-guard-2-86m model.

These codes also appear in the guardrails property of the AI Gateway REST API, where you configure each category's action programmatically. See the create and update methods.

• Model availability: If at least one hazard category is set to block, but AI Gateway is unable to receive a response from Workers AI, the request will be blocked. Conversely, if a hazard category is set to flag and AI Gateway cannot obtain a response from Workers AI, the request will proceed without evaluation. This approach prioritizes availability, allowing requests to continue even when content evaluation is not possible.
• Latency impact: Enabling Guardrails introduces additional latency to requests. Typically, evaluations using Llama Guard 3 8B on Workers AI add approximately 500 milliseconds per request. However, larger requests may experience increased latency, though this increase is not linear. Consider this when balancing safety and performance.
• Handling long content: When evaluating long prompts or responses, Guardrails automatically segments the content into smaller chunks, processing each through separate Guardrail requests. This approach ensures comprehensive moderation but may result in increased latency for longer inputs.
• Supported languages: Llama Guard 3.3 8B supports content safety classification in the following languages: English, French, German, Hindi, Italian, Portuguese, Spanish, and Thai.

Guardrails does not support streaming (stream: true) requests. Prompts are still evaluated and enforced, but response behavior depends on the API surface.

On the REST API (api.cloudflare.com/*), Guardrails evaluates the response and logs the result, but does not enforce it — the client receives the full streaming response regardless of what Guardrails would have flagged. On the gateway endpoints (gateway.ai.cloudflare.com/v1/*), Guardrails buffers the full response, evaluates it, and returns a single non-streamed payload — the request no longer streams.

For non-streaming (stream: false) requests, both prompts and responses are evaluated and enforced.

Guardrails evaluates response payload text, including URL strings in image generation model responses. It does not retrieve or evaluate referenced images. Embedding and unknown model types bypass response evaluation regardless of streaming mode.

For more information, refer to Supported model types.

Full Guardrails support for streaming requests is on our roadmap.