Last updated October 25, 2026. Tool coverage, size limits, languages, and pricing were checked against AWS, Microsoft, and Google Cloud docs and pricing pages on that date.
Bedrock Guardrails vs Azure Prompt Shields vs Model Armor comes down to where your agents run and which text you need screened: Bedrock Guardrails for AWS apps, Azure Prompt Shields for Foundry agents, and Google Model Armor for the lowest unit price. All three detect prompt injection and jailbreaks, but each one handles agent tool output differently.
Cloud AI guardrails are managed APIs that score prompts, documents, and model responses for attacks or harmful content before your app acts on them. This guide is part of our agent security coverage inside the wider AI governance and security hub, and it compares the three native options from the big clouds head to head.
We read every AWS, Microsoft, and Google Cloud doc and pricing page cited here on October 25, 2026. We also sized 36 real agent tool outputs against each vendor’s billing units and size limits, because published per-unit prices hide very different bills. No vendor paid for placement or reviewed this page, per our editorial standards and disclosure policy.
TL;DR
- Pick by cloud first. Each shield is cheapest to run and easiest to govern inside its own cloud’s identity, logging, and billing.
- Tool output coverage differs. Bedrock’s Converse guardrail skips tool results, Azure screens tool responses for eight supported Foundry tools in preview, and Model Armor screens tools/call traffic on Google MCP servers.
- Model Armor is far cheaper per scan. In our sizing test, screening 1 million tool results cost about $441 on Model Armor, $1,637 on Bedrock InvokeGuardrailChecks, and $7,774 on Azure at list price.
- Size limits bite on Azure. 25 of our 36 real tool outputs exceeded the 10,000-character Prompt Shields document limit and would need chunking.
- Language coverage is uneven. Azure says Prompt Shields is primarily trained on English, Model Armor tests nine languages, and Bedrock’s Standard tier claims the widest support.
Bedrock Guardrails vs Azure Prompt Shields vs Model Armor: The Quick Verdict
Choose Amazon Bedrock Guardrails when your models and agents already run on AWS, Azure Prompt Shields when you build on Azure OpenAI or Foundry Agent Service, and Google Model Armor when you run on Google Cloud or need the lowest cost per screened token. Choose none of them alone when agents read untrusted tool output at scale.
- Choose Bedrock Guardrails when you call Bedrock models through Converse or InvokeModel and want one guardrail resource for prompt attacks, content filters, denied topics, and sensitive data. Add InvokeGuardrailChecks or AgentCore Gateway policies for tool output.
- Choose Azure Prompt Shields when your agents run in Foundry Agent Service with supported tools such as Azure AI Search, Azure Functions, OpenAPI, or Bing Grounding, so tool responses get screened at the platform level.
- Choose Google Model Armor when you run Gemini on Vertex AI, call Google MCP servers, or screen very large volumes of text, since its per-token price was the lowest in our test.
- Choose none of them alone when your agents call third-party MCP servers on another cloud, read encoded payloads, or need multi-turn context. Pair a shield with a gateway and least-privilege tools.
Cloud AI Guardrails Compared at a Glance
The three cloud shields share the same core job, which is classifying prompt attacks and harmful content, but they differ on billing units, tool output coverage, size limits, and language support. The table below summarizes each one from the vendor pages we opened on October 25, 2026, with links in the sections that follow.
| Feature | Amazon Bedrock Guardrails | Azure Prompt Shields | Google Model Armor |
|---|---|---|---|
| Attack types | Jailbreaks, prompt injection, prompt leakage (Standard tier) | User prompt attacks and document attacks with subtypes | Prompt injection and jailbreak, malicious URLs |
| Thresholds | None, Low, Medium, High per prompt and response | Annotate or block per intervention point | High, Medium and above, Low and above |
| Tool output in agents | Not on Converse; use InvokeGuardrailChecks or AgentCore Gateway policy | Preview at the tool response point for eight Foundry tools | Google MCP servers via floor settings, or any text you send |
| Billing unit | Text unit up to 1,000 characters | Text record up to 1,000 Unicode code points | Token of about four non-whitespace characters |
| List price | $0.15 per 1,000 units (content filters); $0.08 for prompt attack via checks API | $0.38 per 1,000 records; 5,000 free a month | $0.10 per 1M tokens; 2M free a month |
| Size limit | Billed per text unit; no injection window found in docs we read | 10,000 characters per prompt and across up to five documents | 65,536 tokens for injection; files up to 4 MB |
| Languages | Standard tier extensive; Classic is English, French, Spanish | Primarily English | Nine tested languages |
Verdict: Bedrock offers the broadest guardrail policy set, Azure has the most native agent hooks inside Foundry, and Model Armor has the cheapest units and the largest screening window. None of them screens every tool call on every platform for you.
What Our Tool Output Sizing Test Found
Real agent tool outputs are much larger than chat prompts, with a median of 16,323 characters across 36 payloads we collected, so per-unit prices that look similar produce bills that differ by more than 17 times. Model Armor came out cheapest and Azure the most expensive at list price in every scenario we modeled.
We collected 36 payloads on October 25, 2026 that match what common agent tools return: GitHub issue lists and READMEs, single issue bodies, PyPI and npm package metadata, search API results, encyclopedia articles as plain text, documentation pages fetched as text, and two RSS feeds. Then we applied each vendor’s documented billing unit and size limit to every payload.
$ python analyze.py # 36 real tool outputs, October 25, 2026
median chars 16,323 | mean 38,177 | p90 48,431
billed per median payload: Bedrock 17 text units | Azure 17 text records | Model Armor 3,504 tokens
over 1,000 chars (Foundry text moderation window): 36 of 36
over 10,000 chars (Prompt Shields document limit): 25 of 36 -> chunking needed
over 65,536 tokens (Model Armor injection limit): 1 of 36 (675,758-char RSS feed)
list cost per 1M tool results, outlier excluded (35 payloads):
Bedrock ApplyGuardrail content filters $3,069
Bedrock InvokeGuardrailChecks prompt $1,637
Azure Prompt Shields $7,774
Google Model Armor $441
The gap comes from billing units. Bedrock and Azure both round each payload up to the next 1,000 characters, so the same 20.5 units per payload cost $0.15 or $0.08 per 1,000 on AWS and $0.38 per 1,000 on Azure. Model Armor counts about four non-whitespace characters per token at $0.10 per million, which works out far lower for long JSON and markdown.
Size limits matter as much as price. Azure’s service limits page caps Prompt Shields at 10,000 characters for the prompt and 10,000 characters across up to five documents, so a five-issue GitHub response of 26,962 characters needs three calls. The same page says Foundry guardrails moderate the first 1,000 characters for text scenarios, which every payload in our set exceeded.
What this means for buyers: price your shield on real tool output, not on chat prompts. Log a week of tool results, count characters and non-whitespace characters, and multiply by the units above before you commit, since a busy agent can screen far more text from tools than from users.
Amazon Bedrock Guardrails: Best for AWS Apps and Broad Policy Coverage
Amazon Bedrock Guardrails is the strongest fit for teams already on AWS, because one guardrail resource covers prompt attacks, content filters, denied topics, sensitive data, and grounding checks under the same IAM and billing as Bedrock inference. The prompt attack docs list jailbreaks, prompt injection, and prompt leakage, with leakage on the Standard tier only.
Filter strength runs from None to High, and you can set different levels for prompts and responses with block or detect actions. The tier docs say the Standard tier is more resilient than Classic, supports code, and uses cross-Region inference, while Classic covers only English, French, and Spanish. The language docs warn that guardrails are ineffective in unsupported languages.
Two details catch agent builders. With InvokeModel, only text inside guardrail input tags gets checked for prompt attacks, so an untagged prompt is not filtered. With Converse, the Converse guardrail docs list tool results, tool definitions, and tool call arguments as content that no guardrail filter evaluates.
- Best for: AWS teams that want prompt attack detection plus denied topics, PII masking, and grounding checks in one managed policy.
- Covers: Jailbreaks, prompt injection, prompt leakage, harmful content, denied topics, sensitive data, contextual grounding, Automated Reasoning checks.
- Pricing (October 2026): Bedrock pricing: content filters and denied topics $0.15 per 1,000 text units, sensitive information $0.10, word and regex filters free; prompt attack via InvokeGuardrailChecks $0.08.
- Watch out for: Converse skips tool content, untagged InvokeModel prompts skip prompt attack filtering, and InvokeGuardrailChecks runs in only seven Regions.
Azure AI Content Safety Prompt Shields: Best for Foundry Agents
Azure Prompt Shields is the best fit for teams building on Azure OpenAI or Foundry Agent Service, because Foundry can apply it at the user input point and, in preview, at the tool response point for supported tools. The Prompt Shields docs split detection into user prompt attacks and document attacks hidden in emails, pages, and files.
User prompt attack subtypes include changing system rules, conversation mockups, role play, and encoding attacks. Document attack subtypes cover manipulated content, infrastructure access, information gathering, availability, fraud, malware, and system rule changes. The Foundry guardrail docs turn user prompt detection on by default and leave document attack detection off, so agent builders must switch it on.
Microsoft says the models are primarily trained and evaluated on English, so test every language your agents read. Spotlighting, a preview feature that base64-encodes document text to mark it as untrusted, adds tokens and works only with the Chat Completions API. The standalone Content Safety API returns verdicts but does not block content itself.
- Best for: Azure OpenAI and Foundry Agent Service builders who want native screening with no new vendor.
- Covers: User prompt attacks, document attacks with subtypes, tool responses for supported Foundry tools in preview, Spotlighting in preview.
- Pricing (October 2026): Content Safety pricing: 5,000 free text records a month, then $0.38 per 1,000 records of up to 1,000 code points; disconnected containers on commitment tiers.
- Watch out for: The 10,000-character request limit, mostly English training data, and tool response screening limited to eight tools in preview.
Google Cloud Model Armor: Best for Google Cloud and Low Unit Cost
Google Model Armor is the low-cost pick for Gemini and Vertex AI teams, with 2 million free tokens a month standalone, $0.10 per million after that, and a prompt injection window of 65,536 tokens. The Model Armor overview covers prompt injection and jailbreak detection, responsible AI filters, malicious URLs, and Sensitive Data Protection.
Templates set confidence at High, Medium and above, or Low and above, and Google recommends Medium for prompt injection. Enforcement is inspect only or inspect and block, but on the direct sanitize API your code still acts on the verdict. Inputs under three words return no match, and screening is single turn with no decoding of Base64, hex, or URL-encoded text.
The quotas page lists 65,536 tokens for injection and responsible AI filters and 0.5 MB for Sensitive Data Protection, and real-time streaming mode has no token limit. Model Armor tested prompt injection in nine languages, including Chinese, Japanese, Korean, and Portuguese. Document screening covers PDF, CSV, TXT, DOCX, PPTX, and XLSX files up to 4 MB.
- Best for: Google Cloud teams running Gemini on Vertex AI or calling Google MCP servers, and anyone screening high text volumes.
- Covers: Prompt injection and jailbreak, responsible AI, malicious URLs, sensitive data, documents up to 4 MB, Google MCP server traffic.
- Pricing (October 2026): Standalone pricing: 2 million tokens free per month, then $0.10 per million tokens; Security Command Center Premium and Enterprise include 3 billion tokens.
- Watch out for: Single-turn screening, no decoding of encoded payloads, and Google MCP server integration fixed to the older v1 filter version.
How Do the Three Shields Handle Agent Tool Calls?
All three shields can screen tool output, but only when you wire it in at the right layer: an AgentCore Gateway policy or your own API call on AWS, the Foundry tool response point on Azure, and floor settings for Google MCP servers on Google Cloud. Tool metadata such as MCP tool lists stays unscreened on all three.
AWS: call the checks yourself or screen at the gateway
The InvokeGuardrailChecks API needs no guardrail resource, runs detect only, and returns confidence scores from 0 to 1, so you can call it right after a tool returns. AWS made guardrails in AgentCore policy generally available on June 17, 2026, letting gateway policies score MCP tools/call inputs and outputs and deny or suppress them.
Prompt attack scores in AgentCore are discrete steps of 0.2, and the policy examples use a default threshold of 0.4 that fires at 0.6 and above. Guardrails in policy run in five Regions: US East (N. Virginia), London, Stockholm, Sydney, and Tokyo. Our Kong vs AgentCore vs Docker comparison covers the gateway itself.
Azure: the tool response intervention point
Foundry applies guardrails at four intervention points: user input, tool call, tool response, and output. At the tool response point in preview, the full payload from each tool is scanned for indirect attacks, and the agent stops if one is found. Microsoft says each point adds about 50 to 100 ms of latency.
Tool call and tool response screening only work for tools that support moderation: Azure AI Search, Azure Functions, OpenAPI, SharePoint Grounding, Fabric Data Agent, Bing Grounding, Bing Custom Search, and Browser Automation. MCP tools were not on that list on October 25, 2026, so agents calling outside MCP servers still need their own Prompt Shields call on each result.
Google Cloud: floor settings for Google MCP servers
Project floor settings can screen traffic to Google and Google Cloud MCP servers, covering tools/call and prompts/get requests and responses plus tool execution errors. Model Armor passes tools/list, resources, notifications, and streamable HTTP traffic through without screening, so poisoned tool descriptions are out of scope.
Google also notes that some MCP servers skip Model Armor without errors or logs when it is not available in the request’s jurisdiction. Agents that call third-party MCP servers need the sanitize API in their own code. Our MCP security tools guide and MCP gateways guide cover tool-layer controls for every platform.
Pricing Compared at Agent Scale
At list price and our measured payload mix, an agent that runs 100,000 sessions a month with one 1,200-character prompt and three tool results each would pay about $134 on Model Armor, $507 to $951 on Bedrock, and $2,406 on Azure Prompt Shields. Free tiers matter only at small volumes.
| Monthly agent runs | Bedrock ApplyGuardrail | Bedrock InvokeGuardrailChecks | Azure Prompt Shields | Google Model Armor |
|---|---|---|---|---|
| 10,000 | $95 | $51 | $239 | $13 |
| 100,000 | $951 | $507 | $2,406 | $134 |
| 1,000,000 | $9,506 | $5,070 | $24,079 | $1,347 |
Verdict: Model Armor is the cheapest option by a wide margin at every volume we modeled. Bedrock’s InvokeGuardrailChecks costs about half of a full guardrail for prompt attack screening, and Azure is the most expensive per screened character, so Azure buyers should size tool output carefully.
Three caveats apply. These are list prices with no committed-use discounts, Model Armor bundles 3 billion tokens into Security Command Center Premium and Enterprise, and Bedrock bills each extra policy you add on top of prompt attacks. Our LLM cost monitoring tools guide shows how to track guardrail spend next to model spend.
Limits and Gotchas That Change the Choice
The documented limits that change the choice most are Bedrock skipping tool content on Converse, Azure capping each request at 10,000 characters, and Model Armor ignoring encoded text and multi-turn context. Each one has a workaround, but you have to build it, test it, and keep monitoring it.
| Limit | Amazon Bedrock Guardrails | Azure Prompt Shields | Google Model Armor |
|---|---|---|---|
| Unscreened by default | Tool results, tool specs, tool call arguments on Converse; untagged InvokeModel text | Document attacks off by default in Foundry | Inputs under three words return no match |
| Encoded text | Standard tier handles more attack styles | Encoding attacks listed as a subtype | No decoding of Base64, hex, URL encoding |
| Conversation scope | Per request | Per request | Single turn only |
| Region notes | InvokeGuardrailChecks in 7 Regions | Check region availability page | Some regions skip non-English detection |
| Rate limits | Account quotas per Region | S0: 1,000 requests per 10 seconds | Project quotas |
Verdict: No shield covers encoded payloads, multi-turn attacks, and tool metadata together. Normalize and decode text before screening, keep tool descriptions under change control, and test with your own attack set after every vendor model update.
Which Cloud AI Guardrail Should You Choose?
Start with the shield native to the cloud where your models run, then check whether it screens tool output in your agent framework, and add a second control only where it does not. Running a shield across clouds adds network hops, separate identity, and data residency reviews that usually outweigh price savings.
| Your situation | First choice | Also consider |
|---|---|---|
| Bedrock models with Converse | Bedrock Guardrails plus InvokeGuardrailChecks on tool output | AgentCore Gateway policy |
| Agents behind AgentCore Gateway | Guardrails in AgentCore policy | Bedrock Guardrails on the model |
| Foundry Agent Service with supported tools | Azure Prompt Shields at tool response | Spotlighting for documents |
| Azure agents calling outside MCP servers | Prompt Shields API on each tool result | An MCP gateway with screening |
| Gemini on Vertex AI | Model Armor templates or floor settings | Sensitive Data Protection inside Model Armor |
| Very high text volume on any cloud | Model Armor sanitize API | Bedrock InvokeGuardrailChecks |
Verdict: Bedrock wins for AWS breadth, Azure wins for native Foundry agent hooks, and Model Armor wins on price and window size. The right answer for most teams is the native shield plus explicit screening of every tool result.
You run agents on AWS
- Attach a Standard tier guardrail to Converse calls for prompts and responses.
- Call
InvokeGuardrailCheckson each tool result before the next model turn, or route tools through AgentCore Gateway with a guardrail policy. - Wrap InvokeModel input in guardrail tags so prompt attack filtering actually runs.
You run agents on Azure
- Turn on document attack detection, which is off by default in Foundry.
- Use supported tools so the tool response point applies, and call the API directly for MCP tools.
- Chunk long tool output into 10,000-character pieces and block if any chunk flags.
You run agents on Google Cloud
- Set separate input and output templates at Medium confidence for prompt injection.
- Use floor settings for Google MCP servers, and call the sanitize API for third-party tools.
- Decode Base64 and URL-encoded text yourself before screening, and test with our agent testing tools.
When These Cloud Shields Are Not Enough
A single cloud shield is not enough when your agents span clouds, call third-party MCP servers, read encoded or multilingual content, or take high-risk actions such as payments and code deploys. In those cases, treat the shield as one detector and design containment around it.
- Multi-cloud agents: a vendor-neutral detector or gateway gives one policy, which our AI agent security tools roundup and LLM gateways guide cover.
- Third-party MCP servers: none of the three screens tool lists or descriptions, so pin and review tool metadata as shown in our ToFu MCP tool security bugs study.
- High-risk actions: put approvals and least privilege in front of writes, following the NIST, NSA, and CISA practices for rogue agents.
- Regulated programs: map shields to controls in our AI agent governance guide and governance and compliance coverage.
Frequently Asked Questions
Which is better, Bedrock Guardrails or Azure Prompt Shields?
Bedrock Guardrails is better for AWS apps that need prompt attacks, denied topics, and PII masking in one policy. Azure Prompt Shields is better for Foundry agents, since it can screen tool responses for supported tools in preview. Pick the shield native to the cloud where your models and agents already run.
Is Google Model Armor cheaper than Bedrock Guardrails and Azure?
Yes, at list price. In our October 25, 2026 sizing test of 35 real tool outputs, screening 1 million results cost about $441 on Model Armor, $1,637 on Bedrock InvokeGuardrailChecks, and $7,774 on Azure Prompt Shields, because Model Armor bills per token rather than per 1,000 characters.
Does Bedrock Guardrails check tool results for prompt injection?
Not through a guardrail attached to Converse. AWS docs say tool results, tool definitions, and tool call arguments are not evaluated by any guardrail filter. Call InvokeGuardrailChecks or ApplyGuardrail on each tool result yourself, or screen MCP traffic with guardrails in AgentCore Gateway policy.
What is the size limit for Azure Prompt Shields?
Azure caps Prompt Shields at 10,000 characters for the user prompt and 10,000 characters total across up to five documents per request. In our test, 25 of 36 real agent tool outputs exceeded that limit, so long results need chunking into several calls, and each extra call adds latency and cost.
Can I use Model Armor with agents that are not on Google Cloud?
Yes. The Model Armor sanitize API screens any text you send, so agents on other clouds can call it on prompts and tool results. Expect extra network latency, a separate identity setup, and data residency review, and remember that Model Armor screens single turns and does not decode Base64 or hex.
Related Guides
For related coverage, see our prompt injection detection tools, AI guardrails tools roundup, NeMo Guardrails vs Guardrails AI vs Llama Guard, Lakera alternatives and Prompt Security alternatives.
Keep going with the agent security hub, the AI governance and security hub, our AI agent security tools roundup, Zenity vs Noma vs Pillar, MCP security tools, MCP gateways, MCP explained, and Cloudflare vs Vercel vs AgentCore. Each one is live and covers a layer that sits next to cloud guardrails in a production agent stack.
More context sits in the AI agent governance guide, Microsoft Dynamic Agent Risk, the NIST and CISA incident response practices, governance and compliance coverage, editorial standards, disclosure, and contact.
The Bottom Line
Use Amazon Bedrock Guardrails on AWS, Azure Prompt Shields for Foundry agents, and Google Model Armor on Google Cloud or wherever screening volume makes price the deciding factor. Whichever shield you pick, screen every tool result explicitly, because each cloud leaves at least one agent path unscreened by default.
Prices, preview features, and supported tool lists change often, so recheck the linked docs before you sign a commitment and rerun the sizing method on your own tool outputs. Send corrections or your own measurements through our contact page.