← Safety

核验标记表示资料完整度，不是产品评分。下列未确认项可能影响选型；请按对应来源逐项确认。The confidence mark describes evidence completeness, not a product score. Unconfirmed items below may affect your choice; check them against the relevant sources.

模型与开放条件Model & openness

守的是你应用里接的那个模型，模型本身不由它提供。官方 Supported LLMs 页在册：NVIDIA NIM、 OpenAI、Azure、Anthropic、Hugging Face、Ollama、LangChain，可同机服务也可远端端点。 护栏判定可用应用模型自检（LLM self-checking）、NemoGuard / Nemotron 专用安全模型， 也可挂第三方（目录在册 LlamaGuard、ActiveFence、Cisco AI Defense 等）。

It guards the model your app already calls; it does not supply one. The official Supported LLMs page records NVIDIA NIM, OpenAI, Azure, Anthropic, Hugging Face, Ollama and LangChain, served either on the same machine or at a remote endpoint. Rail decisions can use the application LLM for self-checking, dedicated NemoGuard / Nemotron safety models, or third parties (the catalog records LlamaGuard, ActiveFence, Cisco AI Defense).

运行位置Where it runs

开源 Python 库，官方 About 页在册两种交付：PyPI 包与容器镜像。装在你自己的进程或容器里跑， installation 页在册 pip 安装、Python 3.10–3.13、uv 起 server、Docker 可用。 检测逻辑在本地引擎执行，模型调用按你配置的端点出去。

An open-source Python library; the About page records two delivery forms: the PyPI package and a container image. It runs inside your own process or container. The installation page records pip install, Python 3.10-3.13, starting the server with uv, and Docker. Rail logic executes locally; model calls go wherever you configure them.

本地文件Local files

配置目录（config.yml + flows / actions）在你本机文件系统，CLI 与 server 直接读该目录。 官方页未声明它读写你的工作区业务文件；评测用公开数据集（evaluate 页在册 chit-chat、MSMARCO）。 更大范围的本地文件面本次未逐条核验，记为未知。

The config folder (config.yml plus flows and actions) lives on your own filesystem and is read directly by the CLI and the server. No official statement was found about reading your project's business files; evaluation uses public datasets (chit-chat, MSMARCO, on the evaluate page). The wider local file surface was not verified item by item and is recorded as unknown.

关机后的任务Tasks after shutdown

没有托管侧的「关机后续跑」任务面：它是随你的应用一起起来的库或服务进程。 官方 CLI 页在册 chat / server / convert / find_providers 等子命令， evaluate 页在册离线批跑评测；异步队列与断点续跑不在产品口径里。

There is no hosted 'keeps running after shutdown' task surface: it comes up with your application. The CLI page records chat / server / convert / find_providers, and the evaluate page records offline batch evaluation. Queues and resumption are not part of the product framing.

工具与扩展Tools & extensions

五类 rail 在册：input / dialog / retrieval / execution / output，execution rail 管工具调用， 自定义 action 可挂自己的校验函数。LangChain / LangGraph 走 passthrough mode 集成。 config.yml 顶层键（models / instructions / rails / prompts / knowledge_base / tracing） 未见 MCP server 配置项，MCP 接入方式记为未知。

Five rail types are on record: input / dialog / retrieval / execution / output, where execution rails govern tool calls and custom actions let you plug in your own checks. LangChain and LangGraph integrate through passthrough mode. The top-level config.yml keys (models / instructions / rails / prompts / knowledge_base / tracing) contain no MCP server entry, so MCP access is recorded as unknown.

上下文与记忆Context & memory

会话消息由调用方带入，rail 在处理 user / assistant 消息时逐条判定； retrieval rail 可读 knowledge_base 做检索过滤。跨会话记忆与持久化策略本次未核验到官方声明， 记为未知；上下文长度实际上限由你所选模型决定。

Conversation messages are passed in by the caller and rails judge user / assistant messages one by one; retrieval rails can read the knowledge_base. No official statement was verified on cross-session memory or rail-state persistence, recorded as unknown; effective context length is set by whichever model you choose.

权限与限制Permissions & limits

数据流向取决于你选的端点：本地 / 自托管端点内容不出你的环境； catalog 页在册第三方 guardrail 服务会把送检内容交给该方。许可证 Apache-2.0（当日在册）。 观测面有 logging / tracing 专页在册。合规认证（SOC 2 / ISO 等）与训练用途承诺本次未核验，记为未知。

Data flow depends on the endpoint you select: local or self-hosted endpoints keep content inside your environment, while the catalog page records that third-party guardrail services send submitted content to that party. Apache-2.0 is on the PyPI and repository pages the same day. Logging and tracing have dedicated pages. Compliance certifications and training-use commitments were not verified and are recorded as unknown.

适合什么任务Best for

适合：要在自己的进程或容器里加可编程护栏——话题控制、PII、越狱检测、工具调用管控， 并且要能换模型与端点。不适合：只想要一个托管控制台带审核工作流、要把评测平台当主轴、 或不能接受「护栏质量取决于所选模型」这件事。

Fits: teams adding programmable rails inside their own process or container - topic control, PII, jailbreak detection, tool-call governance - while keeping the freedom to swap models and endpoints. Not a fit: anyone wanting a hosted console with review workflows, or treating rail quality as a vendor guarantee, since the judgement inherits whichever model runs it.

本页由This page is generated from the ai-handbook 数据层生成（CC BY 4.0）。data layer (CC BY 4.0). 方法论与坐标系定义见仓库内For the methodology and coordinate definitions, see METHODOLOGY.md.