NeMo Guardrails — agentic threat model

Integrates with multiple foundation models. Vulnerable to adversarial jailbreaks designed to bypass the guardrail checks, or prompt injection attacks that manipulate the guardrail's internal LLM self-evaluation steps.

Features 'retrieval rails' to validate RAG inputs/outputs. Threats include data poisoning of the vector database or knowledge base, which can lead to the retrieval of malicious context that evades guardrail detection.

Uses Colang scripting and 'execution rails' to run custom code/actions. Threats include remote code execution (RCE) if execution rails run untrusted code, and logic bypasses in Colang dialog flow definitions.

Not certain from the listing — As an open-source toolkit, deployment security depends on the integrator. Threats include lack of sandboxing for execution rails and insecure API exposure of the guardrails server.

Acts as an active observability and policy enforcement layer. Threats include guardrail evasion (gaming the evaluation criteria), latency overhead leading to denial of service, and insufficient logging of blocked malicious attempts.

Not certain from the listing — Helps enforce safety compliance policies (e.g., toxic content filtering), but does not natively manage user authentication, authorization, or enterprise compliance audits.

Not certain from the listing — While it can be deployed to protect individual agents, the listing does not detail native multi-agent ecosystem trust boundaries or marketplace security controls.