Head to head · updated 2026-09
AEGIS vs NeMo Guardrails
Different points of intervention. NVIDIA NeMo Guardrails uses the Colang DSL to shape conversational flow — topical rails, input/output rails, retrieval rails. AEGIS is a runtime firewall on the tool-call execution path with a cryptographic audit chain. Common pattern: NeMo shapes the dialog, AEGIS gates the side effects.
Written by the AEGIS team. Facts cross-referenced against docs.nvidia.com/nemo/guardrails and github.com/NVIDIA/NeMo-Guardrails as of 2026-09.
TL;DR
- NeMo Guardrails = dialog flow: Colang DSL for topical / input / output / retrieval / execution rails. Great for content shaping and conversation constraints.
- AEGIS = tool-call firewall: pre-execution block, cost-aware cascade (rules → XGBoost → LLM), cryptographic audit chain, human-review queue.
- Together: NeMo input rails filter the user turn → model emits tool call → AEGIS mediates the call → reviewer approves pending. Additive, not competing.
Head-to-head capability matrix
| Capability | AEGIS | NeMo Guardrails | Notes |
|---|---|---|---|
| Category | Runtime firewall + cryptographic audit | Conversational safety / dialog flow control | AEGIS gates tool calls at the execution boundary. NeMo Guardrails uses the Colang DSL to constrain dialog flow (topical rails, input/output rails, retrieval rails, execution rails). |
| Runtime enforcement (block tool call) | Yes (pre-execution block) | Yes (via execution rails, DSL-driven) | Both can block tool execution. NeMo does it through a Colang rule the developer writes; AEGIS does it through a policy DSL + trained classifier + LLM judge cascade. |
| Programming model | JSON Schema policies + 2-line SDK auto() | Colang (Python-embedded DSL for dialog rules) | AEGIS: declarative JSON Schema, no new language to learn. NeMo: write Colang rules (novel DSL) that describe conversational flows and rails. |
| License | MIT (core) | Apache-2.0 | Both fully open-source. |
| Deployment | Self-host + hosted | Self-host (library or NIM microservice) | AEGIS runs as a binary + optional Postgres. NeMo ships as a Python library and as a NIM inference microservice. |
| Cryptographic audit chain | Yes (Ed25519 + SHA-256, RFC 6962 style) | No | AEGIS ships a tamper-evident log verifiable by third parties. NeMo focuses on runtime enforcement, not evidence generation. |
| Peer-reviewed benchmark | Yes (arXiv:2603.12621) | No (docs-driven) | AEGIS publishes head-to-head numbers on ToolGuard-Bench. NeMo publishes technical reports and blog posts; no peer-reviewed gateway benchmark. |
| Human-in-the-loop approval queue | Yes (Compliance Cockpit) | No (not in scope) | AEGIS routes ambiguous / high-risk calls to a reviewer UI. NeMo returns a rail decision to the caller. |
| EU AI Act / SOC 2 evidence pack | Yes (Article 12-15 signed export) | No | AEGIS emits a signed compliance pack. NeMo does not — this is an add-on the deployer builds on top. |
| Dialog-flow control (topical rails) | No | Yes (Colang native strength) | NeMo excels at conversational flow constraints ("do not discuss competitors", "always answer in Spanish first"). AEGIS scope is tool-call enforcement, not dialog shaping. |
Frequently asked
Is AEGIS a NeMo Guardrails alternative?
They overlap on the "block risky tool call" scenario but sit at different layers. NeMo Guardrails shapes conversational flow with the Colang DSL — great for topical rails, input/output rails, and retrieval rails. AEGIS is a runtime firewall on the tool-call execution path with a cryptographic audit chain and human-review queue. Many production teams deploy both.
Do I need Colang to use AEGIS?
No. AEGIS policies are declarative JSON Schema (with an optional natural-language authoring UI); there is no new language to learn. NeMo requires Colang for its rules.
Which one has better prompt-injection defence?
On the ToolGuard-Bench runtime path, AEGIS is the only system that publishes head-to-head numbers (99.9% block at 1.06 ms P50). NeMo's input rails can block obvious prompt-injection attempts before they reach the model; AEGIS blocks them at the tool-call boundary after they cause the model to emit a malicious call. Different points of intervention.
Can I use them together?
Yes. A common pattern: NeMo input rails filter user turns for obvious PI + topical rails constrain the conversation → the model produces tool calls → AEGIS mediates each tool call with cascade classification + cryptographic audit → human reviewer approves pending calls. NeMo's input safety + AEGIS's execution-path enforcement are additive.
Is NeMo Guardrails free?
Yes, Apache-2.0. NVIDIA also offers NIM microservice deployment for enterprise. AEGIS is MIT for the core engine with open-core paid tiers.
Try AEGIS
MIT-licensed engine. Deploys alongside NeMo Guardrails.