Each layer scans every request, independently. Unlike token-based LLM pricing, most guardrail APIs charge per item checked — so the bill scales with request volume, not with how much the underlying model call itself costs. That's why a stack of paid layers can end up costing more than a cheap, fast model's own token spend.
—per request
—safety tax (% of LLM spend)
—layers active
Cost by tier, same volume
Same request volume and layer selection, three rate tiers.
| Tier | Guardrail cost / mo | Safety tax |
|---|
⚠️ Estimate using representative reference rates (July 2026), not live vendor pricing — rate cards vary by provider, item type (text vs image vs video) and volume discounts. Prototype tier assumes free/self-hosted models (OpenAI Moderation endpoint, Llama Guard on your own compute) at near-$0 marginal cost. Confirm current pricing with your chosen provider before committing. ·
Report outdated price →
Why "add a moderation call" undersells the real cost
Most cost planning for an LLM feature starts and ends at the model's own token price. A production system that talks to real users almost never ships with just that one call — it adds input moderation to catch bad prompts before they reach the model, output moderation to catch bad completions before they reach the user, and increasingly PII redaction and prompt-injection detection as agents gain tool-calling and document-processing abilities. Each of those is a separate API call, priced per item rather than per token, and each one runs on every single request regardless of how short or cheap the underlying model call was. At high volume with a fast, cheap model, the guardrail stack can become the larger line item on the bill — not the LLM.
The "safety tax" framing
Expressing guardrail cost as a percentage of LLM spend — the safety tax — makes the tradeoff legible in a way a raw dollar figure doesn't. A team running GPT-4o-class spend can absorb a few hundred dollars of moderation without noticing; the same guardrail bill next to a high-volume, cheap-model use case (customer support triage on a small fast model, for instance) can dwarf the model cost several times over. That's not a reason to skip guardrails — it's a reason to size the stack to the actual risk surface instead of running every layer on every request by default.
Where the real savings are
Two levers matter more than picking a cheaper vendor: pre-filtering with free heuristics (keyword/regex lists, known-bad-hash lookups) so only ambiguous content reaches the paid API, and being honest about which layers your product actually needs — see the FAQ above. Self-hosting an open guardrail model like Llama Guard 3 or Granite Guardian removes the per-item fee entirely in exchange for owning inference infrastructure, which is usually the better trade once volume is high and stable. For the moderation layer priced on its own, see the content moderation cost calculator; for evaluation/red-teaming spend rather than production filtering, see the LLM eval cost calculator.
Content Moderation CostLLM Eval CostAI Agent Cost CalculatorAPI Stack Cost CalculatorGuardrails: Self-Hosted vs Managed
How this calculator works
The AI Guardrails Stack Cost Calculator estimates the true monthly cost of running a production LLM safety layer — input moderation, output moderation, PII redaction, and prompt-injection detection — as a combined bundle rather than four separate line items. It multiplies your requests per month by the per-check cost implied by your selected rate tier, then expresses the total against your current LLM spend to show the safety tax: the percentage of your model budget that guardrails add on top. The main drivers are request volume, how many of the four checks you stack, and the tier you qualify for, since higher volume usually shifts unit pricing.
The key trade-off to watch is coverage versus overhead. Screening both input and output roughly doubles guardrail calls, and each check adds latency as well as cost, so a stack can quietly rival the model spend it protects. Use the calculator to test whether every layer earns its place — some workloads justify full moderation plus PII redaction, while lower-risk internal traffic may safely run input-only checks. Re-run it whenever request volume crosses a tier boundary, because the safety tax percentage can move sharply even when your underlying model usage stays flat.
Frequently asked questions
Why would a safety stack cost more than the LLM call itself?
Because each guardrail layer scans the same text independently and is priced per item, not per token — and a production setup often runs multiple layers (input moderation, output moderation, PII redaction, prompt-injection detection) on every single request. At high request volume with a cheap underlying model, the per-request guardrail fees can add up to more than a small/fast model's own per-request token cost, especially once you're past free tiers like OpenAI's Moderation endpoint and into paid third-party platforms.
Do I need all four guardrail layers?
No — it depends on what you're building. A simple internal tool with trusted, authenticated users can often skip prompt-injection detection and PII redaction entirely and rely on input+output moderation alone. A customer-facing agent that can take actions (tool calls, purchases, account changes) or that processes user-submitted documents is where injection detection and PII handling stop being optional. Toggle each layer off below to see what you're actually paying for the ones you don't need.
Is self-hosting guardrail models cheaper than an API?
Often yes, at scale — open models like Llama Guard 3 or IBM Granite Guardian can run on your own GPU or a shared inference endpoint for close to compute cost only, with no per-item fee. The tradeoff is the same as self-hosting any model: you own uptime, latency tuning, and keeping the model current against new attack patterns, versus a managed API that's priced per item but handles that maintenance for you.