Each layer scans every request, independently. Unlike token-based LLM pricing, most guardrail APIs charge per item checked — so the bill scales with request volume, not with how much the underlying model call itself costs. That's why a stack of paid layers can end up costing more than a cheap, fast model's own token spend.
Cost by tier, same volume
Same request volume and layer selection, three rate tiers.
| Tier | Guardrail cost / mo | Safety tax |
|---|
Why "add a moderation call" undersells the real cost
Most cost planning for an LLM feature starts and ends at the model's own token price. A production system that talks to real users almost never ships with just that one call — it adds input moderation to catch bad prompts before they reach the model, output moderation to catch bad completions before they reach the user, and increasingly PII redaction and prompt-injection detection as agents gain tool-calling and document-processing abilities. Each of those is a separate API call, priced per item rather than per token, and each one runs on every single request regardless of how short or cheap the underlying model call was. At high volume with a fast, cheap model, the guardrail stack can become the larger line item on the bill — not the LLM.
The "safety tax" framing
Expressing guardrail cost as a percentage of LLM spend — the safety tax — makes the tradeoff legible in a way a raw dollar figure doesn't. A team running GPT-4o-class spend can absorb a few hundred dollars of moderation without noticing; the same guardrail bill next to a high-volume, cheap-model use case (customer support triage on a small fast model, for instance) can dwarf the model cost several times over. That's not a reason to skip guardrails — it's a reason to size the stack to the actual risk surface instead of running every layer on every request by default.
Where the real savings are
Two levers matter more than picking a cheaper vendor: pre-filtering with free heuristics (keyword/regex lists, known-bad-hash lookups) so only ambiguous content reaches the paid API, and being honest about which layers your product actually needs — see the FAQ above. Self-hosting an open guardrail model like Llama Guard 3 or Granite Guardian removes the per-item fee entirely in exchange for owning inference infrastructure, which is usually the better trade once volume is high and stable. For the moderation layer priced on its own, see the content moderation cost calculator; for evaluation/red-teaming spend rather than production filtering, see the LLM eval cost calculator.