Arc vs NVIDIA NeMo Guardrails

What NeMo Guardrails actually is

NeMo Guardrails is NVIDIA's open-source (Apache 2.0) Python toolkit for adding programmable rails to LLM-based conversational systems. It supports five rail categories — input, dialog, retrieval, execution, and output — defined in Colang, a Python-like DSL for dialogue flows. Input rails can reject or rewrite a user message; dialog rails steer the conversation through canonical intents; retrieval rails filter RAG chunks; output rails check what the model says before the user sees it. NVIDIA also ships NemoGuard NIM microservices for content safety and topic control (licensing varies — check NVIDIA's site).

It's a genuinely good toolkit for its job: keeping a conversational system on-topic, moderated, and structured. If your problem is “the bot said something it shouldn't,” NeMo Guardrails is built for exactly that.

Where the layers split

NeMo Guardrails' newest piece — execution rails — does get closer to the action: check tool input / check tool output flows let you validate tool parameters in Python before an action fires. Worth being precise about what that is and isn't:

• It's in-process code you write, running inside the same Python process as the agent. There's no out-of-band policy service, so a code path that skips the rails skips the guardrail.
• There's no human approval lifecycle. A rail can block a tool call; it cannot park it in a queue, page a human, expire after an hour, and resume on approval.
• There's no execution proof. Nothing cryptographically binds “this action passed the rail” to “this is what your app executed.” Arc delivers approved work as an ES256-signed JWS — your app verifies signature, timestamp, nonce, and a hash of the exact body before business logic runs.
• There's no enforced spend cap or tamper-evident audit. NeMo Guardrails doesn't meter cumulative dollars or write a hash-chained log; Arc does both (sha256(prev_hash + canonical_json), redacted).

The honest framing: NeMo Guardrails governs the model layer — what goes into and comes out of the LLM. Arc governs the action layer — whether issue_refund or delete_customer is allowed to run at all, who approved it, and whether what executed is what was approved. Neither stops prompt injection at the model level — Arc explicitly does not; it's the layer that limits what an injected agent can do.

Capability comparison

● full · ◔ partial · ○ no

Run them in series, not in competition

These tools compose cleanly. Rails clean the text; Arc gates the consequence:

user → NeMo Guardrails (input/dialog/output rails — the text)
     → agent decides to act
     → Arc (allow / ask / block → human approval → ES256-signed exec)
     → your app (verifies signature, runs business logic)

Arc's policy is a few lines of TypeScript (npm i @geostack/arc):

import { defineActions } from "@geostack/arc";

export const actions = defineActions({
  draft_reply: { policy: "allow" },                      // harmless, let it run
  issue_refund: {
    policy: "ask",                                       // pause for a human
    limits: { maxAmount: 200, cumulativePerDay: 1_000 }, // enforced, not advisory
  },
  delete_customer: { policy: "block" },                  // never, signed or not
});
// anything not declared is denied by default

Pick NeMo Guardrails, not Arc, if

Your system is conversational and read-only — a support bot, a RAG assistant, a docs Q&A — where the worst failure is bad text: off-topic answers, leaked PII in a response, a jailbroken persona. Nothing moves money, sends to customers, or mutates production. Rails on the conversation are the right and sufficient tool, and they're free and self-hosted.

You need Arc alongside it the moment that bot grows hands — refunds, cancellations, deletes, infra changes. A Colang flow can shape what the model says; it cannot queue a $4,000 refund for a human, enforce a daily cumulative cap atomically, or prove to an auditor that what executed is what was approved. One enterprise client reportedly ran up ~$500M on Claude in a single month with zero usage caps (an AI consultant's account reported by Axios — unconfirmed, company unnamed). Rails on the dialog would not have touched that.

Arc pricing: free Developer tier, Team $99/mo, Business $499/mo, Enterprise custom. NeMo Guardrails the toolkit is free; for NIM microservice licensing, check NVIDIA's pricing.