Veto vs Guardrails AI: Output Validation vs Runtime Authorization

What Guardrails AI does

Guardrails AI is a Python framework for validating LLM outputs. You define a "Guard" -- a collection of validators -- and pass model outputs through it. Validators check things like type correctness, regex patterns, toxicity scores, PII presence, hallucination detection, and more. The Guardrails Hub has 50+ community-contributed validators you can compose.

The original RAIL spec uses XML to define expected output structure alongside validators. Newer versions also support Pydantic models as schemas. In server mode, Guards run as an API service, so non-Python applications can validate through HTTP calls.

Where Guardrails AI excels: structured output parsing, re-asking the model when validation fails, composing multiple validators into a pipeline, and catching output-level issues before they reach users. If your agent generates customer-facing text and you need to guarantee it's free of PII, factually grounded, and correctly formatted, Guardrails AI handles that well.

Where it stops: Guardrails AI operates on text that has already been generated. It does not intercept tool calls. If your agent decides to call delete_all_records(table="customers"), Guardrails AI has no mechanism to block that execution. By the time the output validator runs, the action has already happened.

What Veto does differently

Veto operates at the tool-call layer. When an agent decides to call a function, Veto intercepts that call before execution and evaluates it against declarative YAML policies. The evaluation considers the tool name, the arguments, user context, and any custom attributes. The result is one of three outcomes: allow, deny, or escalate to human approval.

This happens in-process, locally, in under 5 milliseconds. No network round-trip for policy evaluation. The policies are YAML files that live in your repository -- version-controlled, reviewable, testable. The SDK is open source (Apache-2.0) with TypeScript and Python support and 13+ framework integrations including LangChain, LangGraph, OpenAI, Anthropic, Vercel AI SDK, CrewAI, PydanticAI, and MCP.

Veto does not validate output text. It does not check for PII in responses, score toxicity, or parse structured output. If you need those checks, Guardrails AI or a similar tool is the right choice. Veto's scope is strictly: should this agent be allowed to execute this action?

Feature comparison

The table makes it clear: these tools have almost zero overlap. Guardrails AI wins on output validation. Veto wins on action authorization. The only shared ground is that both are open source, both run in Python, and both offer a server mode.

Code comparison

The difference in what each tool intercepts is clearest in code. Guardrails AI validates the model's text response. Veto wraps the tools the agent can call.

from guardrails import Guard
from guardrails.hub import (
    DetectPII,
    ToxicLanguage,
    ValidJSON,
)

guard = Guard().use_many(
    DetectPII(pii_entities=["EMAIL", "SSN"]),
    ToxicLanguage(threshold=0.8),
    ValidJSON(),
)

# Validates the text the model produced
result = guard(
    model="gpt-5.4",
    messages=[{"role": "user", "content": prompt}],
)

# If validation fails, guard re-asks or
# returns a failed result.
# The model's tool calls already executed.

from veto import Veto

veto = Veto()

# Policy (veto.yaml):
# rules:
#   - tool: delete_records
#     action: escalate
#     reason: "Destructive action requires approval"
#   - tool: send_email
#     when:
#       recipients_count: "> 100"
#     action: deny

@veto.tool
def delete_records(table: str):
    db.execute(f"DELETE FROM {table}")

# Veto intercepts the call BEFORE execution.
# If policy says deny: function never runs.
# If policy says escalate: waits for human.

The left side checks what the model said. The right side controls what the agent does. Both are useful. Neither replaces the other.

When to choose each

The security layer model

A production agent system has multiple points where things can go wrong. Each requires a different kind of check:

Guardrails AI sits at Layer 2. Veto sits at Layer 3. Neither covers the other's layer. A complete agent security stack addresses all three.

Technical differences

Frequently asked questions