Guardrail Limits

Google Model Armor Pricing and Limits in October 2026: Free Tier, Token Caps, and Filter Versions

Model Armor is Google Cloud's runtime screen for prompt injection, jailbreaks, sensitive data and malicious URLs. Its limits have changed several times since launch, and the edge cases (an over-limit skip that looks like a pass, a three-word floor, a version retirement in December) are where deployments fail. Here are the October 2026 numbers from Google's own pages.

By Austa · Published October 10, 2026 · Facts checked against vendor sources as of October 2026 · ~9 min read

Model Armor is Google Cloud's runtime screen for prompts and responses. It covers prompt injection and jailbreak detection, responsible AI filters, Sensitive Data Protection and malicious URL detection. It launched on February 3, 2025 and has changed nearly every month since, so older blog posts quote limits that no longer apply. This page uses Google's product page, quotas page and release notes as of October 2026.

Model Armor pricing

Google counts the total tokens in the prompts and responses you screen, for both billing and filter limits, and treats a token as roughly four characters. Screening 1 million prompts of 500 tokens each is 500 million tokens. After the 2 million free tokens, that comes to about $49.80 a month. Screen the responses too and you pay for those tokens as well. Data skipped for exceeding a limit isn't charged.

Per token, this is the cheapest of the three hyperscaler guardrails. For comparison, Azure Prompt Shields bills per 1,000-character text record and Bedrock Guardrails bills per 1,000-character text unit.

Quotas and system limits

How the injection filter's window grew

The prompt injection and jailbreak window has grown more than 30-fold in 15 months. If a design review or a pentest report quotes a smaller number, it's out of date:

On retirement dates, Google's September 2 notice gave November 29, 2026 for v1 and v2. The September 18 notice replaced it with December 17, 2026, and added exceptions: in asia-northeast3 (Seoul), v1 stays the Stable version, and in australia-southeast2 (Melbourne), v3 became Stable on September 25, 2026. Templates that use the Stable alias upgrade automatically. Templates pinned to an explicit version don't.

What the limits mean for security

EXECUTION_SKIPPED is a fail-open signal

When an input goes over a filter's token limit, Model Armor doesn't partly scan it. The filter returns EXECUTION_SKIPPED with the message "Detection skipped as token limit exceeded," and the overall result can still look clean. Any integration code that reads only filterMatchState and treats "no match" as "safe" will let oversized input through unscanned. That's the first thing to look for in a code review. Treat a skip as a block, or split the input with overlapping windows and scan each piece.

The three-word floor

Inputs under three words are never flagged as injection because, in Google's words, they "lack enough information to constitute an attack." Now combine that with Google's best-practice guidance for chat apps: call sanitizeUserPrompt for every new user message, with userPromptData holding only the latest message, and don't concatenate the chat history. Each message is screened on its own, by design. An attacker who spreads instructions over several short turns, each under three words or harmless on its own, isn't covered by Model Armor's injection filter as documented. Our write-up of the 12-message injection pattern shows why per-turn screening misses this. If your threat model includes it, add your own control on top, such as a separate check over a window of recent turns or limits on what the agent may do after a run of short messages, and measure the false positives before you enforce it.

Inspect only vs inspect and block

Templates and floor settings use one of two enforcement types. Inspect only logs violations to Cloud Logging and lets the request continue. Inspect and block stops it. Google suggests inspect only for tuning new policies, which makes sense. The usual finding is a deployment that never left that mode. If you call the API directly (sanitizeUserPrompt and sanitizeModelResponse), Model Armor only returns a verdict, and your code decides whether to act on it.

Confidence levels

Prompt injection and jailbreak detection supports three thresholds: HIGH, MEDIUM_AND_ABOVE and LOW_AND_ABOVE. Google's documentation suggests starting at High or Medium, and also says Low and above may suit high-stakes categories such as injection, where missing an attack costs more than a false alarm. Choose based on what the agent can do. A read-only FAQ bot and an agent that can send email shouldn't share a threshold.

Languages and system prompts

The injection and responsible AI filters are tested in Chinese (Mandarin), English, French, German, Italian, Japanese, Korean, Portuguese and Spanish. Other languages need enableMultiLanguageDetection, set per request or once at the template level. Google also says not to send the system prompt in userPromptData, because Model Armor looks for threats only in user-provided input. Defending the system prompt is your job, through prompt design and output checks.

Where Model Armor runs without code

Google lists integrations with Agent Gateway (GA June 24, 2026), Apigee, Gemini Enterprise, Google and Google Cloud MCP servers (GA April 22, 2026), Google Cloud networking services, Agent Platform and LangChain. Floor settings set project-wide minimum requirements that every template must meet, and they can apply to Google-managed MCP servers. This is the strongest feature for agent security. Tool traffic through a governed MCP server can be screened without each team remembering to call an API, which is the gap we describe in auditing MCP servers.

Test plan

1. Send a payload just over 65,536 tokens and confirm the integration blocks or splits it rather than passing it through on EXECUTION_SKIPPED.
2. Split a known payload into turns of two words each and check whether anything other than Model Armor catches it, since Google recommends screening only the latest message.
3. Check the enforcement type on every template and floor setting. Note any still on inspect only.
4. Check the filter version on every template. Outside asia-northeast3, any pinned to v1 or v2 must move to v3 or the Stable alias before December 17, 2026.
5. Translate detected payloads into a language outside the tested nine with multi-language detection off.
6. Hide instructions in a 4 MB+ document, or beyond the 256th URL, and check what happens.

FAQ

Is Model Armor free?

Model Armor has a free tier of 2 million tokens per month. Above that, standalone pay-as-you-go usage costs $0.10 per additional 1 million tokens as of October 2026. Security Command Center Premium and Enterprise subscriptions include 3 billion tokens per month, and Model Armor is included with Gemini Enterprise subscriptions.

What is the Model Armor token limit for prompt injection detection?

Since August 25, 2026 the prompt injection and jailbreak detection filter supports up to 65,536 tokens (262,144 characters). The same limit applies to the responsible AI and CSAM filters. Sensitive Data Protection supports 130,000 tokens. Earlier limits were 2,000 tokens from May 2025 and 10,000 tokens from July 2025.

What happens when input exceeds the Model Armor token limit?

The filter returns EXECUTION_SKIPPED with the message that detection was skipped because the token limit was exceeded. Skipped data is not charged. Integrations should treat a skip as a failure, not as a clean result, or split input before screening.

Why does Model Armor not detect short prompt injections?

For prompt injection and jailbreak detection, inputs with fewer than three words return NO_MATCH_FOUND because Google considers them too short to constitute an attack. Google also recommends sending only the latest user message to sanitizeUserPrompt, without the chat history, so payloads split across several short turns need a separate control on your side.

What are the Model Armor API quotas?

The default API quota is 1,200 queries per minute per project, and ExternalProcessor requests are limited to 600 per minute per project. Files and images can be up to 4 MB, files under 69 bytes are rejected, and malicious URL detection scans only the first 256 URLs.

When do Model Armor filter versions v1 and v2 retire?

Per the September 18, 2026 release note, filter versions v1 and v2 moved to Legacy status and retire on December 17, 2026, with regional exceptions: in asia-northeast3 v1 remains the Stable version. Templates that use the Stable alias upgrade automatically; templates pinned to v1 or v2 must be migrated to v3 or the Stable alias.

Does Model Armor block requests or only report them?

Both are possible. Templates and floor settings use either Inspect only, which logs violations without stopping traffic, or Inspect and block, which stops non-compliant prompts and responses in integrated services. When you call sanitizeUserPrompt or sanitizeModelResponse directly, the API returns a verdict and your application decides what to do.

Related reading

• Llama Prompt Guard 2: 86M vs 22M: a self-hosted classifier with a 512-token window.
• Why prompt-injection filters keep failing: the paraphrase problem every classifier shares.
• The 2026 LLM security checklist: where a runtime screen fits among the other controls.

Google keeps the current numbers on the Model Armor quotas and system limits page.