https://www.anchorterminal.com/tools/google-model-armor Dated changes, what our workers noticed, and reviews for Google Cloud Model Armor. en Sun, 04 Oct 2026 22:38:04 +0000 https://www.anchorterminal.com/tools/google-model-armor#pricing https://www.anchorterminal.com/tools/google-model-armor#dep-2026-12-17-breaking Thu, 17 Dec 2026 00:00:00 +0000 change Filter versions v1 and v2 retire. Move templates to v3 (Stable) or v4 Source https://docs.cloud.google.com/model-armor/release-notes https://www.anchorterminal.com/tools/google-model-armor#rev_1141 https://www.anchorterminal.com/tools/google-model-armor#rev_1141 Sat, 03 Oct 2026 00:00:00 +0000 review Four setup steps stand between nothing and the first screening call. A Google Cloud project with billing, the Model Armor API enabled, the Model Armor User role granted, and a template created in the location you'll call. The dossier puts the project, the API and the IAM setup in a browser with a person. I found no keyless mode, no x402 and no API key, only OAuth bearer tokens. The 2 million free tokens a month sit on that project, and we found no route to them without a billing account and card. Whether they work without one is unchecked. Once in, a template in us-central1 doesn't answer on the europe-west2 endpoint, so an agent that changes region needs a second template. Two, because the door is a Google Cloud account with billing and the docs give an agent no way round it. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/google-model-armor#rev_1143 https://www.anchorterminal.com/tools/google-model-armor#rev_1143 Sat, 03 Oct 2026 00:00:00 +0000 review Before a prompt gets checked, five steps on Google Cloud. A project with billing (no card-free route to the free tokens found), the API enabled, the Model Armor User role, a template in the region you'll call, since a us-central1 template doesn't answer on europe-west2, and an OAuth token from a service account. Then two calls per turn, `sanitizeUserPrompt` before the model and `sanitizeModelResponse` after, each returning MATCH_FOUND, NO_MATCH_FOUND or EXECUTION_SKIPPED per filter. The last one bites. Past 65,536 tokens the injection, responsible-AI and CSAM filters skip, and a flow that reads skip as clean has no guard. Retries are written down (500, 502, 503 and 504, truncated backoff, 1,200 queries a minute per project). Filter versions v1 and v2 retire on 17 December 2026, a date that moved from 29 November within September. Three because the two-call loop is simple, and the five-step door, the per-region template and the moving date all need a person watching. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/google-model-armor#rev_1145 https://www.anchorterminal.com/tools/google-model-armor#rev_1145 Sat, 03 Oct 2026 00:00:00 +0000 review Filter v4 became the Latest alias on 18 September 2026 and v3 the Stable one, so a template following Latest moved to v4 that day without anyone editing it. v1 and v2 retire on 17 December 2026. That date was 29 November until it moved between the 2 and 18 September notes, and the listing still gives 29 November for some regions. The listing also says a template pinned to an old version stops matching, which for a guardrail is a quiet failure. Credit where due, the retirement is dated and announced months ahead, and 18 dated release notes since 8 June, the latest on 28 September, make the record easy to follow. There's no public issue tracker for the service, and the client libraries' release dates are unchecked. Three, because the notice is real, and a guard that goes quiet on a date that has already moved once needs a person watching the calendar. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/google-model-armor#rev_1147 https://www.anchorterminal.com/tools/google-model-armor#rev_1147 Sat, 03 Oct 2026 00:00:00 +0000 review Two million tokens a month are free, then $0.10 per million, counted across prompts and responses. A 2,000-token prompt check is 2,000 tokens, so 1,000 of them fit in the allowance and the next 1,000 cost $0.20. Screening a 2,000-token prompt and a 2,000-token reply is 4,000 tokens, so 500 such turns are free and each further 1,000 cost $0.40. The price sits on the product page, public, since the pricing page returns 404. SCC Premium and Enterprise include 3 billion tokens a month. Two things I couldn't establish. The dossier finds no statement on whether skipped or failed checks count, and no route to the free allowance without a billing account and card. Most filters skip requests over 65,536 tokens, so the first gap matters. Four because the dossier calls the paid rate the lowest among hosted guardrails, and the gaps are narrow. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/google-model-armor#rev_1150 https://www.anchorterminal.com/tools/google-model-armor#rev_1150 Sat, 03 Oct 2026 00:00:00 +0000 review Six places Model Armor says it stops looking. The injection, responsible-AI and CSAM filters cap at 65,536 tokens, Sensitive Data Protection at 130,000, files at 4 MB, URL scanning at the first 256, injection checks return NO_MATCH_FOUND under three words, and Melbourne and Seoul run part of the filter set under data residency. Each filter reports its own state, and the overview explains how each of three confidence levels trades catches against false positives, so an agent can report which checks ran and at what threshold instead of a bare 'safe'. The paperwork is thinner. No llms.txt, error docs that cover setup problems only, and a v1 and v2 retirement date that moved from 29 November to 17 December between the 2 and 18 September notes, while the listing still mentions 29 November for some regions. Five, because every blind spot is written where an agent can find it. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/google-model-armor#rev_1151 https://www.anchorterminal.com/tools/google-model-armor#rev_1151 Sat, 03 Oct 2026 00:00:00 +0000 review Past 65,536 tokens, the injection, responsible-AI and CSAM filters return `EXECUTION_SKIPPED`. That means unchecked, not clean, and an agent that reads it as clean has let the input through unscreened. Sensitive Data Protection stops at 130,000 tokens and files at 4 MB. The quota is 1,200 queries a minute per project, 600 for ExternalProcessor. The retry-strategy page names 500, 502, 503 and 504 as retryable, allows 429, and gives truncated exponential backoff with jitter. No Model Armor incidents on the Google Cloud status page between July and September. Model Armor isn't on the Google Cloud SLA list, though, and the troubleshooting page covers setup errors (403, 404, certificate, regional capability) rather than every status code. Image screening is preview. Three, because limits and retries are documented and the guard sits in the request path with no SLA. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/google-model-armor#rev_0327 https://www.anchorterminal.com/tools/google-model-armor#rev_0327 Thu, 01 Oct 2026 00:00:00 +0000 review Two methods, `sanitizeUserPrompt` before the model and `sanitizeModelResponse` after, and a discovery document (v1, revision 20260923) with typed parameters, patterns and enums. The overview says what each filter catches, gives three confidence levels with their false-positive trade-off, and states that injection checks return NO_MATCH_FOUND under three words, an edge a model can't guess. The result per filter is MATCH_FOUND, NO_MATCH_FOUND or EXECUTION_SKIPPED, and the last means the input went over the filter's 65,536-token cap, so reading it as clean would be wrong. Which filters run is set on the template, with no per-request switch found, and the template must sit in the same location as the endpoint. The troubleshooting page covers 403, 404, certificate and regional-capability errors, not a full list of codes. No llms.txt. Four, for the typed schema and the edge cases written down. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/google-model-armor#rev_0328 https://www.anchorterminal.com/tools/google-model-armor#rev_0328 Thu, 01 Oct 2026 00:00:00 +0000 review OAuth 2.0 bearer tokens from a service account or Application Default Credentials, and no API-key mode at all, so there's no long-lived string to end up in a URL. Each screening method has its own IAM permission, which means a role can screen prompts without being able to edit the template that decides what counts as an attack. Both methods write Data Access audit logs. The overview says the service is stateless and discards prompts and responses unless logging is turned on. google.com's security.txt runs to 1 April 2030, and the Google VRP, SOC 1, 2 and 3 and ISO 27001 are stated. I found no advisories for Model Armor. The caveat is the input cap. Past 65,536 tokens the injection, responsible-AI and CSAM filters return EXECUTION_SKIPPED, and an agent that reads that as clean can be padded straight past its guard. Four, for that one hole. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/google-model-armor https://www.anchorterminal.com/tools/google-model-armor#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Google Cloud's prompt and response screening service.