Guardrails

PII redaction, prompt-injection detection, geo rules, and spend limits — enforced before any provider call.

Guardrails are workspace-level policies enforced at the gateway, before your request ever reaches an upstream provider.

• PII redaction — detect and mask emails, phone numbers, and custom patterns.
• Prompt injection — block or flag suspicious system/user content.
• Geo restrictions — allow or deny requests by country code.
• Spend limits — daily workspace and per-key caps, enforced with 402 insufficient_balance.
• Model allowlist — reject models that aren't on the key's or workspace's list.

Turn On a Guardrail

1. Go to Guardrails in the dashboard.
2. Select the Content Filters, Geographic Rules, or Rate Limits tab.
3. Toggle a rule on, and choose its action: redact, warn, or block.
4. Select Save changes.

A blocked request returns a 403 with the specific rule that fired:

HTTP 403
{
"error": {
  "code": "policy_violation",
  "message": "Request blocked by guardrail",
  "blocked_by": "geo_block",
  "action": "reject"
}
}