Guardrails Preview
Guardrail rules are single checks on text going into and coming out of a model. Guardrail profiles bundle checks for a provider or agent.
- Tell guardrail rules and guardrail profiles apart
- Choose an action for a finding
- Roll a rule out in monitor mode first
Guardrails are one family with two pages, side by side under AI Gateway and as the Rules and Profiles tabs on each other's page.
- Guardrail rules (
/guardrail-policies, the/api/guardrailsAPI): one rule is one check at the model boundary, applied by agent. This page describes rules. - Guardrail profiles (
/guardrails, the/api/guardrail-profilesAPI): a profile is a named bundle of checks attached to LLM providers and agents, with its own templates, a Start disabled or Enforce now rollout and a Run test panel. Profiles need the admin.write permission. Evaluating a profile with an external provider is marked coming soon.
Building blocks
| Object | What it is | API |
|---|---|---|
| Guardrail rule | One check: what to detect, where and what to do | /api/guardrails/{name} |
| Guardrail set | A named group of rules, scoped to tags, models, providers or tenants | /api/guardrail-sets/{name} |
| Binding | Holds one agent to rules you pick: Inherit adds them to the rules that already cover it, Replace uses only them | /api/guardrail-bindings/{agent} |
| Guardrail profile | A named bundle of checks (content, words, patterns, prompt attacks, topics, PII, grounding) attached to LLM providers and agents | /api/guardrail-profiles/{id} |
What a guardrail rule can check
Each rule is one kind of check: Redact PII, Block prompt injection, Prompt attack, Deny topics, Custom patterns, Word filter, Truncate input, URL safety, Recipient domains, Context leak, Output format (a JSON schema or a pattern), Grounding, Content safety or an External detector.
Actions
Which actions are offered depends on the kind of check.
| Action | Effect |
|---|---|
| Block | Refuse the call |
| Mask | Replace the match with a fixed mark |
| Tokenise | For PII: replace the match with a token instead of a mark |
| Flag for a person | For deny topics: let it through and put it on the record for review |
| Escalate to a person | File it to a person as a ticket. For deny topics the text is refused. For content safety, incoming text goes on, flagged, and a reply is withheld |
| Detect only | For content safety: record a finding, change nothing |
| Don't check | For deny topics: skip this topic on that side |
Direction and scope
- Direction: Input, Output, Both, Tool call or Tool result.
- Agents: blank for all agents, or a list. A guardrail set can narrow further by tag, model, provider or tenant.
- A guardrail profile is attached the other way round: pick the LLM providers and agents on the profile itself.
Rollout
A new rule can start in Monitor first (recommended). Findings are recorded but nothing is blocked. Review its matches (mark each False positive or Correct, and POST /api/guardrails/{name}/monitor records the label), then choose Enforce now on its row (PATCH /api/guardrails/{name} with "mode": "enforce"). GET /api/guardrails/{name}/used-by shows where a rule is in effect before you change it.
A new profile starts disabled unless you choose Enforce now when creating it. Enable it from its row or its page once the checks look right.