# Guardrails

Guardrail rules are single checks on text going into and coming out of a model. Guardrail profiles bundle checks for a provider or agent.

> [!PREVIEW]
> Guardrails are one family with two pages, side by side under **AI Gateway** and as the **Rules** and **Profiles** tabs on each other's page.
>
> - **Guardrail rules** (`/guardrail-policies`, the `/api/guardrails` API): one rule is one check at the model boundary, applied by agent. This page describes rules.
> - **Guardrail profiles** (`/guardrails`, the `/api/guardrail-profiles` API): a profile is a named bundle of checks attached to LLM providers and agents, with its own templates, a **Start disabled** or **Enforce now** rollout and a **Run test** panel. Profiles need the admin.write permission. Evaluating a profile with an external provider is marked coming soon.

## Building blocks

| Object | What it is | API |
| --- | --- | --- |
| Guardrail rule | One check: what to detect, where and what to do | `/api/guardrails/{name}` |
| Guardrail set | A named group of rules, scoped to tags, models, providers or tenants | `/api/guardrail-sets/{name}` |
| Binding | Holds one agent to rules you pick: **Inherit** adds them to the rules that already cover it, **Replace** uses only them | `/api/guardrail-bindings/{agent}` |
| Guardrail profile | A named bundle of checks (content, words, patterns, prompt attacks, topics, PII, grounding) attached to LLM providers and agents | `/api/guardrail-profiles/{id}` |

## What a guardrail rule can check

Each rule is one kind of check: **Redact PII**, **Block prompt injection**, **Prompt attack**, **Deny topics**, **Custom patterns**, **Word filter**, **Truncate input**, **URL safety**, **Recipient domains**, **Context leak**, **Output format** (a JSON schema or a pattern), **Grounding**, **Content safety** or an **External detector**.

## Actions

Which actions are offered depends on the kind of check.

| Action | Effect |
| --- | --- |
| Block | Refuse the call |
| Mask | Replace the match with a fixed mark |
| Tokenise | For PII: replace the match with a token instead of a mark |
| Flag for a person | For deny topics: let it through and put it on the record for review |
| Escalate to a person | File it to a person as a ticket. For deny topics the text is refused. For content safety, incoming text goes on, flagged, and a reply is withheld |
| Detect only | For content safety: record a finding, change nothing |
| Don't check | For deny topics: skip this topic on that side |

## Direction and scope

- **Direction:** Input, Output, Both, Tool call or Tool result.
- **Agents:** blank for all agents, or a list. A guardrail set can narrow further by tag, model, provider or tenant.
- A guardrail profile is attached the other way round: pick the LLM providers and agents on the profile itself.

## Rollout

A new rule can start in **Monitor first (recommended)**. Findings are recorded but nothing is blocked. Review its matches (mark each **False positive** or **Correct**, and `POST /api/guardrails/{name}/monitor` records the label), then choose **Enforce now** on its row (`PATCH /api/guardrails/{name}` with `"mode": "enforce"`). `GET /api/guardrails/{name}/used-by` shows where a rule is in effect before you change it.

A new profile starts disabled unless you choose **Enforce now** when creating it. Enable it from its row or its page once the checks look right.

## Next steps

- [Create a guardrail rule](/docs/ai-gateway/create-guardrail)
- [Guardrail templates](/docs/ai-gateway/guardrail-templates)
- [Test a guardrail](/docs/ai-gateway/test-guardrail)