Policy at the edge, not in your prompts.
PII redaction, prompt-injection blocking and content policies run at the router — before your traffic ever reaches a provider. Toggle globally, override per key.
PII redaction
Detect and mask names, emails, phone numbers, credit cards, national IDs before they leave your VPC. Re-inject on response for the caller only.
Prompt injection
Classifier scores every user turn and every tool result. Configurable action: block, warn, quarantine or route to a hardened model.
Content safety
OpenAI moderation, Llama Guard, or bring your own classifier. Per-category thresholds for violence, self-harm, sexual and hate.
Custom rule engine
Deny requests matching regex, allow-list domains in retrieved context, cap request size, require a system prompt prefix.
Zero-retention routing
Constrain routing to providers with signed zero-retention agreements. Requests to non-compliant peers are dropped.
Signal in every response
x-llmcloud-guardrail header reports every rule that fired, plus a policy_id you can trace in the audit log.
POST /v1/policies
{
"name": "prod-default",
"pii": { "action": "redact", "scope": ["email","phone","ssn"] },
"injection": { "action": "block", "threshold": 0.7 },
"content": {
"provider": "llama-guard-4",
"block": ["violence","self_harm"],
"warn": ["sexual"]
},
"routing": { "require_zero_retention": true }
}# Per-key (default policy for all requests on this key)
PATCH /v1/keys/agent-prod-router
{ "policy": "prod-default" }
# Per-request override
POST /v1/chat/completions
Headers:
X-LLMCloud-Policy: prod-default
Body:
{ "model": "auto:quality", "messages": [...] }How much latency do guardrails add?+
PII detection and injection classification run in parallel with routing — typical overhead is 6–14ms p50. Content classifiers run on the response and can be async for streaming.
Can I bring my own classifier?+
Yes. Point a rule at your webhook and the router calls it in-line with a configurable timeout and fallback action.
Do redactions round-trip?+
Optionally. The router maps tokens to synthetic placeholders on ingress, sends the redacted prompt upstream, then re-inflates on egress before returning to the caller. Nothing sensitive touches the upstream.