Guardrails

Guardrails are optional processors configured per API key. They run inside the gateway’s trusted execution environment before a prompt is sent to an upstream model provider.

Available controls include:

• PII redaction.
• Secret and credential redaction.
• Custom regular-expression matching.
• Blocked-word filters.

Guardrails are off by default. Configure them for the relevant key in the GM dashboard.

Design guidance

• Use a dedicated key for each policy boundary.
• Test a policy with representative non-sensitive examples before production.
• Expect false positives and false negatives from pattern-based controls.
• Keep application authorization and validation in your own system.
• Treat guardrails as one layer, not as a complete data-loss-prevention program.

Changing a key’s policy affects future requests made with that key. Maintain a change record when guardrail settings form part of your compliance process.