Guardrails

Inspect or rewrite prompts and responses inline at the gateway with TrustGuard, OpenAI Moderation, Azure Content Safety, AWS Bedrock, or Regex Replace policies.

TrustGate guardrail policies inspect request or response content and can block or transform matching content. Add one or more guardrails to a policy, either globally or per consumer.

Configure in the console

1. Open Policies → Catalog (guardrails are listed first).
2. Pick TrustGuard, OpenAI Moderation, Azure Content Safety, Bedrock Guardrail, or Regex Replace.
3. For TrustGuard, select or create an Agent Runtime collector when prompted; connection settings are platform-managed on SaaS.
4. Set direction (request / response), mode (Enforce / Observe), and scope.
5. Save. Test blocking behavior in the Playground and inspect Security flags under Activity.

Policy (slug)	Provider	Stages
trustguard	NeuralTrust TrustGuard	pre_request · pre_response
openai_moderation	OpenAI Moderations API	pre_request · pre_response
azure_content_safety	Azure AI Content Safety	pre_request
bedrock_guardrail	AWS Bedrock Guardrails	pre_request · pre_response
regex_replace	Built-in RE2 rewrite	pre_request or pre_response

Streaming responses cannot be inspected or blocked in realtime by these policies. Apply guardrails on the request leg (or to non-streaming responses) for enforcement.

---

TrustGuard

The trustguard policy evaluates request or response content using configured TrustGuard detectors for jailbreaks, PII, toxicity, and tool abuse. It applies the action returned by TrustGuard.

Setting	Type	Default	Notes
collector_id	string	None	TrustGuard collector UUID bound to this policy. Required.
direction	enum	request_response	request, response, or request_response.
on_error	enum	fail_open	fail_open or fail_closed for transport and service errors. Authentication (401/403), rate-limit (429), and entitlement (503) responses always block.

Transport failures, timeouts, and ordinary service errors follow on_error, which defaults to fail_open. Authentication, rate-limit, and entitlement responses always block. A missing base URL or gateway credential fails open. Connection settings come from the deployment’s TRUSTGUARD_* environment. See the TrustGate integration.

{ "slug": "trustguard", "settings": { "collector_id": "<uuid>", "direction": "request_response", "on_error": "fail_open" } }

OpenAI Moderation

The openai_moderation policy screens text with the OpenAI Moderations API and blocks content that crosses configured category thresholds. Text-only.

Setting	Type	Default	Notes
api_key	string	None	OpenAI credential (Bearer). Required.
model	string	omni-moderation-latest	Moderations model.
stages	enum[]	None	Legs to inspect: pre_request, pre_response.
categories	string[]	None	Categories to evaluate (empty = all returned).
thresholds	map	None	Per-category score threshold 0..1; a score ≥ threshold blocks.
block_on_flagged	bool	false	Block anything OpenAI marks flagged, even without a threshold.
action.message	string	None	Block message returned to the caller.

In enforce mode this policy fails closed (HTTP 502) on any moderator error; observe mode records and passes through.

{
  "slug": "openai_moderation",
  "settings": {
    "api_key": "sk-…",
    "stages": ["pre_request"],
    "thresholds": { "harassment": 0.7, "hate": 0.5 },
    "block_on_flagged": true
  }
}

Azure Content Safety

The azure_content_safety policy screens request content with the Azure AI Content Safety Analyze Text API and blocks categories whose severity meets the configured threshold.

Setting	Type	Default	Notes
api_key	string	None	Azure subscription key (Ocp-Apim-Subscription-Key). Required.
endpoint	string	None	Absolute Analyze Text endpoint URL. Required.
output_type	enum	FourSeverityLevels	FourSeverityLevels (0/2/4/6) or EightSeverityLevels (0–7).
categories	enum[]	all	Hate, Violence, SelfHarm, Sexual.
category_severity	map	None	Per-category severity threshold; only listed categories are enforced. Required.
message	string	None	Optional block message.

Fails closed in enforce mode.

{
  "slug": "azure_content_safety",
  "settings": {
    "api_key": "…",
    "endpoint": "https://<resource>.cognitiveservices.azure.com/contentsafety/text:analyze?api-version=2024-09-01",
    "category_severity": { "Hate": 4, "Violence": 4 }
  }
}

AWS Bedrock guardrail

The bedrock_guardrail policy applies an AWS Bedrock guardrail to request prompts and/or responses. It inspects the topic, content, word, sensitive-information (PII), and contextual-grounding policy families configured on the guardrail, and blocks with a 403 or anonymizes PII in place. Streaming responses pass through untouched.

Setting	Type	Default	Notes
guardrail_id	string	None	AWS Bedrock guardrail identifier. Required.
version	string	DRAFT	Guardrail version.
pii_action	enum	block	On sensitive-info match: block or anonymize.
message	string	None	Optional block message.
credentials	object	None	AWS auth (region, static keys or use_role + role_arn). Required.

{
  "slug": "bedrock_guardrail",
  "settings": {
    "guardrail_id": "abcd1234",
    "version": "DRAFT",
    "pii_action": "anonymize",
    "credentials": { "aws_region": "us-east-1", "use_role": true, "role_arn": "arn:aws:iam::…:role/…" }
  }
}

Regex Replace

The regex_replace policy (Regex Replace in the catalog) rewrites the request prompt or the LLM response with ordered RE2 regular expressions. Rules chain: each rule sees the previous rule’s output. A single policy instance targets one leg (request or response), not both. Streaming responses pass through untouched.

Configure in the console

1. Policies → Catalog → Regex Replace.
2. Choose the target leg (request or response) and add ordered rewrite rules (pattern, replacement, optional case-insensitive / multiline).
3. Set mode and scope, then save.

Setting	Type	Default	Notes
target	enum	None	request or response. Required.
rules	array	None	Ordered [{ pattern, replacement, case_insensitive, multiline }]. Required.
rules[].pattern	string	None	RE2 pattern (no backreferences or lookaround). Required.
rules[].replacement	string	None	Replacement text; $1 / ${name} for capture groups. Empty removes the match.
rules[].case_insensitive	bool	false	Match without regard to letter case ((?i)).
rules[].multiline	bool	false	^ and $ match at line boundaries ((?m)).

{
  "slug": "regex_replace",
  "settings": {
    "target": "request",
    "rules": [
      { "pattern": "\\b(ssn|social)\\b", "replacement": "[REDACTED]", "case_insensitive": true }
    ]
  }
}

---

Choose a guardrail

• trustguard: evaluate content with TrustGuard detectors and correlate findings with Telemetry Alerts.
• openai_moderation / azure_content_safety: apply the corresponding provider’s content-moderation service.
• bedrock_guardrail: reuse guardrails defined in AWS Bedrock, including in-place PII anonymization.
• regex_replace: use deterministic string replacement for pattern-based redaction or rewriting without an external moderator.

A policy chain can contain multiple guardrails. For example, apply TrustGuard to the request and a Bedrock guardrail for PII anonymization to the response.