Skip to navigation
Embedded Routing

Guardrails

Override prompt injection and DLP policy for one customer

A customer can override your organization’s prompt injection protection and data loss prevention settings. Use it when one tenant needs a different posture, such as blocking for regulated data while others stay in alert mode. Overrides are sparse: the customer inherits every omitted or null field from your organization, including later changes.

These endpoints take your organization-level key; customer API keys get 403 customer_scoped_key_forbidden.

How an override reaches a request

Request identifies the customer withWhat the override can do
A customer API keyTighten or loosen, as written
The customer field or X-Merge-Customer headerTighten only. Anything that loosens is ignored.

Any organization-level key can name any customer, so this stops a caller from picking the weakest policy. A tenant that needs a looser policy must call with its own customer API key.

GET shows loosened values that may not apply

GET reports the effective policy as if the customer used its own API key. For a customer only ever named with the customer field, a loosened value shows here while requests keep your organization’s policy.

pi_allowlist_patterns add to your organization’s list, never replacing it, and since an exception always loosens, they apply only to customer API key traffic. An override can’t turn on protection your organization hasn’t configured.

Prompt injection

PUT /v1/customers/{customer_id}/pi-settings replaces the customer’s whole PI override.

cURL
curl -X PUT https://api-gateway.merge.dev/v1/customers/{customer_id}/pi-settings \
  -H "Authorization: Bearer $MERGE_GATEWAY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "pi_mode": "block", "pi_block_threshold": 0.7 }'

The response returns both layers, so you never merge them:

{
  "override": { "pi_mode": "block", "pi_block_threshold": 0.7 },
  "effective": { "pi_mode": "block", "pi_block_threshold": 0.7, "pi_indirect_mode": "alert" },
  "inherited_fields": ["pi_indirect_mode", "pi_output_action", "pi_fail_closed"]
}
FieldDescription
pi_modeDirect injection: off, alert, or block
pi_block_thresholdDirect injection block threshold, 0 to 1. Must be at least your organization’s pi_pass_threshold (0.30 by default).
pi_indirect_modeIndirect injection: off, alert, or block
pi_tier2a_block_threshold, pi_tier2b_block_thresholdIndirect injection heuristic and embedding thresholds, 0 to 1
pi_output_actionredact redacts flagged response content. Every other accepted value (observe, route, block, escalate) only records the detection.
pi_fail_closedReject requests when detection is unavailable. Your organization’s default is to fail open.
pi_allowlist_patternsUp to 20 regexes of up to 200 characters each. Matching segments skip scanning.

Organization-only fields (pi_pass_threshold, pi_input_action, pi_safer_vendor_route, pi_log_full_text_on_block) return 422.

Data loss prevention

PUT /v1/customers/{customer_id}/dlp-settings replaces the customer’s whole DLP override, keyed by entity type, each with optional enabled and action (log, redact, or block).

cURL
curl -X PUT https://api-gateway.merge.dev/v1/customers/{customer_id}/dlp-settings \
  -H "Authorization: Bearer $MERGE_GATEWAY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "override": { "US_SSN": { "action": "block" }, "EMAIL_ADDRESS": { "enabled": false } } }'

An entity that isn’t a seeded or custom rule in your organization returns 422. The response has the same shape as the project DLP response.

Read, clear, and propagation

GET on either path returns the override and the effective policy. DELETE, or a PUT with an empty body ({} for PI, {"override": {}} for DLP), clears the override; null clears one field.

Changes reach requests within about 60 seconds. A change Gateway can’t store returns 502 and the previous policy stays in force. You can also edit a customer’s guardrails on its Configuration tab.

Next steps

Prompt injection protection

The organization policy these overrides layer on

Data loss prevention

Entity types and organization DLP rules

Project guardrails

The equivalent overrides for your own projects