> This page is for Gateway.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.merge.dev/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.merge.dev/_mcp/server.

# Guardrails

> Set sparse per-customer prompt injection and DLP overrides on top of your organization's policy, and learn when a relaxed override actually applies.

A customer can override your organization's [prompt injection protection](/merge-gateway/security/prompt-injection-protection) and [data loss prevention](/merge-gateway/security/data-loss-prevention) settings. Use it when one tenant needs a different posture, such as blocking for regulated data while others stay in alert mode. Overrides are sparse: the customer inherits every omitted or `null` field from your organization, including later changes.

These endpoints take your organization-level key; customer API keys get `403` `customer_scoped_key_forbidden`.

## How an override reaches a request

| Request identifies the customer with                                          | What the override can do                        |
| ----------------------------------------------------------------------------- | ----------------------------------------------- |
| A [customer API key](/merge-gateway/embedded-routing-stack/customer-api-keys) | Tighten or loosen, as written                   |
| The `customer` field or `X-Merge-Customer` header                             | Tighten only. Anything that loosens is ignored. |

Any organization-level key can name any customer, so this stops a caller from picking the weakest policy. A tenant that needs a looser policy must call with its own customer API key.

> **GET shows loosened values that may not apply**
>
> `GET` reports the effective policy as if the customer used its own API key. For a customer only ever named with the `customer` field, a loosened value shows here while requests keep your organization's policy.

`pi_allowlist_patterns` add to your organization's list, never replacing it, and since an exception always loosens, they apply only to customer API key traffic. An override can't turn on protection your organization hasn't configured.

## Prompt injection

`PUT /v1/customers/{customer_id}/pi-settings` replaces the customer's whole PI override.

**`cURL`**

```bash title="cURL"
curl -X PUT https://api-gateway.merge.dev/v1/customers/{customer_id}/pi-settings \
  -H "Authorization: Bearer $MERGE_GATEWAY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "pi_mode": "block", "pi_block_threshold": 0.7 }'
```

The response returns both layers, so you never merge them:

```json
{
  "override": { "pi_mode": "block", "pi_block_threshold": 0.7 },
  "effective": { "pi_mode": "block", "pi_block_threshold": 0.7, "pi_indirect_mode": "alert" },
  "inherited_fields": ["pi_indirect_mode", "pi_output_action", "pi_fail_closed"]
}
```

| Field                                                    | Description                                                                                                                                 |
| -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| `pi_mode`                                                | Direct injection: `off`, `alert`, or `block`                                                                                                |
| `pi_block_threshold`                                     | Direct injection block threshold, 0 to 1. Must be at least your organization's `pi_pass_threshold` (0.30 by default).                       |
| `pi_indirect_mode`                                       | Indirect injection: `off`, `alert`, or `block`                                                                                              |
| `pi_tier2a_block_threshold`, `pi_tier2b_block_threshold` | Indirect injection heuristic and embedding thresholds, 0 to 1                                                                               |
| `pi_output_action`                                       | `redact` redacts flagged response content. Every other accepted value (`observe`, `route`, `block`, `escalate`) only records the detection. |
| `pi_fail_closed`                                         | Reject requests when detection is unavailable. Your organization's default is to fail open.                                                 |
| `pi_allowlist_patterns`                                  | Up to 20 regexes of up to 200 characters each. Matching segments skip scanning.                                                             |

Organization-only fields (`pi_pass_threshold`, `pi_input_action`, `pi_safer_vendor_route`, `pi_log_full_text_on_block`) return `422`.

## Data loss prevention

`PUT /v1/customers/{customer_id}/dlp-settings` replaces the customer's whole DLP override, keyed by entity type, each with optional `enabled` and `action` (`log`, `redact`, or `block`).

**`cURL`**

```bash title="cURL"
curl -X PUT https://api-gateway.merge.dev/v1/customers/{customer_id}/dlp-settings \
  -H "Authorization: Bearer $MERGE_GATEWAY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "override": { "US_SSN": { "action": "block" }, "EMAIL_ADDRESS": { "enabled": false } } }'
```

An entity that isn't a seeded or custom rule in your organization returns `422`. The response has the same shape as the [project DLP response](/merge-gateway/automation/projects-api/guardrails#data-loss-prevention).

## Read, clear, and propagation

`GET` on either path returns the override and the effective policy. `DELETE`, or a `PUT` with an empty body (`{}` for PI, `{"override": {}}` for DLP), clears the override; `null` clears one field.

Changes reach requests within about 60 seconds. A change Gateway can't store returns `502` and the previous policy stays in force. You can also edit a customer's guardrails on its **Configuration** tab.

## Next steps

#### [Prompt injection protection](/merge-gateway/security/prompt-injection-protection)

The organization policy these overrides layer on

#### [Data loss prevention](/merge-gateway/security/data-loss-prevention)

Entity types and organization DLP rules

#### [Project guardrails](/merge-gateway/automation/projects-api/guardrails)

The equivalent overrides for your own projects