Model guardrails

Model guardrails screen the prompts employees send to models and the completions that come back. They run inline, so a redaction or block happens before the prompt reaches the vendor.

Tool calls are screened separately

Tool calls are screened by the Security Gateway. DLP entity rules are shared: changing a rule on the DLP tab also changes it for tool calls.

Data loss prevention entity rules

Action	Effect
Log	Record the match and pass the text through
Redact	Replace the match with a placeholder before it reaches the vendor
Block	Refuse the call

The seeded rules default to Redact for CREDIT_CARD, CRYPTO, IBAN_CODE, US_ITIN, and US_SSN, and Log for the rest: DATE_TIME, EMAIL_ADDRESS, IP_ADDRESS, NRP, LOCATION, PERSON, PHONE_NUMBER, MEDICAL_LICENSE, URL, US_BANK_NUMBER, US_DRIVER_LICENSE, and US_PASSPORT. See Standard Entity Rules for what each matches.

All seeded rules start Inactive. Nothing is detected until you enable a rule.

You can switch a rule off or change its action, but not its pattern. Custom regex rules live on Custom Regex Rules.

Prompt injection screening

Screening runs on two axes, each with its own mode.

Axis	What it looks for
Direct	Instructions in the prompt that try to override or leak the system prompt
Indirect	Instructions inside retrieved content, a tool result, or a pasted document

Mode	Behavior
`off`	No screening
`alert`	Emits alerts, never blocks
`block`	Enforces your configured action

Run in alert for a week, tune your allowlist, then switch to block.

Prompt injection actions

The prompt defaults to block and the response to redact.

Action	Effect
`observe`	Record only
`redact`	Replace the flagged span
`route`	Send the request to a safer vendor you nominate
`block`	Refuse the request
`escalate`	Block the request and mark the alert for human review

Prompt injection allowlist

The allowlist suppresses legitimate work that looks like injection. It takes up to 50 regex patterns of 200 characters each. A pattern broad enough to match ordinary prose is dropped.

Prompt injection errors

A blocked prompt returns 400. A blocked output returns the same shape with pi_output_blocked. Match on code.

{
  "error": {
    "type": "invalid_request_error",
    "message": "Request blocked: prompt injection detected.",
    "code": "pi_blocked"
  }
}

Where model guardrail detections land

Detections appear on the Security alerts tab. The Employee column shows a dash for now, so find the person through the request in LLM calls.

Task	Permission
Read the Security alerts tab	View security alerts
Read the DLP tab	View security rules
Change a rule’s action or switch	Manage security rules

Test a rule before enabling it with the Guardrail tester.