Skip to content
Guardrails

The layer that looks inside the prompt

To make good decisions, policy has to know what is in the prompt. The guardrail pipeline scans a request the moment it enters the gateway; the signals it produces become policy input.

  • Turkish PII patterns (national ID, IBAN, card)
  • Prompt injection and jailbreak detection
  • Secrets and keys pasted into prompts
Request a demoCompare plans

~5msp99 PII scan

It produces signals; it doesn't decide

The guardrail pipeline never refuses a request — it reports what it found. Fields like signals.pii.detected, signals.pii.types and signals.injection.score are written into the input policy will see. What to do about them is policy's call, and that separation matters: the same signal means refusal in one organization and merely masking plus a route to a local model in another.

What it does

PII detection

National IDs, card numbers, IBANs, phone numbers, emails and financial-data patterns. Turkish IDs are checksum-verified, so not every eleven-digit number counts as PII.

Injection detection

Instruction-override, role-switching and jailbreak patterns. ML-based, ~10ms p99.

Secret detection

API keys, tokens and passwords pasted into a prompt. Provider key prefixes are recognised.

External connectors

API-based guardrail services such as Lakera or Microsoft Content Safety can join the pipeline.

Custom rules

Regex and keyword patterns the organization defines itself — your customer-number format, your internal project code names.

Asynchronous execution

Scanners that don't need to block can run in the background, keeping pipeline latency off the critical path.

Interactive · Guardrails

The layer that reads the prompt before policy does

Whatever you type below is scanned in your browser, with the same kind of patterns the gateway uses. The resulting signals become policy input — which is what makes a rule like "if there's a national ID, pin it to Turkey" possible at all.

Prompt

155
Sample payloads

What was detected

Hi, can you raise the credit limit for the customer with national ID 10000000146 to 25,000? Contact: ayse.yilmaz@examplebank.com, card 4111 1111 1111 1111.

  • Turkish national ID1
  • Card number1
  • Email1
Signals handed to policyinput.signals
{
  "pii": { "detected": true, "types": ["tckn", "email", "creditCard"], "available": true },
  "secrets": { "detected": false, "available": true },
  "injection": { "detected": false, "score": 0.00, "available": true }
}

The masked version

What reaches the provider once a redactTypes: detected obligation applies

Hi, can you raise the credit limit for the customer with national ID [TCKN_TR] to 25,000? Contact: [EMAIL], card [CARD].

Scanning happens entirely in your browser; nothing you type is sent anywhere.

The demo on this page runs in your browser; no real gateway call is made.

How it works

Scanning, masking and routing are three separate steps. Getting the order wrong means scanning the wrong string.

  1. 1

    The prompt is hydrated

    If the request arrived with a prompt_id and variables, the template is filled first. PII arrives inside those variables, so any design that scans before substitution scans the wrong string.

    hydration → scan
  2. 2

    The pipeline runs

    PII, injection, secret and connector scanners produce their signals.

    signals.*
  3. 3

    Policy consumes the signal

    A rule like "if there's a national ID, pin it to a local model, mask the prompt, switch the cache off" fires here.

    input.signals
  4. 4

    The obligation is enforced

    When a redactTypes: detected obligation applies, the text that reaches the provider is the masked one, and the audit trail records what was masked.

    redact · auditTags

Technical summary

PII scanner
Regex + pattern matching + checksum validation · ~5ms p99
Injection scanner
ML-based · ~10ms p99
Secret scanner
Provider key prefixes, high-entropy strings
Connectors
External API-based guardrail services
Output
signals.{pii,injection,secrets} written into policy input
Turkish patterns
National ID · IBAN (TR) · mobile · tax number
Masking
Triggered by a redactTypes: detected obligation
Execution mode
Synchronous (blocking) or asynchronous

Why there is an available field

A signal doesn't only say detected: true/false; it also says available: true/false. If a scanner could not run, policy needs to know — "no PII was detected" and "PII could not be scanned for" are not the same statement. Whoever writes the compliance rule can choose to be conservative in the second case; a rule that mistakes a missing signal for a clean prompt is the most expensive error an audit can find.

The rest of the control plane

This capability works on its own, but most of its value comes from sharing one decision contract with the others.

Policy EngineTake the decision out of the code
Routing & FailoverBind traffic to a decision, not to a model
Prompt ManagementTake the prompt out of the code
ObservabilityMake the decision explainable

See it on your own traffic

In a 30-minute session we run your own rule set in shadow mode.

Request a demoCompare plans