Configure a guardrail

Guardrails inspect traffic as it passes through the gateway. They run as a pipeline: each configured guardrail sees the request before it reaches the provider, and the response before it reaches the caller.

Steps

1. Open /guardrails. Each row is one configured guardrail with its type and enabled state.

2. Click Create Guardrail.

Create Guardrail

3. Fill the form.

Field	Notes
Name	Free text, shown in logs and decisions.
Guardrail Type	The detector to run — see the table below.
Config (JSON)	Detector-specific tuning, e.g. `{"threshold": 0.8}`.
AOCore Params (JSON)	Enforcement behaviour, e.g. `{"mode":"block"}`.

4. Click Create. The guardrail is live immediately — there is no separate publish step. It appears in /guardrails with a toggle you can use to disable it without deleting its configuration.

Available types

Type	Detects
`pii_detection`	Emails, SSNs, phone numbers, addresses and similar identifiers
`content_filter` / `content_moderation`	Policy-violating content
`jailbreak_detection`	Attempts to subvert system instructions
`prompt_injection`	Injected instructions in user or retrieved content
`secret_detection`	API keys, tokens and credentials in prompts
`regex_filter`	Custom patterns you supply

Reversible PII redaction

pii_detection supports two enforcement modes, and the difference matters.

{"mode":"block"} rejects the request outright. Safe, and often too blunt — a support ticket containing a customer email becomes unanswerable.

{"mode":"mask"} tokenizes instead. PII is replaced with typed placeholders ([EMAIL_1], [SSN_1]) before the prompt leaves the gateway, and the original values are restored in the response if the model echoes a placeholder back. The model works on masked text; the caller sees real values.

Two properties are worth stating plainly because they are the reason to prefer this over blocking:

Nothing raw is persisted. In mask mode guardrail_logs.original_content is empty. The vault holding the real values is in-memory and per-request.
It survives streaming. A placeholder split across two SSE chunks is reassembled, so restoration works mid-stream without buffering the whole response.

Masking applies to embeddings too: the vector is computed over the masked text.

Ordering and cost

Guardrails run in the order listed. Put cheap deterministic detectors (regex_filter, secret_detection) ahead of model-backed ones (content_moderation, jailbreak_detection) so an obvious violation is caught before you pay for an inference call.

Verifying it works

Send a request that should trip the rule, then open /guardrail-logs. A guardrail that never appears in the logs is not running — check that it is enabled and that its type name is spelled exactly as in the table above. An unrecognised type is stored but never matches.

API equivalent

curl -X POST https://<gateway>/guardrails \
  -H "X-Aoedge-Identity-Context: <attested context>" \
  -H "Content-Type: application/json" \
  -d '{
        "name": "customer-pii",
        "guardrail_type": "pii_detection",
        "config": {"threshold": 0.8},
        "aocore_params": {"mode": "mask"}
      }'