Guardrails: Check prompts before they reach the model.

When a guardrail blocks a request before the model call, nRouter returns HTTP 400 (guardrail_blocked), places no credit hold, and charges $0.00. When a post-call rule blocks a model response, the violating output is withheld from the client, and consumed tokens settle at the served model’s published price with a 0% platform fee.

Built-in baseline protections cannot be switched off or downgraded through organization, team, key, or request settings. Customer rules remain configurable in the dashboard, and you can append up to eight extra rules on a single call using nrouter_guardrails. The nrouter_guardrails field is add-only, stripped before the provider call, and fails closed with HTTP 400 (guardrail_not_found) if an unknown or foreign rule is supplied.

The personal-data scanner covers 21 supported identifier types in formatted text: email addresses, phone numbers, credit card numbers, US Social Security numbers, IPv4 and IPv6 addresses, MAC addresses, IBAN and SWIFT/BIC codes, passport, driver license, national ID, and tax ID numbers, bank account and routing identifiers, medical record and health plan numbers, and biometric, vehicle, device, and employee identifiers. It does not detect free-text personal names, street addresses, spoken birth dates, or locations described in prose. Input redaction requires an enabled redaction rule; output personal-data redaction runs as part of the platform baseline.

Scope resolution chooses the most specific assignment per rule—key over team over organization over organization default—and runs that rule only if the winning assignment enables it. It does not run every inherited assignment for the same rule. Setting a customer rule to warn or log never turns built-in baseline enforcement into observation.

Pre-call checks run before the model call. During streaming responses, the gateway does not buffer the entire completion before forwarding tokens, so earlier chunks can reach the client before a later chunk triggers a post-call block. When a post-call violation is detected mid-stream, the gateway drops the violating chunk, sends an SSE event: error frame with type "guardrail_blocked", and terminates the stream.

Text guardrails do not inspect binary image, document, or file attachments or pre-tokenized inputs. Enforcing rules default to allow_and_record—scanning the text and returning x-nr-guardrails: partial—or can be configured per rule to refuse uninspectable content with HTTP 400. On /v1/audio/*, binary audio uploads are checked on the generated transcript after the call. Very large prompt-injection inputs are sampled across bounded windows rather than scanned across every byte, so x-nr-guardrails: pass does not certify that every byte or attachment was inspected.

On nrouter/auto, the built-in platform baseline runs its deterministic checks and output protections, while any model-scored checks you configure on your organization, team, or key still apply. Checks execute within a 5,000 ms scoring budget; if a scoring service is unavailable, the gateway follows the rule’s failure policy and reports x-nr-guardrails: unavailable when a check could not complete.