Guardrails are live. Every chat completion, embedding, and image request now flows through a configurable safety pipeline before it reaches the provider — and the response flows back through it before it reaches the caller. No Enterprise paywall: every guardrail is available on every plan from day one.

What ships

Five guardrail providers, all in-path:

PII redaction — Microsoft Presidio. Detects and masks emails, phone numbers, SSNs, credit cards, names, addresses before the prompt leaves our infrastructure.
Prompt injection — heuristic detection across a weighted library of known injection patterns (instruction-override, role-switching, exfiltration). Blocks the request with a structured 400 when a pattern is matched.
Keyword / regex blocklists — bring your own term list or regex. Useful for compliance words, competitor names, internal codenames.
Custom guardrails — point at any HTTP endpoint that returns { allowed: bool, redacted_text?: string }. We call it pre- and post-call.
Response scanning — same providers run on the assistant message before the caller sees it.

Scope hierarchy

Guardrails are assigned in the dashboard at org, team, and key level. For each guardrail, the assignment at the narrowest scope that mentions it wins — a key-scoped assignment overrides a team-scoped one, which overrides the org-scoped one. There is no per-request parameter and no per-request opt-out: every guardrail covering the key you call with runs inline, pre-call before the request leaves for the provider and post-call before the response reaches you, streaming included.

# Nothing is passed in the body — the guardrails assigned to this key run on this call.
curl https://api.nrouter.ai/v1/chat/completions \
  -H "Authorization: Bearer sk-nrouter-..." \
  -H "Content-Type: application/json" \
  -d '{
    "model": "gemini-2.5-flash",
    "messages": [{"role": "user", "content": "Email me at jane@example.com"}]
  }'

When a guardrail blocks, the response is a 400 with error.code = guardrail_blocked — never a silent pass-through.

Configure guardrails at /{org}/guardrails. Audit hits at /{org}/observability.