v0.1 — Guardrails: pre/post-call enforcement

Guardrails are live. Every chat completion, embedding, and image request now flows through a configurable safety pipeline before it reaches the provider — and the response flows back through it before it reaches the caller. No Enterprise paywall: every guardrail is available on every plan from day one.

What ships

Guardrails, all in-path:

• PII redaction — the gateway's built-in scanner detects and masks personal data such as emails, phone numbers, SSNs and card numbers before the prompt leaves our infrastructure. Personal names and street addresses are not detected.
• Prompt injection — deterministic detection of known injection patterns (instruction-override, role-switching, exfiltration). Blocks the request with a structured 400 when a pattern is matched.
• Keyword blocklists — bring your own term list. Useful for compliance words, competitor names, internal codenames.
• Response scanning — the same checks run on the assistant message before the caller sees it.

The current list of guardrail types, and exactly what each one checks, is in the Guardrails guide.

Scope hierarchy

Guardrails are assigned in the dashboard at org, team, and key level. For each guardrail, the assignment at the narrowest scope that mentions it wins — a key-scoped assignment overrides a team-scoped one, which overrides the org-scoped one. Nothing is passed in the body and there is no per-request opt-out: every guardrail covering the key you call with runs inline, pre-call before the request leaves for the provider and post-call before the response reaches you, streaming included. (Since the 2026-09-18 gateway release a single call can also add guardrails with nrouter_guardrails; it can never remove one.)

# Nothing is passed in the body — the guardrails assigned to this key run on this call.
curl https://api.nrouter.ai/v1/chat/completions \
  -H "Authorization: Bearer sk-nrouter-..." \
  -H "Content-Type: application/json" \
  -d '{
    "model": "gemini-2.5-flash",
    "messages": [{"role": "user", "content": "Email me at jane@example.com"}]
  }'

When a guardrail blocks, the response is a 400 with error.code = guardrail_blocked — never a silent pass-through.

Configure guardrails at /{org}/guardrails. Audit hits at /{org}/observability.