Every request. Protected by default.
Five guardrails fire on every nRouter request from day one. PII redaction, prompt-injection detection, secret scanning, abuse blocking, response scanning. Sub-50ms overhead, free on every tier, configurable per org/team/key.
Pre-call scan trigger
- Guardrails on every plan
- 5
- Pre-call overhead
- < 50 ms
- Plan tiers gating it
- 0
- Configurable scopes
- 3
PII, injection, secrets, abuse, response
Runs in parallel with request prep
Active on every tier from day one
Org > Team > Key with override
Five gates, inline on every request — not a sidecar.
Every guardrail runs inline on the request path before it reaches a provider. No extra API call, no SDK changes, no sidecar to scale.
Injection
Six attack classes blocked before the model is invoked: 403, no charge.
PII redact
Presidio masks SSNs, emails, cards, phones, addresses before the prompt leaves.
Secret scan
sk-*, AKIA*, PATs, JWTs, high-entropy strings: redacted or blocked.
Abuse block
Harmful-content keywords with leet-speak + Unicode normalization.
Response scan
Output buffered, scanned, then delivered. Leaked prompts and PII withheld.
The model sits between the pre-call gates and the response scan. Blocked requests never reach it.
Org > Team > Key with explicit override semantics
Lower scopes inherit higher-scope guardrails by default and can override them only if the parent permits. The same organization_id flows through every scope decision. No mapping table to drift.
Scope 01 — organization
5 guardrails inherited by every key
The security floor. Applies org-wide; resolution cached 30s, revoke is immediate.
Scope 02 — team
+ webhook (legal review)
Teams layer additional guardrails on top of the org set for their keys.
Scope 03 — key
skip injection — org permits
A research key can skip one inherited guardrail, but only if the org policy allows the override.
Effective guardrail set
Full guardrail catalog: detectors, providers, billing semantics
- PII redaction (Microsoft Presidio)
- SSN, credit card, email, phone, address detectors plus custom recognizers for org-specific patterns. Replacement tokens preserved across the conversation; the model never sees the raw value.
- Prompt-injection detection
- Heuristic detection across six attack categories: instruction override, role switching, prompt extraction, delimiter injection, encoding tricks, DAN-style jailbreaks. Logged with attack class for SIEM ingestion.
- Secret + API-key scanning
- OpenAI sk-*, Anthropic sk-ant-*, AWS AKIA*, GitHub PATs, Slack tokens, JWT, Stripe keys, plus a generic high-entropy detector. Block-vs-redact mode configurable per scope.
- Abuse + harmful-content blocking
- Violence, weapons, drug synthesis, CSAM, and self-harm keywords with leet-speak normalization. Pre-call by default, post-call for response sweeps. Returns 403 guardrail_blocked with category breakdown.
- Response scanning (streaming-aware)
- Streamed output is buffered, scanned as a complete message, then forwarded. Blocked completions are withheld; the client sees a 403 mid-stream. Post-call blocks were billed for the LLM call.
- Custom webhook guardrails
- Send the prompt to any HTTPS endpoint, await a verdict, then allow / block / redact. Configurable timeout (default 500ms), fail-open or fail-closed, signed payloads. Layer on top of the built-ins.
- Third-party providers
- Microsoft Presidio, regex patterns, keyword filters, injection detection, and custom webhooks are live today. Azure Content Safety, Bedrock Guardrails, Lakera Guard, and Aporia are on the roadmap.
- Billing on blocks
- Pre-call blocks: no LLM call is made, the credit reservation is released, you pay nothing. Post-call blocks: the upstream call already happened, so provider cost applies. The output is withheld.
Common guardrail questions
Do guardrails add latency?
Pre-call guardrails run in parallel with request prep and typically add under 50ms, negligible vs LLM inference time. Post-call guardrails buffer the response, scan it, then deliver, adding only a few milliseconds for normal-length completions. Streaming responses are buffered into chunks; blocked content never reaches the client.
Can I disable defaults or override them per request?
Yes. Default guardrails are visible in your dashboard. Toggle any off, modify config, or add your own. Per-request override via `nemo_guardrail_ids` in the `extra_body` field, scoped by org > team > key with key-level overrides taking precedence.
Are guardrails available on all plans?
Yes. All five built-in guardrails plus custom webhook guardrails are active on every plan from day one. We do not gate safety features behind paid plans. The scope hierarchy and override semantics are identical across Pay as you go, Pro, and Enterprise.
What about streaming responses?
Pre-call guardrails work identically. They fire before the model is invoked. Post-call scanning buffers the streamed response, scans it as a complete message, then forwards the chunks to the client. Blocked content is never delivered. Streaming clients see a 403 mid-stream if a post-call block fires.
If a request is blocked, am I charged?
Pre-call blocks: no LLM call is made and no credits are charged. The reservation is released immediately. Post-call blocks: the LLM call was made and you are charged the provider cost (we cannot retract the upstream call), but the output is withheld from the client.
How does the org > team > key scope hierarchy work?
Guardrails can be assigned at any of three scopes. Org-level guardrails apply to every key in the org. Team-level guardrails apply to keys assigned to that team. Key-level assignments override the others. A key can also be configured to skip an inherited guardrail (e.g. for a research workload that needs raw prompt-injection traffic), but only if the org policy permits override.
240+ models · 5 guardrails · 0 setup
Ship safer LLM features without writing safety code
Sign up, pick a tier, drop in your virtual key. Guardrails fire on the very first request. No flags to flip, no contracts to sign.