> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/agentgateway/agentgateway/llms.txt
> Use this file to discover all available pages before exploring further.

# Prompt Guard

> Inspect, filter, and block LLM prompts and responses using regex rules, webhooks, or managed AI safety services.

Prompt Guard allows you to intercept LLM requests and responses at the gateway layer — before they reach your AI provider or return to the client. This enables consistent content policy enforcement without modifying application code.

Guards can be applied to `request` (what the user sends to the LLM) and `response` (what the LLM sends back).

## Overview

<CardGroup cols={2}>
  <Card title="Regex" icon="magnifying-glass">
    Match patterns in prompt text and block or mask matching content. Supports custom patterns and built-in rules for common PII types.
  </Card>

  <Card title="Webhook" icon="webhook">
    Forward request or response content to an external moderation service. The webhook can reject or rewrite the content.
  </Card>

  <Card title="AWS Bedrock Guardrails" icon="aws">
    Delegate content safety to AWS Bedrock Guardrails using a guardrail identifier, version, and region.
  </Card>

  <Card title="Google Model Armor" icon="google">
    Delegate content safety to Google Cloud Model Armor using a template, project, and location.
  </Card>
</CardGroup>

## Configuration placement

Prompt Guard is configured under `policies.ai.promptGuard` on a route, applied to an AI backend:

```yaml theme={null}
binds:
- port: 3000
  listeners:
  - routes:
    - backends:
      - ai:
          name: openai
          provider:
            openAI:
              model: gpt-4o-mini
      policies:
        ai:
          promptGuard:
            request:
              ...
            response:
              ...
```

## Regex-based filtering

Use the `regex` guard to match patterns in prompts and responses. The `request` and `response` fields each accept a **list** of guard entries. Specify `action: reject` to block matching content.

```yaml theme={null}
policies:
  ai:
    promptGuard:
      request:
      - regex:
          action: reject
          rules:
          - pattern: SSN
          - pattern: Social Security
        rejection:
          status: 400
          body: "Request rejected: Contains sensitive information"
      response:
      - regex:
          action: reject
          rules:
          - builtin: email
        rejection:
          status: 400
          body: "Response blocked: Contains email address"
```

### Built-in patterns

Agentgateway ships with built-in patterns for common PII types. Reference them with the `builtin` key:

| Built-in name | Matches                    |
| ------------- | -------------------------- |
| `email`       | Email addresses            |
| `ssn`         | US Social Security Numbers |

### Custom patterns

Custom patterns accept any regular expression via the `pattern` field:

```yaml theme={null}
rules:
- pattern: "\\b\\d{3}-\\d{2}-\\d{4}\\b"
- pattern: "CONFIDENTIAL"
```

## Custom rejection responses

Rejection responses are fully configurable. Return JSON errors compatible with OpenAI-style clients:

```yaml theme={null}
policies:
  ai:
    promptGuard:
      request:
      - regex:
          action: reject
          rules:
          - pattern: SSN
          - pattern: Social Security
        rejection:
          status: 400
          headers:
            set:
              content-type: "application/json"
          body: |
            {
              "error": {
                "message": "Request rejected: Content contains sensitive information",
                "type": "invalid_request_error",
                "code": "content_policy_violation"
              }
            }
      - regex:
          action: reject
          rules:
          - builtin: email
        rejection:
          status: 400
          headers:
            set:
              content-type: "application/json"
          body: |
            {
              "error": {
                "message": "Response blocked: Contains email",
                "type": "invalid_request_error",
                "code": "pii_detected"
              }
            }
```

### Header operations

Rejection responses support three header operations:

```yaml theme={null}
rejection:
  status: 403
  headers:
    set:
      content-type: "application/json"
      x-moderation-version: "v1"
    add:
      x-blocked-category: "violence"
    remove:
      - server
  body: '{"error": "Forbidden"}'
```

| Operation | Behavior                                                           |
| --------- | ------------------------------------------------------------------ |
| `set`     | Replace or create a header (overwrites existing value)             |
| `add`     | Append a header value (allows multiple values for the same header) |
| `remove`  | Remove a header from the response                                  |

## Testing regex guards

Send a request containing a blocked pattern:

```bash theme={null}
curl http://localhost:3000 \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -d '{
    "model": "gpt-4o-mini",
    "messages": [
      {"role": "system", "content": "You are a helpful assistant."},
      {"role": "user", "content": "Is 123-45-6789 a valid SSN"}
    ]
  }'
# Request rejected due to inappropriate content
```

Test that the response guard blocks LLM output containing emails:

```bash theme={null}
curl http://localhost:3000 \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -d '{
    "model": "gpt-4o-mini",
    "messages": [
      {"role": "system", "content": "You are a helpful assistant."},
      {"role": "user", "content": "Return a fake email address"}
    ]
  }'
# Response rejected due to inappropriate content
```

## Webhook-based validation

Forward request or response content to an external moderation service. The webhook can reject content or allow it through:

```yaml theme={null}
policies:
  ai:
    promptGuard:
      request:
        webhook:
          target: 127.0.0.1:8000
          # Forward specific request headers to the webhook
          forwardHeaderMatches:
          - name: h1
            value:
              regex: v1
          - name: h2
            value:
              regex: v2.*
      response:
        webhook:
          target: 127.0.0.1:8000
```

By default, request headers are not forwarded to the webhook. Use `forwardHeaderMatches` to specify which headers to include — each entry is a header name with an optional regex value matcher.

## Provider integrations

<Tabs>
  <Tab title="AWS Bedrock Guardrails">
    Delegate content moderation to [AWS Bedrock Guardrails](https://aws.amazon.com/bedrock/guardrails/). Configure with a guardrail identifier, version, and the AWS region:

    ```yaml theme={null}
    # yaml-language-server: $schema=https://agentgateway.dev/schema/config
    binds:
    - port: 3000
      listeners:
      - routes:
        - backends:
          - ai:
              name: openai
              provider:
                openAI:
                  model: gpt-4o-mini
          policies:
            ai:
              promptGuard:
                request:
                - bedrockGuardrails:
                    guardrailIdentifier: bedrock-guardrail-identifier
                    guardrailVersion: DRAFT
                    region: us-west-2
                response:
                - bedrockGuardrails:
                    guardrailIdentifier: bedrock-guardrail-identifier
                    guardrailVersion: DRAFT
                    region: us-west-2
    ```

    | Field                 | Description                                |
    | --------------------- | ------------------------------------------ |
    | `guardrailIdentifier` | The Bedrock guardrail ID or ARN            |
    | `guardrailVersion`    | Version string, e.g. `DRAFT` or `1`        |
    | `region`              | AWS region where the guardrail is deployed |

    <Note>
      AWS credentials must be available in the environment (e.g. via IAM role, environment variables, or the default credential chain).
    </Note>
  </Tab>

  <Tab title="Google Cloud Model Armor">
    Delegate content moderation to [Google Cloud Model Armor](https://cloud.google.com/security/products/model-armor). Configure with a template ID, project ID, and location:

    ```yaml theme={null}
    # yaml-language-server: $schema=https://agentgateway.dev/schema/config
    binds:
    - port: 3000
      listeners:
      - routes:
        - backends:
          - ai:
              name: openai
              provider:
                openAI:
                  model: gpt-4o-mini
          policies:
            ai:
              promptGuard:
                request:
                - googleModelArmor:
                    templateId: model-armor-template-id
                    projectId: model-armor-project-id
                    location: us-central1
                response:
                - googleModelArmor:
                    templateId: model-armor-template-id
                    projectId: model-armor-project-id
                    location: us-central1
    ```

    | Field        | Description                                   |
    | ------------ | --------------------------------------------- |
    | `templateId` | The Model Armor template ID                   |
    | `projectId`  | Your Google Cloud project ID                  |
    | `location`   | The GCP region where the template is deployed |

    <Note>
      Google Cloud Application Default Credentials (ADC) must be configured in the environment.
    </Note>
  </Tab>
</Tabs>

## Running the prompt guard example

```bash theme={null}
cargo run -- -f examples/ai-prompt-guard/config.yaml
```

The example configures request guards for `SSN` and `Social Security` patterns, plus a response guard for the `email` built-in pattern, with JSON rejection responses compatible with OpenAI clients.