> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/agentgateway/agentgateway/llms.txt
> Use this file to discover all available pages before exploring further.

# AI Prompt Guard

> Reference for the ai.promptGuard policy — request and response content inspection for LLM traffic.

The `ai.promptGuard` policy inspects LLM request prompts and/or model responses before they are forwarded. Guards can be applied to `request` (incoming user prompts) and `response` (model output) independently. Multiple guards can be chained in each list.

`ai.promptGuard` is part of the `ai` policy, which marks a route as LLM traffic:

```yaml theme={null}
binds:
- port: 3000
  listeners:
  - routes:
    - policies:
        ai:
          promptGuard:
            request:
            - regex:
                action: reject
                rules:
                - pattern: SSN
            response:
            - bedrockGuardrails:
                guardrailIdentifier: my-guardrail
                guardrailVersion: DRAFT
                region: us-west-2
```

## Guard types

Each item in `request[]` or `response[]` is exactly one of the following guard types:

<Tabs>
  <Tab title="Regex">
    Inspect content using regular expression patterns. Supports both custom patterns and built-in named patterns for common PII types.

    <ParamField body="regex" type="object">
      Regex-based content guard.

      <Expandable title="regex fields">
        <ParamField body="regex.action" type="string" required>
          Action to take when a rule matches. Valid values: `reject`.

          ```yaml theme={null}
          action: reject
          ```
        </ParamField>

        <ParamField body="regex.rules" type="object[]" required>
          A list of match rules. Each rule is either a `builtin` named pattern or a custom `pattern`.

          <Expandable title="rule types">
            <ParamField body="rules[].builtin" type="string">
              A built-in named pattern. Currently supported values include `email`.

              ```yaml theme={null}
              rules:
              - builtin: email
              ```
            </ParamField>

            <ParamField body="rules[].pattern" type="string">
              A custom regular expression string to match against message content.

              ```yaml theme={null}
              rules:
              - pattern: SSN
              - pattern: Social Security
              ```
            </ParamField>
          </Expandable>
        </ParamField>
      </Expandable>
    </ParamField>

    **Example — reject requests containing PII:**

    ```yaml theme={null}
    ai:
      promptGuard:
        request:
        - regex:
            action: reject
            rules:
            - pattern: SSN
            - pattern: Social Security
          rejection:
            status: 400
            headers:
              set:
                content-type: "application/json"
            body: |
              {
                "error": {
                  "message": "Request rejected: Content contains sensitive information",
                  "type": "invalid_request_error",
                  "code": "content_policy_violation"
                }
              }
        - regex:
            action: reject
            rules:
            - builtin: email
          rejection:
            status: 400
            body: '{"error": {"message": "Contains email address"}}'
    ```
  </Tab>

  <Tab title="Webhook">
    Forward content to an external HTTP service for inspection. The service returns an allow or deny decision.

    <ParamField body="webhook" type="object">
      Webhook-based content guard.

      <Expandable title="webhook fields">
        <ParamField body="webhook.target" type="object" required>
          The external service to forward content to. One of `service`, `host`, or `backend` must be set.

          <Expandable title="target options">
            <ParamField body="webhook.target.host" type="string">
              Hostname or IP address (with port) of the webhook service.
            </ParamField>

            <ParamField body="webhook.target.service" type="object">
              Reference to a named service.

              <Expandable title="service fields">
                <ParamField body="service.name.namespace" type="string">
                  Namespace of the service.
                </ParamField>

                <ParamField body="service.name.hostname" type="string">
                  Hostname of the service.
                </ParamField>

                <ParamField body="service.port" type="integer">
                  Port of the service.
                </ParamField>
              </Expandable>
            </ParamField>

            <ParamField body="webhook.target.backend" type="string">
              Explicit backend reference. The backend must be defined in the top-level `backends` list.
            </ParamField>
          </Expandable>
        </ParamField>

        <ParamField body="webhook.forwardHeaderMatches" type="object[]">
          A list of request headers to forward to the webhook service. Each entry matches by header name and optional value.

          <Expandable title="forwardHeaderMatches fields">
            <ParamField body="forwardHeaderMatches[].name" type="string" required>
              Header name to match.
            </ParamField>

            <ParamField body="forwardHeaderMatches[].value.exact" type="string">
              Exact value to match.
            </ParamField>

            <ParamField body="forwardHeaderMatches[].value.regex" type="string">
              Regex value to match.
            </ParamField>
          </Expandable>
        </ParamField>
      </Expandable>
    </ParamField>

    **Example:**

    ```yaml theme={null}
    ai:
      promptGuard:
        request:
        - webhook:
            target:
              host: "guard-service:8080"
            forwardHeaderMatches:
            - name: x-user-id
    ```
  </Tab>

  <Tab title="OpenAI Moderation">
    Use the [OpenAI Moderation API](https://platform.openai.com/docs/guides/moderation) to classify content.

    <ParamField body="openAIModeration" type="object">
      OpenAI Moderation API-based content guard.

      <Expandable title="openAIModeration fields">
        <ParamField body="openAIModeration.model" type="string" default="omni-moderation-latest">
          The moderation model to use. Defaults to `omni-moderation-latest`.

          ```yaml theme={null}
          model: omni-moderation-latest
          ```
        </ParamField>

        <ParamField body="openAIModeration.policies" type="object">
          Backend connection policies for the OpenAI API (TLS, auth, headers, etc.). Supports the same policy fields as other backend connections.
        </ParamField>
      </Expandable>
    </ParamField>

    **Example:**

    ```yaml theme={null}
    ai:
      promptGuard:
        request:
        - openAIModeration:
            model: omni-moderation-latest
    ```
  </Tab>

  <Tab title="Bedrock Guardrails">
    Use [AWS Bedrock Guardrails](https://aws.amazon.com/bedrock/guardrails/) to evaluate content.

    <ParamField body="bedrockGuardrails" type="object">
      AWS Bedrock Guardrails-based content guard.

      <Expandable title="bedrockGuardrails fields">
        <ParamField body="bedrockGuardrails.guardrailIdentifier" type="string" required>
          The unique identifier of the Bedrock guardrail to invoke.

          ```yaml theme={null}
          guardrailIdentifier: bedrock-guardrail-identifier
          ```
        </ParamField>

        <ParamField body="bedrockGuardrails.guardrailVersion" type="string" required>
          The version of the guardrail (e.g. `DRAFT` or a version number).

          ```yaml theme={null}
          guardrailVersion: DRAFT
          ```
        </ParamField>

        <ParamField body="bedrockGuardrails.region" type="string" required>
          The AWS region where the guardrail is deployed.

          ```yaml theme={null}
          region: us-west-2
          ```
        </ParamField>

        <ParamField body="bedrockGuardrails.policies" type="object">
          Backend policies for AWS authentication. When omitted, implicit AWS credential chain authentication is used.
        </ParamField>
      </Expandable>
    </ParamField>

    **Example:**

    ```yaml theme={null}
    ai:
      promptGuard:
        request:
        - bedrockGuardrails:
            guardrailIdentifier: bedrock-guardrail-identifier
            guardrailVersion: DRAFT
            region: us-west-2
        response:
        - bedrockGuardrails:
            guardrailIdentifier: bedrock-guardrail-identifier
            guardrailVersion: DRAFT
            region: us-west-2
    ```
  </Tab>

  <Tab title="Google Model Armor">
    Use [Google Cloud Model Armor](https://cloud.google.com/security-command-center/docs/model-armor-overview) to evaluate content.

    <ParamField body="googleModelArmor" type="object">
      Google Cloud Model Armor-based content guard.

      <Expandable title="googleModelArmor fields">
        <ParamField body="googleModelArmor.templateId" type="string" required>
          The Model Armor template ID to use.

          ```yaml theme={null}
          templateId: model-armor-template-id
          ```
        </ParamField>

        <ParamField body="googleModelArmor.projectId" type="string" required>
          The GCP project ID where Model Armor is configured.

          ```yaml theme={null}
          projectId: my-gcp-project
          ```
        </ParamField>

        <ParamField body="googleModelArmor.location" type="string" default="us-central1">
          The GCP region. Defaults to `us-central1`.

          ```yaml theme={null}
          location: us-central1
          ```
        </ParamField>

        <ParamField body="googleModelArmor.policies" type="object">
          Backend policies for GCP authentication. When omitted, implicit GCP credential chain authentication is used.
        </ParamField>
      </Expandable>
    </ParamField>

    **Example:**

    ```yaml theme={null}
    ai:
      promptGuard:
        request:
        - googleModelArmor:
            templateId: model-armor-template-id
            projectId: model-armor-project-id
            location: us-central1
        response:
        - googleModelArmor:
            templateId: model-armor-template-id
            projectId: model-armor-project-id
            location: us-central1
    ```
  </Tab>
</Tabs>

## Rejection configuration

Each guard entry can include a `rejection` block that customizes the HTTP response returned when the guard denies a request.

<ParamField body="rejection" type="object">
  Configures the HTTP response sent to the client when the guard rejects a request.

  <Expandable title="rejection fields">
    <ParamField body="rejection.status" type="integer">
      HTTP status code to return. Defaults to 403.

      ```yaml theme={null}
      rejection:
        status: 400
      ```
    </ParamField>

    <ParamField body="rejection.body" type="string">
      Response body to send. Supports multi-line strings.

      ```yaml theme={null}
      rejection:
        body: |
          {"error": {"message": "Request rejected"}}
      ```
    </ParamField>

    <ParamField body="rejection.headers" type="object">
      Headers to add, set, or remove from the rejection response.

      <Expandable title="rejection.headers fields">
        <ParamField body="rejection.headers.add" type="object">
          Headers to add to the rejection response.
        </ParamField>

        <ParamField body="rejection.headers.set" type="object">
          Headers to set on the rejection response (overrides existing values).

          ```yaml theme={null}
          rejection:
            headers:
              set:
                content-type: "application/json"
          ```
        </ParamField>

        <ParamField body="rejection.headers.remove" type="string[]">
          Header names to remove from the rejection response.
        </ParamField>
      </Expandable>
    </ParamField>
  </Expandable>
</ParamField>

## Guard chaining

Multiple guards can be listed under `request[]` or `response[]`. Guards are evaluated in order. If any guard rejects the content, the associated `rejection` response is returned immediately and subsequent guards are not evaluated.

```yaml theme={null}
ai:
  promptGuard:
    request:
    - regex:                  # evaluated first
        action: reject
        rules:
        - pattern: SSN
      rejection:
        status: 400
        body: 'Rejected: contains SSN'
    - regex:                  # evaluated second (only if first passes)
        action: reject
        rules:
        - builtin: email
      rejection:
        status: 400
        body: 'Rejected: contains email'
```

<Note>
  The `ai.promptGuard` policy only applies to routes that process LLM traffic. The parent `ai` policy must be set on the route for prompt guard to take effect.
</Note>