Guardrails

Guardrails are BharatRouter's content-inspection layer. They sit beside the egress allow/deny policy but inspect the request/response body: redacting or blocking PII and leaked secrets, filtering keywords and prompt-injection, running an asynchronouscontent-moderation classifier, and (optionally) consulting your own webhook. Manage them under Console → Guardrails or the REST API below.

Off by default (DPDP). Inference is zero-retention; every guardrail is an explicit, owner/admin opt-in. An un-armed org short-circuits to ~0 overhead. Audit records arecontent-free — rule ids + counts only, never the matched value.

Fail-open. Any evaluation error, classifier timeout, or webhook failure lets inference proceed (a broken guardrail must never brick the gateway). A per-org fail_closedopt-in flips that for strict tenants — a classifier/webhook outage then blocks instead.

Detectors

Content moderation

Moderation runs an asynchronous classifier alongside the local detectors, mapping each hazard to one of ten categories: hate, harassment,sexual, sexual_minors, violence, self_harm,weapons_criminal, privacy, ip_defamation, misc. Each category is independently off / flag / block.

• Classifier. Default meta-llama/Llama-Guard-3-8B (a catalog Llama-Guard). Override with any catalog classifier_model.
• Residency. residency: "india" forces the in-country Krutrim LLM-judge (routes only via Krutrim Cloud) and stamps x-br-data-policy: india_onlyon the classifier sub-call — recommended for India orgs. residency: "any" may send content to an off-shore classifier; the console surfaces a warning.
• Loop-safe. The classifier is called through the gateway's own routing with an incremented hop counter, and moderation is skipped on any nested (self-call) request, so a classifier can never recurse into a second classifier.
• Latency & cost. Ingress moderation overlaps routing (near-zero added TTFB); egress is serial (it needs the answer). Each armed request adds onemax_tokens: 32 classifier completion (egress doubles it). Bounded by a clampedtimeout_ms (200–10000, default 2000) and the un-armed short-circuit. Theresidency toggle is the cost-vs-residency lever — the Krutrim judge is pricier and slower than a 1B Llama-Guard.

Where they apply

Streaming egress buffers the response for armed orgs only — every other stream keeps a byte-identical raw pipe. On a block, an OpenAI stream emits an in-bandfinish_reason: "content_filter" + error frame (no content leaked); an Anthropic stream emits an error event + a refusal stop. Redaction back into thenative Anthropic wire and native-passthrough streaming reassembly are follow-ups; on those, a block is enforced but a redact is not yet rewritten in place.

Block response

A blocked request/response returns HTTP 400 with error codeguardrail_blocked (Anthropic surfaces the equivalent type: "error"body) — never echoing the offending content. Response headers x-br-guardrails,x-br-guardrails-egress, and x-br-guardrails-moderation reportblocked / redacted / flagged.

Management API

Session-authed, org-scoped. Reading is member-visible; writing is owner/admin only.

PUT /me/guardrails
{
  "enabled": true,
  "apply_ingress": true,
  "apply_egress": true,
  "pii": { "aadhaar": "redact", "pan": "redact", "credit_card": "block" },
  "secrets": { "api_key": "redact", "private_key": "block" },
  "moderation": {
    "residency": "india",
    "apply_ingress": true,
    "apply_egress": true,
    "timeout_ms": 2000,
    "fail_closed": false,
    "categories": { "hate": "block", "sexual_minors": "block", "self_harm": "flag" }
  }
}