Guardrails and PII masking
Detect, redact or refuse personal data in requests and MCP tool calls.
Guardrails scan traffic for the personal-data patterns your organisation selects in Governance › Policies, under PII Scanning, and act on what they find before it reaches the provider or the tool.
What is scanned
- LLM requests: the request body, before it is sent to the provider. LLM responses are not scanned by guardrails.
- MCP tool calls: the tool's arguments, before the tool sees them, and the tool's result, before the caller sees it.
Actions
For each pattern, choose what happens on a match:
- Alert, and allow (the default): the request is sent as it is, and the detection is recorded.
- Redact, then send: the matched values are replaced before the request is sent, or before a tool result is returned. The redacted version is what is stored.
- Refuse the request: the request is refused with HTTP 400
pii_policy_violation(an MCP tool call gets JSON-RPC error-32602), naming the kind of data matched, never the value. For a tool result, the tool has already run; its output is withheld and the caller gets an error in its place.
When several patterns match, the strongest action applies: refuse, then redact, then alert.
When a request cannot be scanned
Choose a fail mode for when the policy cannot be read and no recent copy of it is available, or a body is larger than the 1 MB that can be scanned:
- Fail open (the default): the request is sent unscanned, and recorded as not scanned.
- Fail closed: the request is refused. When the policy cannot be read, an LLM request or a call to a server's own MCP endpoint gets HTTP 503, which clients that retry will try again; a call on the unified MCP endpoint gets JSON-RPC error
-32603. A request body too large to scan gets HTTP 413, and a tool result too large to scan is withheld.
Reviewing detections
Each detection is recorded on the request or tool call with the pattern that matched and the action taken, without the matched value. Changes to the policy reach the gateway within a minute.
Masking of stored request and response bodies is a separate setting, applied when bodies are stored; it does not change what the provider or the tool receives.