Relay: guardrails
Deterministic PII and prompt-injection checks on requests and responses, what they catch, what they do not, and how verdicts are reported.
Design choice
The first release of Relay's guardrails is deterministic: pattern and rule based, no model in the loop. That makes them fast (sub-millisecond), free (no tokens), reproducible (the same text always gets the same verdict) and explainable (the verdict names the rule). It also means they catch the obvious and documented cases, not every paraphrase. Treat them as a policy floor, not as a replacement for application-level controls.
Detectors
PII (request and response)
| Rule | Example of what matches |
|---|---|
pii.email |
[email protected] |
pii.phone |
E.164 and common national formats |
pii.card |
13–19 digit sequences passing the Luhn check |
pii.hkid |
Hong Kong ID pattern with check digit |
pii.cn_id |
PRC 18-digit resident ID with check digit |
pii.iban |
IBAN with checksum |
Prompt injection (request; optionally response for tool-use loops)
| Rule | Signal |
|---|---|
inj.override |
"ignore previous instructions" and close variants in several languages |
inj.role |
attempts to redefine the system role inside user content |
inj.exfil |
instructions to reveal the system prompt, keys or hidden context |
inj.encoded |
base64 / hex blobs above a size threshold inside user text |
Policy and verdicts
Per environment, separately for requests and responses: off, flag, block.
flag— the call proceeds;X-Relay-Guardrail: flag:pii.emailis returned and the trace records every rule that fired.block— the call is refused with422 guardrail_blockedand a body naming the rules; nothing is sent to the provider. On responses, the provider's output is withheld and replaced by the error.
Blocked requests are not metered. Flagged requests are.
Allow-listing
A rule can be disabled per environment (for example pii.phone in a call-centre application), and specific literal values can be allow-listed (a support mailbox address). Both are audited.
What this is not
It is not a content-safety classifier, not a redaction service (text is not rewritten), and not a defence against adversarial paraphrase. Environments that need model-based classification can enable the evaluation feature on the Business plan, which samples traffic and scores it asynchronously with a model you choose, on your own key — never in the request path.