Overview

Guardrails in Bifrost provide enterprise-grade content safety, security validation, and policy enforcement for LLM traffic and MCP tool executions. The system validates inputs and outputs in real-time against your specified policies, ensuring responsible AI deployment with protection against harmful content, prompt injection, PII leakage, credential leakage, and policy violations.

Supported Providers

Secrets Detection

Built-in Gitleaks-backed detection for leaked API keys, tokens, private keys, and credentials.

Prompt Guardrails

LLM-as-judge enforcement for organization-specific natural-language policies.

Custom Regex

In-process regex guardrails, including the built-in PII Detection template.

Microsoft Presidio

Presidio Analyzer based PII detection, blocking, and redaction.

Azure AI Language PII

Azure Language PII entity recognition with configurable categories and redaction.

AWS Bedrock Guardrails

Enterprise content filtering, PII detection, and prompt attack prevention.

Azure Content Safety

Multi-modal content moderation with severity-based filtering.

Google Model Armor

Google Cloud policy enforcement for prompt injection, content safety, malicious URLs, and Sensitive Data Protection.

CrowdStrike AIDR

Inline AI threat detection, policy enforcement, redaction, and AIDR audit visibility.

Gray Swan Cygnal

AI safety monitoring with natural language rule definitions.

Patronus AI

LLM security, hallucination detection, and safety evaluation.

Lakera Guard

Threat detection for LLM conversations, including prompt injection and sensitive data exposure.

Repello Argus

Asset-defined AI security policies for prompt injection, sensitive data, unsafe content, and policy violations.

Core Concepts

Bifrost Guardrails are built around two core concepts that work together to provide flexible and powerful content protection:

Concept	Description
Rules	Custom policies defined using CEL (Common Expression Language) that determine which LLM requests or MCP tool executions to validate and when. Rules can apply to inputs, outputs, or both, and can be linked to one or more profiles for evaluation.
Profiles	Configurations for guardrail providers, including Bifrost-managed providers (Prompt Guardrails, Custom Regex, Secrets Detection) and external providers (Presidio, Azure AI Language PII, AWS Bedrock, Azure Content Safety, Google Model Armor, CrowdStrike AIDR, Gray Swan, Patronus AI, Lakera Guard, and Repello Argus). Profiles are reusable and can be shared across multiple rules.

How They Work Together:

Profiles define how content is evaluated using native Bifrost checks or external provider capabilities
Rules define when and what content gets evaluated using CEL expressions
A single rule can use multiple profiles for layered protection
Profiles can be reused across different rules for consistency

Key Features

Feature	Description
Multi-Provider Support	Bifrost-managed Prompt Guardrails, Custom Regex, and Secrets Detection, plus Presidio, Azure AI Language PII, AWS Bedrock, Azure Content Safety, Google Model Armor, CrowdStrike AIDR, Gray Swan, Patronus AI, Lakera Guard, and Repello Argus integrations
Dual-Stage Validation	Guard LLM prompts and responses or MCP tool arguments and results
Real-Time Processing	Synchronous and asynchronous validation modes
CEL-Based Rules	Define custom policies using Common Expression Language
Reusable Profiles	Configure providers once, use across multiple rules
Sampling Control	Apply rules to a percentage of requests for performance tuning
Automatic Remediation	Detect, block, redact, or modify content based on policy
Bifrost-Managed Redaction	Redact runtime payloads, Bifrost logs, and trace-export connector content for supported providers
Comprehensive Logging	Detailed audit trails for compliance

Redaction

Supported providers can redact detected text instead of only detecting or blocking it. Bifrost supports three redaction modes:

Runtime (runtime) redacts the live request or response and stores redacted values in logs.
Logs only (logs_only) leaves runtime content raw but redacts Bifrost logs and trace-export connector content.
Runtime + reversible logs (runtime_reversible) redacts runtime content and logs with reversible placeholders.

For the full behavior matrix, reveal permissions, and connector export caveats, see Guardrail Redaction.

Navigating Guardrails in the UI

Access Guardrails from the Bifrost dashboard:

Page	Path	Description
Configuration	Guardrails > Configuration	Manage guardrail rules and their settings
Providers	Guardrails > Providers	Configure and manage guardrail profiles

Guardrail Targets

Every rule has one execution target. Existing rules and rules that omit target default to llm.

Target	Input phase	Output phase	Target-specific CEL variables
`llm`	Before the request reaches the model provider	After the model provider responds	`model`, `provider`, `params`
`mcp`	Before the MCP tool executes; guardrails can inspect or redact its arguments	After the tool returns; guardrails can inspect or redact its result	`mcp_client`, `mcp_tool`, `mcp_arguments`

Both targets also expose headers, virtual_key, customer, team, and user. Target-specific CEL variables are intentionally isolated: an MCP rule cannot reference model, and an LLM rule cannot reference mcp_tool.

Architecture

The following diagram illustrates how Rules and Profiles work together for the LLM target. For tool execution, see MCP Guardrails. Flow Description:

Incoming Request - LLM request arrives at Bifrost
Input Validation - Applicable rules evaluate the input using linked profiles
LLM Processing - If input passes, request is forwarded to the LLM provider
Output Validation - Response is evaluated by output rules using linked profiles
Response - Validated response is returned (or blocked/modified based on violations)

MCP Guardrails

MCP guardrails protect the actual tool-execution boundary, not merely the tool call proposed by an LLM. After the rule’s CEL expression matches, Bifrost applies the selected phase:

Apply on	Flow
Before tool call (`input`)	Inspect arguments → allow or redact and execute; block → stop before execution
After tool result (`output`)	Execute tool → inspect a successful text-bearing result → allow or redact and return; block → do not return the result
Both (`both`)	Run the input flow; if allowed, execute the tool and run the output flow. A block at either boundary stops processing

Choose Which Tool Calls to Guard

MCP Client is populated from configured clients that are enabled.
MCP Tool is populated from their currently discovered tools.
Tool Argument shows a searchable dropdown of top-level string, number, and boolean input-schema fields when one MCP tool is selected with the = operator. You can also enter an argument name manually.

MCP rules can additionally use the shared identity fields listed under Guardrail Targets.

All supported guardrail providers can be linked to MCP rules without separate MCP-specific provider setup. Provider capabilities still apply: only providers listed in Guardrail Redaction support Bifrost-managed redaction, while other providers may detect, block, or return provider-managed transformations.

MCP rules use the same linked profiles, sampling, and timeout settings as LLM rules. See Creating Rules for configuration and CEL Expression Examples for targeting examples.

Streaming Output Guardrails

Streaming delivery depends on what the matched output guardrails can do:

Detect-only and logs-only rules observe the stream without delaying client delivery.
Runtime redaction checks buffered text segments and releases the resulting safe text as the response is generated.
If any matched rule can block, Bifrost holds the complete stream until generation and guardrail evaluation finish. If stream_replay_event_interval_ms is positive, an allowed stream is replayed with that delay between buffered events; otherwise, it is delivered immediately. A blocked stream returns the guardrail intervention instead.

Replay pacing is disabled by default. The dashboard initializes the event interval to 25 milliseconds when pacing is enabled, while 0 sends all buffered events immediately. If multiple matched block-capable rules configure different intervals, Bifrost uses the largest value. This behavior applies to streaming Chat Completions, Text Completions, and Responses API requests. Input guardrails still check the request before Bifrost sends it to the LLM provider.

Gray Swan is a tool-call-specific exception. Text-only streams are delivered directly to the client and are not sent to Cygnal. See Gray Swan Cygnal for the full behavior.

If the same rule also uses another output guardrail profile, Bifrost waits for that profile to check the completed response. Gray Swan’s text-only behavior only skips the Gray Swan call; it does not bypass the other profile.

Guardrail Rules

Guardrail Rules are custom policies that define when and how content validation occurs. Rules use CEL (Common Expression Language) expressions to evaluate requests and can be linked to one or more profiles for execution.

Guardrail rule editor showing LLM and MCP target options, input and output phase choices, linked profiles, sampling rate, and timeout

Rule Properties

Property	Type	Required	Description
`id`	integer	Yes	Unique identifier for the rule
`name`	string	Yes	Descriptive name for the rule
`description`	string	No	Explanation of what the rule does
`enabled`	boolean	Yes	Whether the rule is active
`target`	enum	No	Execution boundary: `llm` (default) or `mcp`
`cel_expression`	string	Yes	CEL expression for rule evaluation
`apply_to`	enum	Yes	When to apply: `input`, `output`, or `both`. For MCP rules, input means tool arguments and output means the tool result
`sampling_rate`	integer	No	Percentage of requests to evaluate (0-100)
`timeout`	integer	No	Execution timeout in seconds (default: 60)
`max_turns_to_send`	integer	No	Number of historical conversation turns sent to the guardrail provider; the latest message is always included. `0` sends all turns
`evaluation_mode`	enum	No	`bundled` (default) sends selected turns in one guardrail call; `per_turn` evaluates each turn in isolation and uses more provider calls
`stream_replay_event_interval_ms`	integer	No	Delay in milliseconds between buffered events after block-capable streaming output guardrails allow the response. `0` sends buffered events immediately; maximum `1000`
`provider_config_ids`	array	No	IDs of profiles to use for evaluation

Creating Rules

Web UI
API
config.json
Helm

Navigate to Rules
- Go to Guardrails > Configuration
- Click Add Rule

Guardrail rules list showing configured rules with status and actions

Configure Rule Settings

Basic Information:

Name: Enter a descriptive name (e.g., “Block PII in Prompts”)
Description: Explain the rule’s purpose
Enabled: Toggle to activate the rule
Target: Choose LLM or MCP. LLM is the default for existing rules

Evaluation Settings:

Apply To: Select when to apply the rule
- input - Validate incoming prompts for LLM rules or tool arguments for MCP rules
- output - Validate LLM responses or MCP tool results
- both - Validate both phases
CEL Expression: Define the validation logic
Sampling Rate: Set percentage of requests to evaluate (default: 100%)
Timeout: Set maximum execution time in seconds (default: 60)

Link Profiles
- Select one or more profiles to use for evaluation
- Bifrost evaluates linked profiles in their configured order and stops that rule when a profile intervenes or fails
Save and Test
- Click Save Rule
- Use the Test button to validate with sample content

The HTTP API uses camelCase field names (celExpression, applyTo, samplingRate, selectedGuardrailProfiles). The target field remains lowercase and accepts llm or mcp. Profiles are referenced as "<provider-type>:<config-id>" strings (for example, "regex:1", "patronus-ai:6").Create a Guardrail Rule:

curl -X POST http://localhost:8080/api/guardrails/rules \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Protect GitHub issue creation",
    "description": "Inspect arguments before the GitHub tool creates an issue",
    "enabled": true,
    "target": "mcp",
    "celExpression": "mcp_client == \"github\" && mcp_tool == \"create_issue\"",
    "applyTo": "input",
    "samplingRate": 100,
    "timeout": 5000,
    "selectedGuardrailProfiles": ["regex:1", "bedrock:2"]
  }'

List All Rules:

curl -X GET http://localhost:8080/api/guardrails/rules \
  -H "Content-Type: application/json"

# Response
{
  "count": 1,
  "limit": 1,
  "offset": 0,
  "rules": [
    {
      "id": 1,
      "name": "Protect GitHub issue creation",
      "description": "Inspect arguments before the GitHub tool creates an issue",
      "enabled": true,
      "target": "mcp",
      "celExpression": "mcp_client == \"github\" && mcp_tool == \"create_issue\"",
      "applyTo": "input",
      "samplingRate": 100,
      "timeout": 5000,
      "selectedGuardrailProfiles": ["regex:1", "bedrock:2"]
    }
  ]
}

Update a Rule:PUT revalidates against the full rule schema. Send the complete rule body (same shape as POST), not a patch.

curl -X PUT http://localhost:8080/api/guardrails/rules/1 \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Protect GitHub issue creation",
    "description": "Inspect arguments before the GitHub tool creates an issue",
    "enabled": false,
    "target": "mcp",
    "celExpression": "mcp_client == \"github\" && mcp_tool == \"create_issue\"",
    "applyTo": "input",
    "samplingRate": 50,
    "timeout": 5000,
    "selectedGuardrailProfiles": ["regex:1", "bedrock:2"]
  }'

Delete a Rule:

curl -X DELETE http://localhost:8080/api/guardrails/rules/1

{
  "guardrails_config": {
    "guardrail_rules": [
      {
        "id": 1,
        "name": "Block PII in Prompts",
        "description": "Prevent PII from being sent to LLM providers",
        "enabled": true,
        "target": "llm",
        "cel_expression": "true",
        "apply_to": "input",
        "sampling_rate": 100,
        "timeout": 5000,
        "provider_config_ids": [1, 2]
      },
      {
        "id": 2,
        "name": "Content Filter for Responses",
        "description": "Filter harmful content from LLM responses",
        "enabled": true,
        "target": "llm",
        "cel_expression": "true",
        "apply_to": "output",
        "sampling_rate": 100,
        "timeout": 3000,
        "max_turns_to_send": 8,
        "evaluation_mode": "per_turn",
        "provider_config_ids": [2]
      },
      {
        "id": 3,
        "name": "Protect GitHub issue creation",
        "description": "Inspect arguments before the GitHub tool creates an issue",
        "enabled": true,
        "target": "mcp",
        "cel_expression": "mcp_client == 'github' && mcp_tool == 'create_issue'",
        "apply_to": "input",
        "sampling_rate": 100,
        "timeout": 2000,
        "provider_config_ids": [1]
      }
    ]
  }
}

bifrost:
  guardrails:
    rules:
      - id: 1
        name: "Block PII in Prompts"
        description: "Prevent PII from being sent to LLM providers"
        enabled: true
        target: "llm"
        cel_expression: "true"
        apply_to: "input"
        sampling_rate: 100
        timeout: 5000
        provider_config_ids: [1, 2]
      - id: 2
        name: "Content Filter for Responses"
        description: "Filter harmful content from LLM responses"
        enabled: true
        target: "llm"
        cel_expression: "true"
        apply_to: "output"
        sampling_rate: 100
        timeout: 3000
        max_turns_to_send: 8
        evaluation_mode: per_turn
        stream_replay_event_interval_ms: 25
        provider_config_ids: [2]
      - id: 3
        name: "Protect GitHub issue creation"
        description: "Inspect arguments before the GitHub tool creates an issue"
        enabled: true
        target: "mcp"
        cel_expression: "mcp_client == 'github' && mcp_tool == 'create_issue'"
        apply_to: "input"
        sampling_rate: 100
        timeout: 2000
        provider_config_ids: [1]

CEL Expression Examples

CEL (Common Expression Language) determines whether a rule applies using request identity and target-specific metadata. The linked guardrail profiles inspect the actual prompt, response, tool arguments, or tool result; message content is not exposed as a request.messages CEL object. Always Apply Rule:

true

Apply Based on LLM Model:

model.startsWith("gpt-4")

Apply to OpenAI Traffic in Production:

provider == "openai" && ("x-environment" in headers) && headers["x-environment"] == "production"

Apply to a Team:

team == "team-platform"

Apply to an MCP Tool:

mcp_client == "github" && mcp_tool == "create_issue"

Apply Based on an MCP Argument:

("amount" in mcp_arguments) && mcp_arguments["amount"] > 1000

Linking Rules to Profiles

Rules can be linked to multiple profiles for comprehensive validation:

Rule configuration showing linked profiles

Best Practices:

Link credential-leakage rules to Secrets Detection
Link PII detection rules to profiles with PII capabilities (Custom Regex PII template, Presidio, Azure AI Language PII, Bedrock, Patronus)
Link content filtering rules to profiles with content safety features (Azure, Bedrock, Gray Swan)
Use Prompt Guardrails for natural-language policies evaluated by a configured Bifrost judge model
Use Gray Swan when you want its external Cygnal policy service, violation scoring, and threat-detection capabilities
Use multiple profiles for defense-in-depth (e.g., Bedrock + Patronus for PII, Azure + Gray Swan for content)
Set appropriate timeouts when using multiple profiles

Managing Profiles

Profiles are reusable configurations for guardrail providers. External providers include credentials, endpoints, and detection thresholds. Custom Regex and Secrets Detection run locally. Prompt Guardrails uses a configured Bifrost LLM provider and model as its judge.

Guardrail profiles list showing configured providers

Profile Properties

Property	Type	Required	Description
`id`	integer	Yes	Unique identifier for the profile
`provider_name`	string	Yes	Provider type: `regex`, `secrets`, `prompt-guardrail`, `presidio`, `azure-pii`, `bedrock`, `azure`, `model-armor`, `crowdstrike-aidr`, `grayswan`, `patronus-ai`, `lakera`, or `repelloai-argus`
`policy_name`	string	Yes	Descriptive name for the policy
`enabled`	boolean	Yes	Whether the profile is active
`config`	object	No	Provider-specific configuration

Creating Profiles

Web UI
API
config.json
Helm

Navigate to Providers
- Go to Guardrails > Providers
- Click Add Profile

Select Provider Type
- Choose a supported Bifrost-managed or external provider
Configure Provider Settings
- Enter credentials and endpoint information for external providers, local settings for native providers, or the judge provider, model, and policy for Prompt Guardrails
- Configure provider-specific detection, decision, or transformation settings
- See the provider-specific page for detailed configuration
Save Profile
- Click Save Profile
- The profile is now available for linking to rules

Profiles are managed per provider type at /api/guardrails/{provider}, where {provider} is one of secrets, regex, prompt-guardrail, presidio, azure-pii, bedrock, azure, model-armor, crowdstrike-aidr, grayswan, patronus-ai, lakera, or repelloai-argus. The API assigns the configuration ID after creation.Create a Profile:

curl -X POST http://localhost:8080/api/guardrails/bedrock \
  -H "Content-Type: application/json" \
  -d '{
    "name": "PII Detection Profile",
    "enabled": true,
    "config": {
      "access_key": "env.AWS_ACCESS_KEY_ID",
      "secret_key": "env.AWS_SECRET_ACCESS_KEY",
      "guardrail_arn": "arn:aws:bedrock:us-east-1:123456789:guardrail/abc123",
      "guardrail_version": "1",
      "region": "us-east-1"
    }
  }'

List All Profiles (grouped by provider):

curl -X GET http://localhost:8080/api/guardrails \
  -H "Content-Type: application/json"

# Response
[
  {
    "name": "regex",
    "configs": [
      { "id": 1, "name": "PII Detection", "enabled": true, "patterns": [...] }
    ]
  },
  {
    "name": "bedrock",
    "configs": [
      { "id": 2, "name": "PII Detection Profile", "enabled": true, "guardrail_arn": "...", "region": "us-east-1" }
    ]
  }
]

To list only a single provider’s profiles, hit the provider path directly: GET /api/guardrails/bedrock.Update a Profile:

curl -X PUT http://localhost:8080/api/guardrails/bedrock \
  -H "Content-Type: application/json" \
  -d '{
    "id": 1,
    "name": "PII Detection Profile",
    "enabled": false
  }'

Delete a Profile:

curl -X DELETE http://localhost:8080/api/guardrails/bedrock \
  -H "Content-Type: application/json" \
  -d '{"id": 1}'

{
  "guardrails_config": {
    "guardrail_providers": [
        {
          "id": 1,
          "provider_name": "secrets",
          "policy_name": "Block Leaked Credentials",
          "enabled": true,
          "config": {
            "ignored_secret_keywords": ["example", "dummy"]
          }
        },
        {
          "id": 2,
          "provider_name": "regex",
          "policy_name": "PII Detection",
          "enabled": true,
          "config": {
            "patterns": [
              { "pattern": "\\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\\.[A-Z]{2,}\\b", "description": "Email address", "flags": "i" },
              { "pattern": "\\b\\d{3}-\\d{2}-\\d{4}\\b", "description": "US Social Security Number" }
            ]
          }
        },
        {
          "id": 3,
          "provider_name": "bedrock",
          "policy_name": "PII Detection Profile",
          "enabled": true,
          "config": {
            "access_key": "env.AWS_ACCESS_KEY_ID",
            "secret_key": "env.AWS_SECRET_ACCESS_KEY",
            "guardrail_arn": "arn:aws:bedrock:us-east-1:123456789:guardrail/abc123",
            "guardrail_version": "1",
            "region": "us-east-1"
          }
        },
        {
          "id": 4,
          "provider_name": "azure",
          "policy_name": "Content Safety Profile",
          "enabled": true,
          "config": {
            "endpoint": "https://your-resource.cognitiveservices.azure.com/",
            "api_key": "env.AZURE_CONTENT_SAFETY_API_KEY",
            "analyze_enabled": true,
            "analyze_severity_threshold": "medium",
            "jailbreak_shield_enabled": true,
            "indirect_attack_shield_enabled": true
          }
        },
        {
          "id": 5,
          "provider_name": "model-armor",
          "policy_name": "Google Model Armor Production",
          "enabled": true,
          "timeout": 30,
          "config": {
            "auth_type": "default_credential",
            "project_id": "env.GCP_PROJECT_ID",
            "location": "env.GCP_LOCATION",
            "template_id": "env.GMA_TEMPLATE_ID"
          }
        },
        {
          "id": 6,
          "provider_name": "crowdstrike-aidr",
          "policy_name": "CrowdStrike AIDR Production",
          "enabled": true,
          "timeout": 30,
          "config": {
            "api_key": "env.CS_AIDR_TOKEN",
            "base_url": "env.CS_AIDR_BASE_URL",
            "app_id": "bifrost-production",
            "collector_instance_id": "prod-us-east-1"
          }
        },
        {
          "id": 7,
          "provider_name": "grayswan",
          "policy_name": "Custom Safety Rules",
          "enabled": true,
          "config": {
            "api_key": "env.GRAYSWAN_API_KEY",
            "policy_id": "YOUR_GRAYSWAN_POLICY_ID",
            "violation_threshold": 0.5,
            "reasoning_mode": "hybrid",
            "rules": {
              "no_pii": "Do not allow personally identifiable information",
              "professional_tone": "Ensure responses maintain a professional tone"
            }
          }
        },
        {
          "id": 8,
          "provider_name": "patronus-ai",
          "policy_name": "Patronus Quality Checks",
          "enabled": true,
          "config": {
            "api_key": "env.PATRONUS_API_KEY",
            "base_url": "https://api.patronus.ai",
            "evaluators": [
              {
                "evaluator": "pii",
                "explain_strategy": "on-fail"
              },
              {
                "evaluator": "judge",
                "criteria": "patronus:is-concise",
                "explain_strategy": "on-fail"
              }
            ],
            "capture": "none"
          }
        }
      ]
    }
  }

bifrost:
  guardrails:
    providers:
      - id: 1
        provider_name: "secrets"
        policy_name: "Block Leaked Credentials"
        enabled: true
        config:
          ignored_secret_keywords:
            - "example"
            - "dummy"
      - id: 2
        provider_name: "regex"
        policy_name: "PII Detection"
        enabled: true
        config:
          patterns:
            - pattern: "\\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\\.[A-Z]{2,}\\b"
              description: "Email address"
              flags: "i"
            - pattern: "\\b\\d{3}-\\d{2}-\\d{4}\\b"
              description: "US Social Security Number"
      - id: 3
        provider_name: "bedrock"
        policy_name: "PII Detection Profile"
        enabled: true
        config:
          guardrail_arn: "arn:aws:bedrock:us-east-1:123456789:guardrail/abc123"
          guardrail_version: "1"
          region: "us-east-1"
          # AWS Authentication (choose one method):
          # Option 1: Explicit credentials
          access_key: "env.AWS_ACCESS_KEY_ID"
          secret_key: "env.AWS_SECRET_ACCESS_KEY"
          # Option 2: IAM Role - omit access_key and secret_key
          # (Bifrost will use IAM credentials from the environment)
      - id: 4
        provider_name: "azure"
        policy_name: "Content Safety Profile"
        enabled: true
        config:
          endpoint: "https://your-resource.cognitiveservices.azure.com/"
          api_key: "env.AZURE_CONTENT_SAFETY_API_KEY"
          analyze_enabled: true
          analyze_severity_threshold: "medium"
          jailbreak_shield_enabled: true
      - id: 5
        provider_name: "model-armor"
        policy_name: "Google Model Armor Production"
        enabled: true
        timeout: 30
        config:
          auth_type: "default_credential"
          project_id: "env.GCP_PROJECT_ID"
          location: "env.GCP_LOCATION"
          template_id: "env.GMA_TEMPLATE_ID"
      - id: 6
        provider_name: "crowdstrike-aidr"
        policy_name: "CrowdStrike AIDR Production"
        enabled: true
        timeout: 30
        config:
          api_key: "env.CS_AIDR_TOKEN"
          base_url: "env.CS_AIDR_BASE_URL"
          app_id: "bifrost-production"
          collector_instance_id: "prod-us-east-1"
      - id: 7
        provider_name: "grayswan"
        policy_name: "Custom Safety Rules"
        enabled: true
        config:
          api_key: "env.GRAYSWAN_API_KEY"
          policy_id: "YOUR_GRAYSWAN_POLICY_ID"
          violation_threshold: 0.5
          reasoning_mode: "hybrid"
          rules:
            no_pii: "Do not allow personally identifiable information"
            professional_tone: "Ensure responses maintain a professional tone"
      - id: 8
        provider_name: "patronus-ai"
        policy_name: "Patronus Quality Checks"
        enabled: true
        config:
          api_key: "env.PATRONUS_API_KEY"
          base_url: "https://api.patronus.ai"
          evaluators:
            - evaluator: "pii"
              explain_strategy: "on-fail"
            - evaluator: "judge"
              criteria: "patronus:is-concise"
              explain_strategy: "on-fail"
          capture: "none"

Provider Capabilities

Bifrost-managed providers cover deterministic local checks and natural-language policies:

Provider	Evaluation	Decisions	Additional provider cost	Best for
Secrets Detection	Local Gitleaks rules	Detect, block, or redact	No	Credentials, tokens, and private keys
Custom Regex	Local RE2 patterns	Detect, block, or redact	No	Known patterns, identifiers, and PII templates
Prompt Guardrails	Configured Bifrost LLM judge	Allow or block	Yes	Semantic, organization-specific policies

See Guardrail Redaction for Bifrost-managed redaction modes. Third-party guardrail providers offer the following capabilities:

Capability	AWS Bedrock	Azure Content Safety	Google Model Armor	CrowdStrike AIDR	Gray Swan	Patronus AI	Lakera Guard	Repello Argus	Azure AI Language PII	Presidio
PII Detection	Yes	No	Yes	Policy-dependent	No	Yes	Yes	Yes	Yes	Yes
Content Filtering	Yes	Yes	Yes	Policy-dependent	Yes	Yes	Yes	Yes	No	No
Prompt Injection	Yes	Yes	Yes	Policy-dependent	Yes	Yes	Yes	Yes	No	No
Hallucination Detection	No	No	No	No	No	Yes	No	No	No	No
Toxicity Screening	Yes	Yes	Yes	Policy-dependent	Yes	Yes	Policy-dependent	Yes	No	No
Custom Policies	Yes	Yes	Yes	Policy-dependent	Yes	Yes	Yes	Yes	Category filters	Entity filters
Custom Natural Language Rules	No	No	No	No	Yes	No	No	No	No	No
Image Support	Yes	No	No	No	No	No	No	No	No	No
IPI Detection	No	Yes	Yes	Policy-dependent	Yes	No	Policy-dependent	Policy-dependent	No	No
Mutation Detection	No	No	No	No	Yes	No	No	No	No	No
Bifrost-managed Redaction	No	No	No	No	No	No	Yes	No	Yes	Yes
Provider-managed Transformation	Yes	No	Yes	Policy-dependent	No	No	No	No	No	No

CrowdStrike AIDR capabilities depend on the AIDR policy and detectors configured in CrowdStrike. Bifrost sends the request to AIDR, then enforces the returned blocked or transformed decision.

Do not configure provider-managed transformations and Bifrost-managed redaction to rewrite the same input or output phase. Bifrost fails closed when a phase produces both provider-managed transformed text and Bifrost-managed redaction findings, because there is no safe unambiguous way to merge two rewritten outputs. Detection-only and blocking guardrails can still run alongside redaction.

Best Practices

Profile Organization:

Create separate profiles for different use cases (PII, content filtering, etc.)
Use descriptive policy names that indicate the profile’s purpose
Keep credentials secure using environment variables

Performance Considerations:

Enable only the profiles you need to minimize latency
Use sampling rates on rules for high-traffic endpoints
Set appropriate timeouts to prevent slow requests
Account for the extra model latency and token cost of each Prompt Guardrails judge call
Test Prompt Guardrails policies with representative allow, block, ambiguous, and adversarial examples before production use

Security:

Store API keys and credentials in environment variables or secrets managers
Regularly rotate credentials
Use least-privilege IAM roles for AWS Bedrock
Use least-privilege Google IAM roles for Google Model Armor, such as roles/modelarmor.user or a higher Model Armor role

Using Guardrails in Requests

Attaching Guardrails to API Calls

Once configured, attach guardrails to your LLM requests using custom headers: Single Guardrail:

curl -X POST http://localhost:8080/v1/chat/completions \
  -H "Content-Type: application/json" \
  -H "x-bf-guardrail-id: bedrock-prod-guardrail" \
  -d '{
    "model": "gpt-4o-mini",
    "messages": [
      {
        "role": "user",
        "content": "Help me with this task"
      }
    ]
  }'

Multiple Guardrails (Sequential):

curl -X POST http://localhost:8080/v1/chat/completions \
  -H "Content-Type: application/json" \
  -H "x-bf-guardrail-ids: bedrock-prod-guardrail,azure-content-safety-001" \
  -d '{
    "model": "gpt-4o-mini",
    "messages": [
      {
        "role": "user",
        "content": "Help me with this task"
      }
    ]
  }'

Guardrail Configuration in Request:

curl -X POST http://localhost:8080/v1/chat/completions \
  -H "Content-Type: application/json" \
  -d '{
    "model": "gpt-4o-mini",
    "messages": [
      {
        "role": "user",
        "content": "Help me with this task"
      }
    ],
    "bifrost_config": {
      "guardrails": {
        "input": ["bedrock-prod-guardrail"],
        "output": ["patronus-ai-001"],
        "async": false
      }
    }
  }'

Guardrail Response Handling

Successful Validation (200):

{
  "id": "chatcmpl-abc123",
  "object": "chat.completion",
  "created": 1699564800,
  "model": "gpt-4o-mini",
  "choices": [
    {
      "index": 0,
      "message": {
        "role": "assistant",
        "content": "I'd be happy to help you with your task..."
      },
      "finish_reason": "stop"
    }
  ],
  "extra_fields": {
    "guardrails": {
      "input_validation": {
        "guardrail_id": "bedrock-prod-guardrail",
        "status": "passed",
        "violations": [],
        "processing_time_ms": 245
      },
      "output_validation": {
        "guardrail_id": "patronus-ai-001",
        "status": "passed",
        "violations": [],
        "processing_time_ms": 312
      }
    }
  }
}

Validation Failure - Blocked (446):

{
  "error": {
    "message": "Request blocked by guardrails",
    "type": "guardrail_violation",
    "code": 446,
    "details": {
      "guardrail_id": "bedrock-prod-guardrail",
      "validation_stage": "input",
      "violations": [
        {
          "type": "PII",
          "category": "SSN",
          "severity": "HIGH",
          "action": "block",
          "text_excerpt": "My SSN is ***-**-****"
        },
        {
          "type": "prompt_injection",
          "severity": "CRITICAL",
          "action": "block",
          "confidence": 0.95
        }
      ],
      "processing_time_ms": 198
    }
  }
}

Validation Warning - Logged (246):

{
  "id": "chatcmpl-def456",
  "object": "chat.completion",
  "created": 1699564800,
  "model": "gpt-4o-mini",
  "choices": [
    {
      "index": 0,
      "message": {
        "role": "assistant",
        "content": "Response with redacted content..."
      },
      "finish_reason": "stop"
    }
  ],
  "bifrost_metadata": {
    "guardrails": {
      "output_validation": {
        "guardrail_id": "azure-content-safety-001",
        "status": "warning",
        "violations": [
          {
            "type": "profanity",
            "severity": "LOW",
            "action": "redact",
            "modifications": 2
          }
        ],
        "processing_time_ms": 187
      }
    }
  }
}

​Overview

​Supported Providers

Secrets Detection

Prompt Guardrails

Custom Regex

Microsoft Presidio

Azure AI Language PII

AWS Bedrock Guardrails

Azure Content Safety

Google Model Armor

CrowdStrike AIDR

Gray Swan Cygnal

Patronus AI

Lakera Guard

Repello Argus

​Core Concepts

​Key Features

​Redaction

​Navigating Guardrails in the UI

​Guardrail Targets

​Architecture

​MCP Guardrails

​Choose Which Tool Calls to Guard

​Streaming Output Guardrails

​Guardrail Rules

​Rule Properties

​Creating Rules

​CEL Expression Examples

​Linking Rules to Profiles

​Managing Profiles

​Profile Properties

​Creating Profiles

​Provider Capabilities

​Best Practices

​Using Guardrails in Requests

​Attaching Guardrails to API Calls

​Guardrail Response Handling

Overview

Supported Providers

Core Concepts

Key Features

Redaction

Navigating Guardrails in the UI

Guardrail Targets

Architecture

MCP Guardrails

Choose Which Tool Calls to Guard

Streaming Output Guardrails

Guardrail Rules

Rule Properties

Creating Rules

CEL Expression Examples

Linking Rules to Profiles

Managing Profiles

Profile Properties

Creating Profiles

Provider Capabilities

Best Practices

Using Guardrails in Requests

Attaching Guardrails to API Calls

Guardrail Response Handling