Guardrails

A guardrail is a named regex rule with an action. Routeplane scans request prompts on the way in and response streams on the way out; when a rule matches, it either blocks the request (or aborts the stream) or redacts the matched span. Enforcement happens inside the router, on the proxy hop. No extra model call, no external service.

There are no built-in classifiers: no PII detector, toxicity model, or content categories. A guardrail does exactly what its regex says, so you bring the patterns that matter for your workload.

Configure

Rules live under custom_patterns in the plugin’s config. Each rule has a name, a pattern (a Rust regex), and an action:

plugins:
  routeplane-guardrails:
    custom_patterns:
      - name: ssn
        pattern: '\d{3}-\d{2}-\d{4}'
        action: redact
      - name: provider-key
        pattern: 'sk-[a-zA-Z0-9]+'
        # action omitted → defaults to block

Patterns are compiled when the router loads its config — an invalid regex fails fast at startup rather than at request time.

Two actions

Action	On a match
block (default)	Deny the request, or abort the response stream, naming the rule that fired. The default when action is omitted: block is the safe fallback.
redact	Replace the matched span with [REDACTED] and let the content through.

Request vs response

The two sides are deliberately asymmetric:

• Request (inbound). Only block rules apply: a prompt is allowed or denied, not rewritten. The scan covers the system instruction, every message’s text and reasoning, tool-result output, and tool-call arguments. Binary parts (images, audio, documents) and citation sources carry no scannable text and are skipped.
• Response (outbound, streaming). redact rules swap matches for [REDACTED] as the stream flows; a block match aborts the stream. Streaming is never stalled. Each delta is emitted in its own turn.

**Block is checked across streaming chunks; redact is per-chunk.** A `block` pattern split across two streamed deltas is still caught (a short trailing window is kept for detection). A `redact` pattern split *exactly* across a delta boundary is a known gap. Block, the security-critical action, is the one guaranteed to span boundaries.

On Cloud

Everything above runs in the local binary off your config file. There is no Routeplane Cloud. It was never built, the cloud surface was removed from the binary, and nothing hosted is planned. The config file is the only place these rules live.