# How to Configure Guardrails for PII Redaction and Prompt Injection Prevention in OmniRoute

> Configure OmniRoute guardrails for PII redaction and prompt injection prevention using feature flags and request overrides. Protect your LLMs from sensitive data leaks and malicious inputs.

- Repository: [Diego Rodrigues de Sa e Souza/OmniRoute](https://github.com/diegosouzapw/OmniRoute)
- Tags: how-to-guide
- Published: 2026-07-26

---

**TLDR:** OmniRoute provides a plug-in guardrail framework configurable via feature flags (`PII_REDACTION_ENABLED`, `INJECTION_GUARD_MODE`) and per-request overrides, allowing you to automatically redact PII from request payloads and block or warn on prompt injection attempts before they reach upstream LLMs.

OmniRoute is an open-source AI gateway that ships with a **plug-in-style guardrail framework** located in `src/lib/guardrails/`. This system executes during the `preCall` phase (before sending requests upstream) and `postCall` phase (after receiving responses), enabling you to configure guardrails for PII redaction and prompt injection prevention through environment variables, database overrides, or request-level headers without modifying core application code.

## Understanding the Guardrail Architecture

The guardrail system is built around an abstract `BaseGuardrail` class defined in [`src/lib/guardrails/base.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/base.ts). Each guardrail implements `preCall` and `postCall` hooks that can modify payloads or abort requests entirely. At startup, the application registers built-in guardrails with a `GuardrailRegistry` (located in [`src/lib/guardrails/registry.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/registry.ts)), which stores them ordered by `priority` and executes them sequentially for every request.

Two critical built-in guardrails handle security concerns:

- **PII‑Masker**: Strips personally identifiable information from request payloads. Implemented in [`src/lib/guardrails/piiMasker.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/piiMasker.ts).
- **Prompt‑Injection Guard**: Detects malicious prompt patterns and can block, warn, or log them. Implemented in [`src/lib/guardrails/promptInjection.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/promptInjection.ts).

## Enabling PII Redaction

PII redaction is controlled by the feature flag **`PII_REDACTION_ENABLED`**, which defaults to `false`. When enabled, the guardrail runs on every request but only modifies the payload when the flag (or a database override) evaluates to `true`.

The core check occurs in the `isRequestPiiMaskingEnabled` function (lines 12‑16 of [`src/lib/guardrails/piiMasker.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/piiMasker.ts)). If enabled, the guardrail uses `sanitizeStringValue` to replace sensitive entities with redacted tokens before the request reaches the LLM provider.

Set the feature flag via environment variable:

```bash
export PII_REDACTION_ENABLED=true

```

Or define it in your `.env` file:

```bash
PII_REDACTION_ENABLED=true

```

## Configuring Prompt Injection Prevention

The Prompt‑Injection Guard is enabled when **`INPUT_SANITIZER_ENABLED`** is truthy (default `true`). However, its behavior is determined by the **`INJECTION_GUARD_MODE`** feature flag, which accepts `warn`, `block`, `log`, or `off` (default).

The mode resolution logic lives in [`src/lib/guardrails/promptInjection.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/promptInjection.ts) within the `getMode` function (lines 34‑51). This function checks database overrides first, then falls back to environment variables. The `isEnabled` check (lines 58‑60) determines whether the guardrail should execute at all. When set to `block`, the guardrail rejects requests that trigger detection thresholds via the `shouldBlock` logic.

Change the mode to `block` using a database override:

```ts
import { setFeatureFlag } from "@/lib/db/featureFlags";

await setFeatureFlag("INJECTION_GUARD_MODE", "block");

```

## Overriding Guardrails Per Request

You can disable specific guardrails for individual requests without changing global configuration. The `GuardrailRegistry.resolveDisabledGuardrails` method (lines 74‑101 of [`src/lib/guardrails/registry.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/registry.ts)) aggregates opt-out instructions from four sources, in order of precedence:

- **API key record**: `apiKeyInfo.disabledGuardrails`
- **Request body**: `body.disabledGuardrails`
- **Request metadata**: `body.metadata.disabledGuardrails`
- **HTTP header**: `x-omniroute-disabled-guardrails` (or legacy `x-disabled-guardrails`)

If a guardrail appears in any of these lists, it is skipped for that request and logged as "skipped" in the execution result.

Disable guardrails via HTTP header:

```http
POST /v1/chat/completions HTTP/1.1
Host: api.omniroute.dev
Content-Type: application/json
x-omniroute-disabled-guardrails: pii-masker, prompt-injection

{
  "model": "gpt-4",
  "messages": [{ "role": "user", "content": "Hello" }]
}

```

Disable via request payload metadata:

```json
{
  "model": "gpt-4",
  "messages": [{ "role": "user", "content": "Hi" }],
  "metadata": {
    "disabledGuardrails": ["vision-bridge"]
  }
}

```

## Feature Flag Hierarchy

OmniRoute supports a two-tier configuration hierarchy for guardrails:

1. **Environment variables** – Set via `process.env` (e.g., `PII_REDACTION_ENABLED=true`).
2. **Database overrides** – Stored in [`src/lib/db/featureFlags.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/db/featureFlags.ts) and queried via `getFeatureFlagOverride`.

Database overrides take precedence, allowing operators to change guardrail behavior at runtime without restarting the process. The prompt injection guard explicitly checks the database first in `getMode` (lines 41‑49 of [`src/lib/guardrails/promptInjection.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/promptInjection.ts)) before falling back to environment variables.

## Implementing Custom Guardrails

You can extend `BaseGuardrail` to implement domain-specific protections. Custom guardrails follow the same registration and override patterns as built-ins.

```ts
import { BaseGuardrail, GuardrailContext, GuardrailResult } from "@/lib/guardrails/base";

class AuditGuardrail extends BaseGuardrail {
  constructor() {
    super("audit-logger", { enabled: true, priority: 15 });
  }

  async preCall(payload: unknown, _ctx: GuardrailContext): Promise<GuardrailResult<unknown>> {
    console.log("Auditing request payload...");
    return { block: false, modifiedPayload: payload };
  }
}

// Register at startup
guardrailRegistry.register(new AuditGuardrail());

```

## Summary

- **PII Redaction**: Enable by setting `PII_REDACTION_ENABLED=true` (env or DB); logic resides in [`src/lib/guardrails/piiMasker.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/piiMasker.ts).
- **Prompt Injection**: Control via `INJECTION_GUARD_MODE` (`warn`, `block`, `off`) in [`src/lib/guardrails/promptInjection.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/promptInjection.ts); requires `INPUT_SANITIZER_ENABLED=true`.
- **Runtime Overrides**: Database feature flags take precedence over environment variables, allowing hot-swappable security policies.
- **Request Exclusions**: Disable guardrails per-request using the `x-omniroute-disabled-guardrails` header or `metadata.disabledGuardrails` array.

## Frequently Asked Questions

### What is the default behavior for PII redaction in OmniRoute?

By default, `PII_REDACTION_ENABLED` is set to `false`, meaning the PII‑Masker guardrail runs but does not modify request payloads. You must explicitly enable the feature flag via environment variable or database override to activate redaction, as implemented in [`src/lib/guardrails/piiMasker.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/piiMasker.ts) (lines 12‑16).

### Can I disable guardrails for specific API keys?

Yes. Store a `disabledGuardrails` array in the API key record (`apiKeyInfo.disabledGuardrails`). The `GuardrailRegistry.resolveDisabledGuardrails` method (lines 74‑101 of [`src/lib/guardrails/registry.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/registry.ts)) checks this field during request processing, causing the listed guardrails to be skipped for requests authenticated with that key.

### How does the feature flag hierarchy work between environment variables and database settings?

Database overrides always take precedence. The system queries `getFeatureFlagOverride` from [`src/lib/db/featureFlags.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/db/featureFlags.ts) first; if no override exists, it falls back to the corresponding environment variable. This hierarchy is explicitly implemented in the prompt injection guard's `getMode` function (lines 41‑49 of [`src/lib/guardrails/promptInjection.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/promptInjection.ts)).

### What are the available modes for prompt injection detection?

The `INJECTION_GUARD_MODE` feature flag supports three modes: **`block`** (reject suspicious requests), **`warn`** (allow but log), and **`log`** (silent logging). The default value is **`off`**, which disables the guard entirely except for the underlying `INPUT_SANITIZER_ENABLED` check defined in [`src/lib/guardrails/promptInjection.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/promptInjection.ts).