How to Configure Guardrails for PII Redaction and Prompt Injection Prevention in OmniRoute

TLDR: OmniRoute provides a plug-in guardrail framework configurable via feature flags (PII_REDACTION_ENABLED, INJECTION_GUARD_MODE) and per-request overrides, allowing you to automatically redact PII from request payloads and block or warn on prompt injection attempts before they reach upstream LLMs.

OmniRoute is an open-source AI gateway that ships with a plug-in-style guardrail framework located in src/lib/guardrails/. This system executes during the preCall phase (before sending requests upstream) and postCall phase (after receiving responses), enabling you to configure guardrails for PII redaction and prompt injection prevention through environment variables, database overrides, or request-level headers without modifying core application code.

Understanding the Guardrail Architecture

The guardrail system is built around an abstract BaseGuardrail class defined in src/lib/guardrails/base.ts. Each guardrail implements preCall and postCall hooks that can modify payloads or abort requests entirely. At startup, the application registers built-in guardrails with a GuardrailRegistry (located in src/lib/guardrails/registry.ts), which stores them ordered by priority and executes them sequentially for every request.

Two critical built-in guardrails handle security concerns:

• PII‑Masker: Strips personally identifiable information from request payloads. Implemented in src/lib/guardrails/piiMasker.ts.
• Prompt‑Injection Guard: Detects malicious prompt patterns and can block, warn, or log them. Implemented in src/lib/guardrails/promptInjection.ts.

Enabling PII Redaction

PII redaction is controlled by the feature flag PII_REDACTION_ENABLED, which defaults to false. When enabled, the guardrail runs on every request but only modifies the payload when the flag (or a database override) evaluates to true.

The core check occurs in the isRequestPiiMaskingEnabled function (lines 12‑16 of src/lib/guardrails/piiMasker.ts). If enabled, the guardrail uses sanitizeStringValue to replace sensitive entities with redacted tokens before the request reaches the LLM provider.

Set the feature flag via environment variable:

export PII_REDACTION_ENABLED=true

Or define it in your .env file:

PII_REDACTION_ENABLED=true

Configuring Prompt Injection Prevention

The Prompt‑Injection Guard is enabled when INPUT_SANITIZER_ENABLED is truthy (default true). However, its behavior is determined by the INJECTION_GUARD_MODE feature flag, which accepts warn, block, log, or off (default).

The mode resolution logic lives in src/lib/guardrails/promptInjection.ts within the getMode function (lines 34‑51). This function checks database overrides first, then falls back to environment variables. The isEnabled check (lines 58‑60) determines whether the guardrail should execute at all. When set to block, the guardrail rejects requests that trigger detection thresholds via the shouldBlock logic.

Change the mode to block using a database override:

import { setFeatureFlag } from "@/lib/db/featureFlags";

await setFeatureFlag("INJECTION_GUARD_MODE", "block");

Overriding Guardrails Per Request

You can disable specific guardrails for individual requests without changing global configuration. The GuardrailRegistry.resolveDisabledGuardrails method (lines 74‑101 of src/lib/guardrails/registry.ts) aggregates opt-out instructions from four sources, in order of precedence:

• API key record: apiKeyInfo.disabledGuardrails
• Request body: body.disabledGuardrails
• Request metadata: body.metadata.disabledGuardrails
• HTTP header: x-omniroute-disabled-guardrails (or legacy x-disabled-guardrails)

If a guardrail appears in any of these lists, it is skipped for that request and logged as "skipped" in the execution result.

Disable guardrails via HTTP header:

POST /v1/chat/completions HTTP/1.1
Host: api.omniroute.dev
Content-Type: application/json
x-omniroute-disabled-guardrails: pii-masker, prompt-injection

{
  "model": "gpt-4",
  "messages": [{ "role": "user", "content": "Hello" }]
}

Disable via request payload metadata:

{
  "model": "gpt-4",
  "messages": [{ "role": "user", "content": "Hi" }],
  "metadata": {
    "disabledGuardrails": ["vision-bridge"]
  }
}

Feature Flag Hierarchy

OmniRoute supports a two-tier configuration hierarchy for guardrails:

1. Environment variables – Set via process.env (e.g., PII_REDACTION_ENABLED=true).
2. Database overrides – Stored in src/lib/db/featureFlags.ts and queried via getFeatureFlagOverride.

Database overrides take precedence, allowing operators to change guardrail behavior at runtime without restarting the process. The prompt injection guard explicitly checks the database first in getMode (lines 41‑49 of src/lib/guardrails/promptInjection.ts) before falling back to environment variables.

Implementing Custom Guardrails

You can extend BaseGuardrail to implement domain-specific protections. Custom guardrails follow the same registration and override patterns as built-ins.

import { BaseGuardrail, GuardrailContext, GuardrailResult } from "@/lib/guardrails/base";

class AuditGuardrail extends BaseGuardrail {
  constructor() {
    super("audit-logger", { enabled: true, priority: 15 });
  }

  async preCall(payload: unknown, _ctx: GuardrailContext): Promise<GuardrailResult<unknown>> {
    console.log("Auditing request payload...");
    return { block: false, modifiedPayload: payload };
  }
}

// Register at startup
guardrailRegistry.register(new AuditGuardrail());

Summary

• PII Redaction: Enable by setting PII_REDACTION_ENABLED=true (env or DB); logic resides in src/lib/guardrails/piiMasker.ts.
• Prompt Injection: Control via INJECTION_GUARD_MODE (warn, block, off) in src/lib/guardrails/promptInjection.ts; requires INPUT_SANITIZER_ENABLED=true.
• Runtime Overrides: Database feature flags take precedence over environment variables, allowing hot-swappable security policies.
• Request Exclusions: Disable guardrails per-request using the x-omniroute-disabled-guardrails header or metadata.disabledGuardrails array.

Frequently Asked Questions

What is the default behavior for PII redaction in OmniRoute?

By default, PII_REDACTION_ENABLED is set to false, meaning the PII‑Masker guardrail runs but does not modify request payloads. You must explicitly enable the feature flag via environment variable or database override to activate redaction, as implemented in src/lib/guardrails/piiMasker.ts (lines 12‑16).

Can I disable guardrails for specific API keys?

Yes. Store a disabledGuardrails array in the API key record (apiKeyInfo.disabledGuardrails). The GuardrailRegistry.resolveDisabledGuardrails method (lines 74‑101 of src/lib/guardrails/registry.ts) checks this field during request processing, causing the listed guardrails to be skipped for requests authenticated with that key.

How does the feature flag hierarchy work between environment variables and database settings?

Database overrides always take precedence. The system queries getFeatureFlagOverride from src/lib/db/featureFlags.ts first; if no override exists, it falls back to the corresponding environment variable. This hierarchy is explicitly implemented in the prompt injection guard's getMode function (lines 41‑49 of src/lib/guardrails/promptInjection.ts).

What are the available modes for prompt injection detection?

The INJECTION_GUARD_MODE feature flag supports three modes: block (reject suspicious requests), warn (allow but log), and log (silent logging). The default value is off, which disables the guard entirely except for the underlying INPUT_SANITIZER_ENABLED check defined in src/lib/guardrails/promptInjection.ts.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}