OmniRoute PII Redaction and Prompt Injection Protection: A Complete Guide to Built-In Guardrails

OmniRoute provides dedicated PII redaction and prompt injection guardrails that run on every request, configurable via feature flags to either sanitize content or block malicious attempts entirely.

OmniRoute implements defense-in-depth security through two specialized guardrails designed to protect sensitive data and prevent adversarial LLM attacks. These guardrails are integrated directly into the request pipeline of the diegosouzapw/OmniRoute routing layer, ensuring protection before any data reaches downstream providers.

How OmniRoute PII Redaction Works

The PII-Masker Guardrail automatically identifies and removes personally identifiable information from both inbound requests and outbound responses.

Activation and Configuration

PII redaction is opt-in via feature flag. The system checks PII_REDACTION_ENABLED (or its database override) before invoking any sanitization logic.

# .env configuration

PII_REDACTION_ENABLED=true
PII_RESPONSE_SANITIZATION_MODE=redact  # "redact" (default) or "block"

When enabled, the request payload flows through processPII in src/shared/utils/inputSanitizer.ts. This utility detects and replaces:

• Email addresses
• CPF numbers (Brazilian tax ID)
• Credit card numbers
• IP addresses
• Additional PII patterns defined in the sanitizer

Streaming Response Protection

For server-sent events (SSE) and streaming responses, OmniRoute applies a sliding-window sanitizer to handle PII that spans chunk boundaries.

In src/lib/streamingPiiTransform.ts, the createPiiSseTransform() function creates a transform stream that wraps src/lib/piiSanitizer.ts. This ensures redaction occurs even when sensitive data is split across multiple response chunks.

import { createPiiSseTransform } from '@/lib/streamingPiiTransform';

const transform = createPiiSseTransform();
await executor.execute(stream => {
  stream.pipe(transform).pipe(res);
});

Operational Modes

Mode	Behavior	Use Case
Redact (default)	Replaces PII with placeholders, forwards request	Standard production deployments
Block	Rejects request containing PII	High-security environments (future policy)

The default redact mode ensures business continuity while preventing data leakage. The block mode remains available for future policy implementations but is not active by default.

OmniRoute Prompt Injection Protection Explained

The Prompt-Injection Guardrail detects adversarial patterns designed to manipulate LLM behavior or extract system prompts.

Detection Architecture

Core detection logic resides in src/lib/guardrails/promptInjection.ts. The system scans combined user and system messages against a curated regular-expression catalog defined in src/shared/utils/injectionSeverity.ts.

Detected patterns include:

• delimiter_injection — attempts to break message boundaries
• system_prompt_leak — prompts designed to expose system instructions
• Custom "injection" tokens identified in the severity registry

Configuration: Warn vs. Block Modes

The INJECTION_GUARD_MODE environment variable controls guardrail behavior:

# .env configuration

INJECTION_GUARD_MODE=warn   # Log and annotate (default)

INJECTION_GUARD_MODE=block  # Reject request with 400 error

Warn mode (default) attaches detection metadata to responses without interrupting service. Block mode halts execution and returns injection_detected error.

Manual Guardrail Invocation

For custom implementations, import the evaluation function directly:

import { evaluatePromptInjection } from '@/lib/guardrails/promptInjection';

const decision = evaluatePromptInjection(messages, { mode: 'warn' });

if (decision.blocked) {
  return new Response('Injection detected', { status: 400 });
}

response.metadata = { ...response.metadata, guardrails: decision };

Guardrail Integration in the Request Pipeline

Both guardrails are registered centrally and executed early in request processing.

Central Registry

src/lib/guardrails/registry.ts instantiates all guardrails at application startup:

• PIIMaskerGuardrail class (implementation in src/lib/guardrails/piiMasker.ts)
• Prompt-injection detector

Middleware Integration

The injection guardrail plugs into Express/Fastify middleware via src/middleware/promptInjectionGuard.ts. Request sanitization occurs through the shared sanitizeRequest utility:

import { sanitizeRequest } from '@/shared/utils/inputSanitizer';

export async function POST(req: Request) {
  const body = await req.json();
  const { sanitizedBody, detections } = await sanitizeRequest(body);
  // `detections` contains redacted elements for audit logging
}

Metadata and Logging

Guardrail decisions are logged through the standard guardrail logger and attached to response metadata under the guardrails key. This enables:

• Audit trail compliance
• Alerting on injection attempts
• Visibility into PII detection rates

Key Implementation Files

File Path	Purpose
src/lib/guardrails/piiMasker.ts	PIIMaskerGuardrail class implementation
src/lib/guardrails/promptInjection.ts	Core injection detection and decision logic
src/lib/guardrails/registry.ts	Central guardrail instantiation and registration
src/shared/utils/inputSanitizer.ts	processPII, sanitizeRequest, and shared utilities
src/lib/piiSanitizer.ts	Streaming-compatible PII redaction engine
src/lib/streamingPiiTransform.ts	SSE transform applying sliding-window sanitization
src/middleware/promptInjectionGuard.ts	Middleware binding injection detection to HTTP pipeline

Summary

• PII redaction is opt-in via PII_REDACTION_ENABLED, operating in redact mode by default with streaming-safe chunk boundary handling.
• Prompt injection protection uses regex-based pattern matching with configurable warn/block responses via INJECTION_GUARD_MODE.
• Both guardrails execute before provider invocation, ensuring malicious or sensitive content never reaches downstream LLMs.
• Metadata logging provides audit trails and operational visibility without impacting latency-critical paths.
• The modular architecture allows programmatic access to sanitization utilities for custom middleware or external integrations.

Frequently Asked Questions

How do I enable PII redaction in OmniRoute?

Set PII_REDACTION_ENABLED=true in your environment variables or database configuration. The guardrail activates automatically on the next request. No code changes are required—the middleware layer handles invocation transparently.

Can OmniRoute block requests containing PII instead of redacting them?

The codebase includes a block mode placeholder via PII_RESPONSE_SANITIZATION_MODE, but the default and recommended configuration uses redact mode. Block mode for PII requires additional policy configuration that is not enabled by default in release v3.8.50.

What happens to PII that spans multiple streaming chunks?

The src/lib/streamingPiiTransform.ts implementation maintains a sliding window buffer that aggregates chunks across boundaries before applying sanitizePIIChunk from src/lib/piiSanitizer.ts. This prevents split PII (e.g., an email address divided across two SSE events) from leaking.

How does prompt injection detection differ from PII redaction?

PII redaction uses pattern matching to identify and replace sensitive data structures (emails, credit cards). Prompt injection detection analyzes semantic attack patterns using severity-scored regexes to identify adversarial intent. Injection detection operates on message content and intent; PII detection operates on data classification regardless of context.

Where are guardrail decisions logged and how can I access them?

Decisions are emitted through OmniRoute's standard guardrail logger and appended to response metadata under response.metadata.guardrails. This structure contains detection type, severity, action taken (warn/block), and matched patterns for both PII and injection events.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}