WorkflowsSix guardrail workflows, defined and worked through
Each runs inline, can be shadow-tested before enforcement, and produces audit evidence by default.
Workflow 01
Access control and usage attribution
Every model call carries an identity — application, team and where available the end user — so usage, cost and risk can be attributed instead of arriving as one anonymous provider invoice.
How it runs
- 1Issue scoped gateway keys per application and environment instead of sharing provider keys.
- 2Attach team, application and environment metadata to every request.
- 3Block calls that use a raw provider key bypassing the gateway at the network layer.
- 4Report per-team token usage, cost and model mix weekly.
- 5Revoke or rotate a single key without touching any other consumer.
Example
A scaleup believed three teams used LLMs. Routing traffic through the gateway revealed eleven applications and two contractor scripts calling production models with a shared key — that key was retired within a week.
Workflow 02
PII and secret redaction
Detection and removal of personal data, credentials and internal identifiers from prompts before they leave your perimeter, with the option to rehydrate placeholders in the response.
How it runs
- 1Classify the data allowed for each application and model tier.
- 2Detect emails, phone numbers, national IDs, payment data, API keys and connection strings in the prompt.
- 3Replace matches with reversible placeholders, or block the call outright for the strictest data classes.
- 4Restore placeholders in the response where the application legitimately needs the value.
- 5Log the detection type and count without ever storing the raw sensitive value.
Example
A support-summarization feature was sending full ticket bodies, including customer addresses and card fragments, to a third-party model. Redaction cut personal data leaving the perimeter to zero with no measurable change in summary quality.
Workflow 03
Prompt-injection and jailbreak defence
Detection of attempts to override system instructions, exfiltrate context or escalate tool permissions — including indirect injection hidden in retrieved documents, web pages or user uploads.
How it runs
- 1Separate trusted system instructions from untrusted user and retrieved content at the gateway.
- 2Score incoming content for known injection and jailbreak patterns plus semantic override attempts.
- 3Constrain which tools and functions a given application is allowed to invoke.
- 4Block or downgrade the request when the score exceeds the application's threshold.
- 5Alert the owning team and keep the blocked payload for review.
Example
A RAG assistant indexed customer-uploaded PDFs. One contained hidden text instructing the model to reveal its system prompt and call an internal tool. The injection was scored and blocked at the gateway before it reached the model.
Workflow 04
Output screening and grounding checks
Inspection of the model response before it reaches a user or a downstream system, covering unsafe content, leaked internal data and, for retrieval-based answers, whether the response is supported by the sources provided.
How it runs
- 1Apply per-application content policy to the response.
- 2Scan for internal identifiers, credentials or other-tenant data in the output.
- 3For grounded answers, check claims against the retrieved context and flag unsupported statements.
- 4Block, rewrite or annotate the response according to the application's configured action.
- 5Feed flagged responses into a review queue so policies improve from real cases.
Example
An internal knowledge assistant occasionally quoted salary data pulled in by an over-broad retrieval filter. Output screening caught the pattern and the retrieval scope was corrected before the feature went company-wide.
Workflow 05
Model routing, fallback and budget caps
Policy-based selection of which model serves each request, with automatic failover and hard spending limits per team and application.
How it runs
- 1Define approved models per data class, use case and region.
- 2Route each request to the cheapest compliant model that meets the quality bar for that task.
- 3Fail over to a secondary provider on outage, rate limit or timeout.
- 4Enforce per-team monthly budget caps with alerts at defined thresholds and a hard stop at the ceiling.
- 5Cache repeat requests where the application allows it to remove redundant spend.
Example
Routing classification and extraction tasks to a smaller model, keeping the frontier model for generation, cut a customer's monthly LLM bill 41% while quality scores on the evaluation set stayed flat.
Workflow 06
Audit trail and compliance evidence
An immutable record of every model interaction and policy decision, structured so it can be handed to an auditor, a regulator or a customer security review without a manual reconstruction exercise.
How it runs
- 1Log request metadata, model, policy decisions, tokens, cost and latency for every call.
- 2Store redaction and block events with type and count, never the raw sensitive content.
- 3Maintain a versioned history of policy changes with author and timestamp.
- 4Keep an inventory of AI systems, their purpose, data classes and the models behind them.
- 5Export evidence packs on demand for EU AI Act, ISO/IEC 42001 and customer due-diligence requests.
Example
An enterprise security questionnaire asked which models processed customer data over the previous quarter and how it was protected. The answer came from an exported evidence pack in under a day instead of a two-week internal survey.
