ai-prompt-guard

Allows or denies prompts that match configured patterns.

Category AIAdd it to Route, Service, Consumer, Consumer group, Global rule, Plugin configEngine plugin ai-prompt-guardPriority 1072

What it does

ai-prompt-guard reads the prompt of a chat request on a route against regular expressions before the request goes on. A prompt that matches one of the Deny patterns is answered 400 with Request contains prohibited content and goes no further.

A prompt that matches none passes unchanged and is answered by what stands behind the route. Unless you change Match all conversation history, only the last message of the conversation is read.

When to use it

• A support assistant where customers paste card numbers, kept from passing them on to the model.
• Prompts that try to override your instructions, for example ones that ask the model to ignore all previous instructions.
• Words your company never sends to an outside provider, for example the names of internal projects.

Not for checking the shape of a JSON body against a schema — see request-validation (Validates request headers and body against a JSON Schema) or adding your own instructions to the prompt — see ai-prompt-decorator (Prepends or appends messages to the prompt sent to the LLM).

Guides

Pages that walk through a job with ai-prompt-guard, step by step.

• Put a language model behind the gatewaySend your apps' chat requests to one language model through a route, with the model's key on the gateway, a token budget, a prompt guard and a cache.

Set it up

Refuse prompts that carry a card number or try to override the instructions

Only the last message of the conversation is read, whatever its role; the card pattern takes 16 digits with or without spaces or dashes between them, and the override pattern takes Ignore and ignore.

Fill Deny patterns as in the JSON below and turn on Match all roles.

ai-prompt-guard · as the console saves it

{
  "deny_patterns": [
    "\\b(?:\\d[ -]?){15}\\d\\b",
    "[Ii]gnore (all )?previous instructions"
  ],
  "match_all_roles": true
}

What you will see

• A prompt that tells the model to ignore its instructions is answered 400 with Request contains prohibited content; the model never sees it.
• A prompt carrying a card number written with spaces is answered 400 with the same message.
• A card number written with dashes is refused the same way, 400.
• A prompt that only names an order number is passed to the model and answered 200.

Things to know

• Deny patterns — In the example a card number of 16 digits is refused with spaces or dashes between the groups, 4111 1111 1111 1111 and 4111-1111-1111-1111 alike. A question about order 4471 passes and is answered 200.
• Deny patterns — A prompt that asks the model to Ignore all previous instructions is refused by the second pattern of the example, with 400.
• Deny patterns — A pattern that is empty is stored and matches every request, so one empty row here refuses all of them.
• Allow patterns — Every pattern here and in Deny patterns is compiled when you save, and one that does not compile is refused by name.
• Fail mode — A request with no body is refused with 400 whatever this says, and only an unreadable body is left to this setting.
• AdviceTry a new pattern against a few real prompts, ones it must refuse and ones it must let through, before you add it to a busy route.

Settings

The fields as the console shows them, section by section.

Deny patternsdeny_patternsarray of stringsdefault []

Regular expressions that refuse a request whose prompt matches one of them, such as password.

Allow patternsallow_patternsarray of stringsdefault []

Match all rolesmatch_all_rolesbooleandefault false

Off, only the messages the user sent are read, and what the model answered is never matched.

Match all conversation historymatch_all_conversation_historybooleandefault false

Off, only the last message of the conversation is read — except in a Responses-API body, where every input item is read whatever this says.

Fail modefail_modestringdefault skip

What to do with a body the plugin cannot read as an AI request: skip lets it through, warn also logs it, and error refuses it with 400.

one of error, skip, warn

Request body limitmax_req_body_sizeintegerdefault 67108864

The largest request body in bytes that is read, where a larger one is refused with 400.

at least 1

Every plugin also has Enabled, Priority, Filter, Error response and Pre-function: see Plugin execution settings.