Skip to main content

Guardrails

Guardrails validate and shape the payloads flowing through the AI Gateway: MCP tool calls, resources and prompts, the HTTP APIs the MCP Gateway proxies as MCP tools, and the prompts and replies that pass through the LLM Gateway. Rather than a bespoke filtering layer, Guardrails reuse the same catalog and model primitives Zilla already uses to govern Kafka message data in Kafka Gateway's data governance.

  • Validate rejects a payload that doesn't conform to a schema or type, before it reaches an agent or an upstream server.
  • Classify rejects a payload that contains sensitive content, such as a secret, personal data, or a jailbreak attempt, detected by pattern, by a Presidio analyzer, or by meaning.
  • LLM Guardrails apply validating and classifying models to each section of an LLM prompt or reply, per model, on the LLM Gateway.
  • Transform changes a payload's representation, so an agent and an upstream don't have to agree on the same wire format.

Validate builds on two resources:

  • Schema Registry defines where a schema lives: embedded in zilla.yaml, read from the local filesystem, or fetched from a remote schema registry.
  • Schema Enforcement defines the type or schema a payload is checked against, from primitives like string and int32 to schema-backed formats like avro, json, and protobuf.

Guardrails apply directly on AI-Gateway-specific bindings, not only illustratively through the http binding:

  • The mcp proxy binding's options.tools validates tools/call request arguments against a model.
  • The mcp-http proxy binding's options.tools.<name>.schemas.input/schemas.output validate and convert a tool's arguments and the upstream HTTP response, each bound to a model and catalog.
  • The llm proxy binding's options.guardrails checks sections of LLM prompts and replies, for each model, with any model, including classify.

See Validate and Transform for the exact configuration on each.

Next Steps

  • Validate walks through rejecting a malformed tool call or upstream response.
  • Classify covers the classifiers that detect secrets, personal data, and content by meaning.
  • LLM Guardrails walks through checking LLM prompts and replies.
  • Transform walks through transforming a payload between wire and view formats.