OpenRouter 工作区配备了护栏：一套可配置的安全与治理工具，用于预算执行、零数据留存（ZDR）、模型与提供商限制、提示词注入防御以及数据丢失防护。将这些规则逐层应用到护栏中，以管理整个工作区，或者为团队成员组或 API 密钥创建自定义护栏，所有这些都无需更改你的代码。
前往主页仪表盘中的“工作区 > 护栏”，或使用管理 API 来创建护栏。阅读文档以获取更多详细信息。
预算执行
设置每日、每周或每月的重置周期支出限额。超出该时间段限额的请求将失败并返回 402 响应。用它来限制每个成员或每个密钥的支出，这样单个失控的脚本就不会烧掉整个月的预算。
护栏预算按实体分配，而非共享。为三名团队成员分配一个每日限额 50 美元的护栏，那么每个人都会获得自己独立的 50 美元预算。API 密钥预算在成员预算之上独立叠加。如果 Audrey 的成员限额是每日 100 美元，而她的密钥限额是每日 30 美元，那么该密钥的支出上限为 30 美元，而 Audrey 在工作区中所有密钥的总支出上限为 100 美元。每次请求都会检查这两个限额。
零数据留存（ZDR）与模型/提供商限制
一键禁用所有会留存数据或利用数据进行训练的端点，屏蔽单个模型或提供商，或将工作区限制为模型/提供商白名单。被禁止的请求将失败并返回 404 响应。用它来将流量引导至你已审查过的提供商，远离那些会留存数据或利用输入进行训练的提供商，并确保流量流向每个项目应使用的模型价格层级。
你的账户级隐私策略和提供商限制默认会被继承。护栏只能施加更严格的限制。
提示词注入防御
根据源自 OWASP 大语言模型提示词注入预防速查表及其他资源的 30 多个正则表达式模式对输入进行扫描，以识别提示词注入和越狱尝试。该检测系统包含多种技术，用于捕捉常见的规避策略：拼写错误型、编码型以及字符间隔型规避。它是确定性的，且延迟开销可忽略不计。
检测在请求发送至模型提供商之前执行，因此被拦截的流量永远不会离开 OpenRouter。可用于捕获常见的注入和越狱模式，尤其适用于那些逐字传递用户输入的智能体。
选择检测到模式时希望执行的操作：
- 标记：请求原样通过；检测结果仅用于可观测性记录，不执行任何强制措施。适用于在切换为编辑或拦截之前，评估该检测对您流量的影响。
- 编辑：输入中匹配的部分被替换为 [PROMPT_INJECTION]，然后将经过净化的请求发送给模型。
- 拦截：整个请求在到达模型之前被拒绝，并返回 403 状态码。该 403 响应包含关于检测到的模式类型的元数据。
数据丢失防护（DLP）
检测并处理请求中的个人身份信息（PII）及其他敏感信息。内置七种敏感信息类型。您也可以添加自定义正则表达式模式，用于匹配特定领域的数据（内部项目代号、专有知识产权）。可分别配置为编辑敏感信息或完全拦截请求。被拦截的请求会返回 403 响应，其中包含检测到的内容类型信息。用于防止 PII 和敏感标识符进入供应商日志，并确保符合您的数据处理承诺。
大多数内置模式及所有自定义模式均使用正则表达式匹配。这种方式是确定性的，且对请求增加的延迟可忽略不计。姓名和地址则通过 Presidio 使用自然语言处理（NLP）技术，其延迟与输入大小成正比。
| 内置模式 | 方法 | 编辑为 |
|---|---|---|
| 电子邮件地址 | 正则表达式 | [EMAIL] |
| 电话号码 | 正则表达式 | [PHONE] |
| 社会安全号码 | 正则表达式 | [SSN] |
| 信用卡号 | 正则表达式 | [CREDIT_CARD] |
| IP 地址 | 正则表达式 | [IP_ADDRESS] |
| 人名 | 自然语言处理 | [PERSON_NAME] |
| 地址 | 自然语言处理 | [ADDRESS] |
分配给 API 密钥或组织成员
您可以将一个护栏规则分配给多个 API 密钥或成员。当分配给成员时，该护栏规则将应用于该成员在工作区中的所有密钥。
每个工作区都有一个默认护栏，你可以对其进行配置，该护栏适用于工作区内的所有 API 密钥和成员。你可以创建额外的护栏，以进一步限制特定的 API 密钥或成员。工作区默认护栏设定基线；任何额外的护栏都叠加在其之上。
开始使用护栏
前往主页仪表盘中的“工作区 > 护栏”，配置你的工作区护栏，或为特定的 API 密钥或成员创建护栏。
通过编程方式配置。管理 API 支持所有护栏操作，包括创建、更新、删除、列出以及分配给密钥或成员，因此你可以在团队入职或密钥轮换期间自动完成配置。
curl https://openrouter.ai/api/v1/guardrails \
-H "Authorization: Bearer $OPENROUTER_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"name": "production-safety",
"limit_usd": 100,
"reset_interval": "daily",
"allowed_models": [
"anthropic/claude-sonnet-4.6",
"openai/gpt-5.4",
"google/gemini-3.1-pro-preview"
],
"content_filter_builtins": [
{"slug": "regex-prompt-injection", "action": "block"},
{"slug": "email", "action": "redact"},
{"slug": "credit-card", "action": "block"}
]
}'
OpenRouter workspaces have guardrails: a set of configurable security and governance tools for budget enforcement, zero data retention (ZDR), model and provider restrictions, prompt injection defense, and data loss prevention. Layer each of these rules into a guardrail to govern your entire workspace, or create customized guardrails for team member groups or API keys, all without changing your code.
Go to Workspaces > Guardrails in your home dashboard or use the management API to create guardrails. Read the docs for more detail.
Budget Enforcement
Set spending limits with daily, weekly, or monthly reset windows. Requests that exceed the limit for the time period will fail with a 402 response. Use it to cap spending per member or per key so a single runaway script can’t burn the month’s budget.
Guardrail budgets are per-entity, not shared. Assign a guardrail with a $50/day limit to three team members, and each one gets their own $50 budget. API key budgets layer independently on top of member budgets. If Audrey has a $100/day member limit and her key has a $30/day limit, the key caps at $30 and Audrey’s total across all keys in the workspace caps at $100. Both are checked on every request.
Zero Data Retention (ZDR) and Model/Provider Restrictions
Disable all endpoints that retain or train on data in one-click, block individual models or providers, or restrict the workspace to a model/provider allowlist. Disallowed requests fail with a 404 response. Use it to keep traffic on providers you’ve vetted, off providers that retain or train on inputs, and on the model price tier each project should use.
Your account-wide privacy policies and provider restrictions are inherited by default. Guardrails can only be more restrictive.
Prompt Injection Defense
Scan inputs against a set of >30 regex patterns derived from the OWASP LLM Prompt Injection Prevention Cheat Sheet and other resources to identify prompt injection and jailbreak attempts. The detection system includes techniques to catch common evasion strategies: typoglycemia, encoding-based, and character-spaced evasion. It’s deterministic and latency overhead is negligible.
Detection runs before the request is sent to the model provider, so blocked traffic never leaves OpenRouter. Use it to catch common injection and jailbreak patterns, especially for agents that pass user input verbatim.
Choose the action you want taken when a pattern is detected:
- Flag: The request passes through unmodified; the detection is recorded for observability, but no enforcement is applied. Useful for evaluating the impact on your traffic before switching to redact or block.
- Redact: Matched parts of the input are replaced with
[PROMPT_INJECTION]and the sanitized request is sent to the model. - Block: The entire request is rejected with a
403before it reaches the model. The403response includes metadata about the type of pattern detected.
Data Loss Prevention (DLP)
Detect and handle PII and other sensitive information in requests. Seven sensitive info types are built in. You can also add your own custom regex patterns for domain-specific data (internal project codenames, proprietary IP). Configure each to Redact the sensitive info or Block the request entirely. Blocked requests return a 403 response with information about the type of content detected. Use it to keep PII and sensitive identifiers out of vendor logs and in compliance with your data handling commitments.
Most built-in patterns and all custom patterns use regular expression matching. This is deterministic and adds negligible latency to requests. Names and addresses use Natural Language Processing (NLP) via Presidio and add latency proportional to input size.
| Built-in pattern | Method | Redacted as |
|---|---|---|
| Email address | Regex | [EMAIL] |
| Phone number | Regex | [PHONE] |
| Social Security number | Regex | [SSN] |
| Credit card number | Regex | [CREDIT_CARD] |
| IP address | Regex | [IP_ADDRESS] |
| Person name | NLP | [PERSON_NAME] |
| Address | NLP | [ADDRESS] |
Assign to API keys or org members
You can assign a guardrail to multiple API keys or members. When assigned to members, the guardrail applies to all of their keys in the workspace.
Each workspace has a default guardrail you can configure that applies to every API key and member in the workspace. You can create additional guardrails to further restrict specific API keys or members. The workspace default guardrail sets the baseline; any additional guardrails layer on top.
Start using guardrails
Go to Workspaces > Guardrails in your home dashboard to configure your workspace guardrail or create guardrails for specific API keys or members.
Configure programmatically. The Management API supports every guardrail operation, including create, update, delete, list, and assign to keys or members, so you can automate provisioning during team onboarding or key rotation.
curl https://openrouter.ai/api/v1/guardrails \
-H "Authorization: Bearer $OPENROUTER_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"name": "production-safety",
"limit_usd": 100,
"reset_interval": "daily",
"allowed_models": [
"anthropic/claude-sonnet-4.6",
"openai/gpt-5.4",
"google/gemini-3.1-pro-preview"
],
"content_filter_builtins": [
{"slug": "regex-prompt-injection", "action": "block"},
{"slug": "email", "action": "redact"},
{"slug": "credit-card", "action": "block"}
]
}'