OpenRouter 工作区现已提供护栏功能：这是一套可配置的安全与治理工具，涵盖预算管控、零数据留存（ZDR）、模型与提供商限制、提示词注入防御以及数据防泄漏。您可以将这些规则逐层叠加到护栏中，用于治理整个工作区，也可以为团队成员分组或 API 密钥创建定制化的护栏，全程无需修改代码。
前往首页仪表盘的“工作区 > 护栏”页面，或使用管理 API 来创建护栏。详情请参阅文档。
预算管控
设置按日、按周或按月重置的消费限额。超出该时段限额的请求将失败并返回 402 响应。可用于限制每个成员或每个密钥的消费上限，防止单个失控脚本烧掉整月预算。
护栏预算按实体独立计算，不共享。如果给三位团队成员分配了同一个每日 50 美元的护栏，那么每人各自拥有 50 美元的独立预算。API 密钥的预算在成员预算之上独立叠加。如果 Audrey 的成员限额是每日 100 美元，而她的密钥限额是每日 30 美元，那么该密钥上限为 30 美元，同时 Audrey 在工作区内所有密钥的总消费上限为 100 美元。每次请求都会同时检查这两项限额。
零数据留存（ZDR）与模型/提供商限制
一键禁用所有会留存数据或利用数据进行训练的端点，屏蔽单个模型或提供商，或将工作区限制为仅允许使用指定的模型/提供商白名单。被禁止的请求将返回 404 响应。可用于确保流量只流向您已审核过的提供商，避开那些会留存或利用输入数据进行训练的提供商，并让流量使用每个项目应采用的模型价格层级。
您账户级别的全局隐私策略和提供商限制默认会被继承。护栏只能在此基础上设置更严格的限制。
提示词注入防御
根据 OWASP 大语言模型提示词注入防护速查表及其他来源，将输入与超过 30 个正则表达式模式进行比对扫描，以识别提示词注入和越狱尝试。该检测系统包含捕捉常见规避策略的技术：字形混淆、基于编码的规避以及字符间隔规避。该检测是确定性的，且延迟开销可忽略不计。
检测在请求发送至模型提供商之前运行，因此被拦截的流量永远不会离开 OpenRouter。用于捕捉常见的注入和越狱模式，尤其适用于那些逐字传递用户输入的智能体。
选择检测到模式时希望执行的操作：
- 标记：请求原样通过；检测结果记录用于可观测性，但不执行任何强制措施。适用于在切换为编辑或拦截之前，评估对自身流量的影响。
- 编辑：输入中匹配的部分被替换为 [PROMPT_INJECTION]，然后将清理后的请求发送至模型。
- 拦截：整个请求在到达模型之前被拒绝，并返回 403 状态码。该 403 响应包含关于检测到的模式类型的元数据。
数据丢失防护（DLP）
检测并处理请求中的个人身份信息（PII）及其他敏感信息。内置七种敏感信息类型。您也可以添加自定义正则表达式模式，用于匹配特定领域的数据（内部项目代号、专有知识产权）。可分别配置为编辑敏感信息或完全拦截请求。被拦截的请求会返回 403 响应，其中包含检测到的内容类型信息。用于防止个人身份信息和敏感标识符进入供应商日志，并确保符合您的数据处理承诺。
大多数内置模式及所有自定义模式均使用正则表达式匹配。此过程是确定性的，且对请求增加的延迟可忽略不计。姓名和地址通过 Presidio 使用自然语言处理（NLP）技术，其增加的延迟与输入大小成正比。
| 内置模式 | 方法 | 编辑为 |
|---|---|---|
| 电子邮件地址 | 正则表达式 | [EMAIL] |
| 电话号码 | 正则表达式 | [PHONE] |
| 社会安全号码 | 正则表达式 | [SSN] |
| 信用卡号 | 正则表达式 | [CREDIT_CARD] |
| IP 地址 | 正则表达式 | [IP_ADDRESS] |
| 人名 | 自然语言处理 | [PERSON_NAME] |
| 地址 | 自然语言处理 | [ADDRESS] |
分配给 API 密钥或组织成员
你可以将护栏规则分配给多个 API 密钥或成员。当分配给成员时，该护栏规则将应用于该成员在工作区中的所有密钥。
每个工作区都有一个可配置的默认护栏规则，适用于工作区内的所有 API 密钥和成员。你可以创建额外的护栏规则，进一步限制特定的 API 密钥或成员。工作区默认护栏规则设定基线；任何额外的护栏规则都在此基础上叠加。
开始使用护栏规则
前往主控制面板中的“工作区 > 护栏规则”，配置你的工作区护栏规则，或为特定的 API 密钥或成员创建护栏规则。
通过编程方式配置。管理 API 支持所有护栏规则操作，包括创建、更新、删除、列出以及分配给密钥或成员，因此你可以在团队入职或密钥轮换期间自动完成配置。
curl https://openrouter.ai/api/v1/guardrails \
-H "Authorization: Bearer $OPENROUTER_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"name": "production-safety",
"limit_usd": 100,
"reset_interval": "daily",
"allowed_models": [
"anthropic/claude-sonnet-4.6",
"openai/gpt-5.4",
"google/gemini-3.1-pro-preview"
],
"content_filter_builtins": [
{"slug": "regex-prompt-injection", "action": "block"},
{"slug": "email", "action": "redact"},
{"slug": "credit-card", "action": "block"}
]
}'- Budget Enforcement
- Zero Data Retention (ZDR) and Model/Provider Restrictions
- Prompt Injection Defense
- Data Loss Prevention (DLP)
- Assign to API keys or org members
- Start using guardrails
OpenRouter workspaces have guardrails: a set of configurable security and governance tools for budget enforcement, zero data retention (ZDR), model and provider restrictions, prompt injection defense, and data loss prevention. Layer each of these rules into a guardrail to govern your entire workspace, or create customized guardrails for team member groups or API keys, all without changing your code.
Go to Workspaces > Guardrails in your home dashboard or use the management API to create guardrails. Read the docs for more detail.
Budget Enforcement
Set spending limits with daily, weekly, or monthly reset windows. Requests that exceed the limit for the time period will fail with a 402 response. Use it to cap spending per member or per key so a single runaway script can’t burn the month’s budget.
Guardrail budgets are per-entity, not shared. Assign a guardrail with a $50/day limit to three team members, and each one gets their own $50 budget. API key budgets layer independently on top of member budgets. If Audrey has a $100/day member limit and her key has a $30/day limit, the key caps at $30 and Audrey’s total across all keys in the workspace caps at $100. Both are checked on every request.
Zero Data Retention (ZDR) and Model/Provider Restrictions
Disable all endpoints that retain or train on data in one-click, block individual models or providers, or restrict the workspace to a model/provider allowlist. Disallowed requests fail with a 404 response. Use it to keep traffic on providers you’ve vetted, off providers that retain or train on inputs, and on the model price tier each project should use.
Your account-wide privacy policies and provider restrictions are inherited by default. Guardrails can only be more restrictive.
Prompt Injection Defense
Scan inputs against a set of >30 regex patterns derived from the OWASP LLM Prompt Injection Prevention Cheat Sheet and other resources to identify prompt injection and jailbreak attempts. The detection system includes techniques to catch common evasion strategies: typoglycemia, encoding-based, and character-spaced evasion. It’s deterministic and latency overhead is negligible.
Detection runs before the request is sent to the model provider, so blocked traffic never leaves OpenRouter. Use it to catch common injection and jailbreak patterns, especially for agents that pass user input verbatim.
Choose the action you want taken when a pattern is detected:
- Flag: The request passes through unmodified; the detection is recorded for observability, but no enforcement is applied. Useful for evaluating the impact on your traffic before switching to redact or block.
- Redact: Matched parts of the input are replaced with
[PROMPT_INJECTION]and the sanitized request is sent to the model. - Block: The entire request is rejected with a
403before it reaches the model. The403response includes metadata about the type of pattern detected.
Data Loss Prevention (DLP)
Detect and handle PII and other sensitive information in requests. Seven sensitive info types are built in. You can also add your own custom regex patterns for domain-specific data (internal project codenames, proprietary IP). Configure each to Redact the sensitive info or Block the request entirely. Blocked requests return a 403 response with information about the type of content detected. Use it to keep PII and sensitive identifiers out of vendor logs and in compliance with your data handling commitments.
Most built-in patterns and all custom patterns use regular expression matching. This is deterministic and adds negligible latency to requests. Names and addresses use Natural Language Processing (NLP) via Presidio and add latency proportional to input size.
| Built-in pattern | Method | Redacted as |
|---|---|---|
| Email address | Regex | [EMAIL] |
| Phone number | Regex | [PHONE] |
| Social Security number | Regex | [SSN] |
| Credit card number | Regex | [CREDIT_CARD] |
| IP address | Regex | [IP_ADDRESS] |
| Person name | NLP | [PERSON_NAME] |
| Address | NLP | [ADDRESS] |
Assign to API keys or org members
You can assign a guardrail to multiple API keys or members. When assigned to members, the guardrail applies to all of their keys in the workspace.
Each workspace has a default guardrail you can configure that applies to every API key and member in the workspace. You can create additional guardrails to further restrict specific API keys or members. The workspace default guardrail sets the baseline; any additional guardrails layer on top.
Start using guardrails
Go to Workspaces > Guardrails in your home dashboard to configure your workspace guardrail or create guardrails for specific API keys or members.
Configure programmatically. The Management API supports every guardrail operation, including create, update, delete, list, and assign to keys or members, so you can automate provisioning during team onboarding or key rotation.
curl https://openrouter.ai/api/v1/guardrails \
-H "Authorization: Bearer $OPENROUTER_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"name": "production-safety",
"limit_usd": 100,
"reset_interval": "daily",
"allowed_models": [
"anthropic/claude-sonnet-4.6",
"openai/gpt-5.4",
"google/gemini-3.1-pro-preview"
],
"content_filter_builtins": [
{"slug": "regex-prompt-injection", "action": "block"},
{"slug": "email", "action": "redact"},
{"slug": "credit-card", "action": "block"}
]
}'