How to enable Guardrails service on AI Gateway-AI Guardrails(AI Guardrails)-阿里云帮助中心

Use cases

Recommended scenarios for AI security risk detection:

Social media content moderation: Automatically identify explicit, violent, illegal, or sensitive information in user-generated content to maintain a safe community environment.
Enterprise customer service filtering: In intelligent chatbot systems, detect inappropriate language in user inputs or bot replies in real time to prevent non-compliant outputs and block phishing links, fraudulent websites, or URLs with malicious scripts in model responses.
Generative AI application protection: Prevent models from producing false, discriminatory, or harmful content in applications for AI-generated content (AIGC), such as AI-powered writing and drawing tools.
Medical or legal consultation: In professional advisory scenarios that demand high accuracy, automatically identify fabricated facts, incorrect data, or unsubstantiated conclusions generated by an LLM.
Government and financial information exchange: In high-compliance environments such as government services or banking, prevent sensitive data leaks and stop the model from generating inaccurate policy interpretations.

Procedure

In the AI Gateway console, go to the Instance page. From the top menu bar, select the region where your target instance is located, and then click the target Instance ID.
In the navigation pane, click Model API, and then click the target API Name to go to the API Details page.
Click Policies And Plugins, enable AI security, and configure its parameters.

Note
Currently, only text and image generation scenarios are supported.

If you have not activated Guardrails, you must first activate Guardrails.
Select a protection service and complete the configuration. We recommend selecting AI Guardrails. Guardrails lets you define a separate mitigation policy for each protection dimension and customized check policies for text and image processing.

Guardrails supports configuring a check policy (including check requests and check responses) and a mitigation policy per consumer. Consumers can be matched by the following rules:

Any consumer: Applies to all consumers.
Exact match: Applies to a specific consumer.
Regex match: Applies to consumers that match a regular expression.
Prefix match: Applies to consumers that start with a specific prefix.

Parameter	Description
Access endpoint	The system automatically populates the Virtual Private Cloud (VPC) endpoint of the nearest Guardrails service. For the list of service endpoints, see Multimodal API Access Guide.
Mitigation policy	Blocks requests or responses that match check rules to prevent non-compliant content from spreading. If you enable Guardrails but do not configure a mitigation policy, a default policy is applied. The default policy sets the protection level to Low for any protection dimension and any consumer. You can define separate mitigation policies for different consumers and protection dimensions. Protection Dimension: Any protection dimension: The policy applies to all protection dimensions. Content compliance detection: Identifies illegal or non-compliant content generated by the LLM. Prompt attack detection: Defends against malicious inputs designed to cause the model to perform unauthorized actions or leak data. Sensitive content detection: Blocks sensitive or high-risk information in the LLM's output. Model hallucination: Detects false or fabricated content. Malicious URL detection: Prevents the model from generating responses that contain malicious links. Protection level: Low: Blocks only high-risk requests. Medium: Blocks medium- and high-risk requests. High: Blocks all requests identified as having risk. Monitor mode: Detects content in requests and responses but does not block them.
Check policy	Inspects user requests and model responses. The system saves results to logs for risk detection, post-event auditing, and application optimization. You can configure Check Requests and Check Responses separately for Text and Image content. Check Request: Inspects user requests to the Model API for violations. You can configure consumer matching rules and the following protection strategies (Service): Note The protection strategy (Service) references configurations in Guardrails. You can go to the Guardrails console to create customized configurations. For more information, see Detection Item Configuration. Text only `query_security_check`: Detects risks related to content compliance, sensitive content, and prompt attacks in LLM inputs. Image only `img_query_security_check`: Detects content compliance risks in input images sent to the LLM. Check Response: Inspects LLM responses for compliance. When enabled, streaming responses are converted to non-streaming responses. You can configure consumer matching rules and the following protection strategies (Service): Text only `response_security_check`: Detects risks related to content compliance, sensitive content, and abnormal outputs caused by prompt attacks in LLM-generated content. `response_security_check_hp`: Optimized for streaming response detection with lower latency. Detects risks related to content compliance, sensitive content, and abnormal outputs caused by prompt attacks in LLM-generated content. Image only `img_response_security_check`: Detects content compliance risks in output images generated by the LLM.

Guardrails activation rules

If Guardrails is enabled but no check policy or mitigation policy is configured, the AI Security Protection feature does not activate.
If Guardrails and a mitigation policy are configured but no check policy is enabled, the AI Security Protection feature does not activate.
If Guardrails and a check policy are enabled but no mitigation policy is configured, AI Security Protection activates with a default configuration: the protection level is set to Low for any protection dimension and any consumer.
If Guardrails, a check policy, and a mitigation policy are all configured, AI Security Protection inspects user requests and model responses based on your configuration, saves results to logs, and blocks content that triggers the mitigation policy.

Note
If the protection dimensions configured in a mitigation policy are not included in the configured check policy, that mitigation policy does not take effect. For example:

If your check policy is enabled for content compliance and sensitive content, but your mitigation policy is enabled for prompt attack detection, the mitigation policy is not activated.
When a check policy is enabled without advanced configuration, the following default rules apply:
- Text only
  - Check Request: Consumer is set to 'Any consumer', and Service is set to query_security_check.
  - Check Response: Consumer is set to 'Any consumer', and Service is set to response_security_check.
- Image only
  - Check Request: Consumer is set to 'Any consumer', and Service is set to img_query_security_check.
  - Check Response: Consumer is set to 'Any consumer', and Service is set to img_response_security_check.
When configuration rules conflict, the following precedence applies:
- Rules for a specific consumer take precedence over rules for 'Any consumer'. For example, if you configure a high protection level for consumers with the prefix 'AI' and a low protection level for 'Any consumer', the rule for the 'AI' prefix is executed first for those consumers.
- If a consumer matches multiple rules, the rule that appears first in the list takes precedence. For example, if one rule sets a Medium protection level for 'Any protection dimension' for all consumers with the prefix 'AI', and a second, lower-ranked rule sets a High protection level for 'model hallucination' for the specific consumer 'AI-TEST', 'AI-TEST' matches both rules. Because the 'Any protection dimension' rule ranks higher and includes 'model hallucination', the second rule does not take effect.

Configuration examples

The following examples show how to configure Guardrails for common use cases.

Protect all requests and block only high-risk ones
- Check policy: Enable Check Requests for both Text only and Image only.
- Mitigation policy: Add a mitigation policy. Set Consumer to 'Any consumer', protection dimension to 'Any protection dimension', and protection level to 'Low'.
Block only requests that involve sensitive content and compliance risks
- Check policy: Enable Check Requests for both Text only and Image only.
- Mitigation policy: Add two mitigation policies. Set the Consumer as needed. For protection dimension, select 'Content compliance detection' and 'Sensitive content detection' respectively. Set the protection level as needed.
Protect all requests, but block risks only for a key business (consumer name 'AIBusiness'), while monitoring all others
- Check policy: Enable Check Requests for both Text only and Image only.
- Mitigation policy: Add one mitigation policy. Set the Consumer to 'Exact match' and select 'AIBusiness'. Set the protection dimension and protection level as needed.
For OpenAI-compatible scenarios (for example, completions), check both text and images for compliance risks
- Check policy: Enable both Check Requests and Check Responses for Text only and Image only.
- Use the default mitigation policy.
For text protection, apply different checks for key businesses (consumer names 'AIBusiness' and 'AIFinancial') versus standard businesses (consumer name 'Common')
- In the Guardrails console, duplicate the query_security_check service twice. Name the copies query_security_check_major and query_security_check_common. For query_security_check_major, enable the Content compliance, Sensitive content, and Prompt Injection Attack protection dimensions. For query_security_check_common, enable only the Content compliance protection dimension.
  - Check policy: Enable Check Requests for Text only.
  - In the check policy, open Advanced Configuration and add two rules. For the first rule, set the consumer to 'Prefix match' with the value AI, and select the query_security_check_major Service. For the second rule, set the consumer to 'Exact match', select 'Common', and select the query_security_check_common Service.
  - Use the default mitigation policy.