Docs · Policy profiles

A policy profile tells the gateway what to do before a request reaches the model and after the model answers. Profiles live in your workspace, are versioned, and attach to API keys. The Policies page edits them; the overview has a sandbox to try them on sample text.

Schema

code

{
  "description": "Redact PII on the way in; block PII on the way out",
  "input": {
    "pii": "redact",              // off | flag | redact
    "classifiers": ["toxicity"],  // ids registered on the gateway
    "on_match": "flag",           // block | flag | annotate
    "max_chars": 200000           // optional hard cap on request text
  },
  "output": {
    "classifiers": ["pii"],
    "on_match": "block",
    "buffer_tokens": 64           // hold-back before the first streamed token
  },
  "system_prompt": {
    "prepend": "You are a strict grader.",
    "pin": true                   // demote client system messages to user
  },
  "retention": "none"             // fixed
}

Stages and actions

Action	Effect
`block`	Input: the model is never called, `400 policy_blocked`. Output: the completion is discarded (or the stream never starts if inside the hold-back window).
`flag`	The request proceeds; the decision code reads `flag=<ids>` so you can route or review.
`annotate`	Proceeds; labels appear as `note=<ids>`.

Redaction is remediation, not a violation: pii: redact rewrites the text and reports redacted=N without triggering on_match. Use pii: flag if PII itself should count.

Versions

Saving a profile creates a new version. A key follows the latest version of its profile by default, and picks up a new version within 30 seconds. Pin a version per request with X-Unrefused-Policy: name@v12.

Platform baseline

An operator-defined baseline runs before and after every profile and cannot be disabled by one. It enforces size limits and the Acceptable Use Policy. A baseline block returns platform_policy.

Classifiers

The built-in pii classifier detects and redacts emails, phone numbers, card numbers (Luhn-checked), IBANs and SSNs in-process. External classifiers are HTTP services registered on the gateway and referenced by id:

code

POST https://classifier.internal/toxicity
{ "text": "…", "stage": "input" }

→ { "matched": true, "score": 0.93, "labels": ["harassment"] }

Each classifier has a timeout and a fail mode: open (annotate error=<id> and continue) or closed (block). The policy editor rejects a profile that references a classifier this deployment does not have.