Relay docs

Guardrails & moderation

Relay includes lightweight, deterministic (BCL-only) safety features you can turn on without any external service.

#PII redaction

Guardrails.RedactPii masks obvious personal data — e-mail addresses, phone numbers, and long card-like digit runs — before text is sent upstream. It is applied in several places:

  • Per agent (the Redact PII option): the user's messages, retrieved knowledge-base context and attached-file text on chat runs, and retrieved passages in a realtime voice session.
  • Captured trace bodies, when the workspace's observability setting Redact PII is on (the default), so stored prompts and completions never carry raw identifiers.
  • Workflows, through the Redact PII node.

Use it for agents that touch customer data but shouldn't leak raw identifiers to the model provider. Turn it off on a dataset agent: a redacted question cannot be turned into a query.

#Content moderation

ContentModerator is a rule-based moderator plus prompt-injection / jailbreak detection, using deterministic keyword and pattern heuristics. Control it with config:

  • Gateway:Moderation:Enabled (default false) — turn moderation on.
  • Gateway:Moderation:Block (default true) — block flagged content vs. just flag it.
  • Gateway:Moderation:FlagJailbreak (default true) — detect prompt-injection / jailbreak attempts.

When enabled, the request is screened before routing, and the reply of a non-streaming call is screened before it is returned (streamed output is not screened, since it has already left). With Block on, either is refused with 400 content_flagged — a blocked reply was still generated upstream, so its usage is billed and recorded. In flag-only mode the call proceeds and the response carries X-Relay-Moderation-Flagged and/or X-Relay-Moderation-Output-Flagged. Every verdict is recorded as a guardrail observation in the trace.

Moderation runs in the chat pipeline only: chat completions, agents, /v1/responses and workflow LLM nodes. Batch jobs, eval runs and embeddings are not moderated. Workflows also have a Moderate node for screening arbitrary text mid-flow.

#What these are (and aren't)

These are fast, local, best-effort guards — no model calls, no packages, no latency tax. They catch common cases (obvious PII, blatant injection, banned keywords). They are not a replacement for a dedicated moderation model where regulatory-grade filtering is required. Combine them with provider-side safety settings for defence in depth.