Filtering PII before it reaches the LLM
The AI Gateway can scan outbound prompts for personally identifiable information (PII) before they are forwarded to an LLM provider. When PII is detected, G8KEPR applies the action you configure — redact, block, or warn — to help keep sensitive data from leaving your environment unintentionally.
How outbound filtering works
Prompts sent through the gateway's completions endpoint are evaluated against your organization's PII filters before routing. Detection runs in two layers:
- ▸Built-in patterns (always on) catch seven high-confidence types: Social Security numbers, credit card numbers, phone numbers, email addresses, IP addresses, dates of birth, and provider API keys (for example, keys beginning with
sk-ant-,sk-,AKIA, orghp_). - ▸Extended detection (optional) adds names, locations, passport and driver's license numbers, bank and IBAN numbers, crypto addresses, and more — covering a broader set of sensitive data types.
Detection is tuned for low false positives. Neutral business text does not trigger filters, and numeric identifiers require standard separators so ordinary product codes and version strings are unlikely to match.
The three actions
You choose what happens when PII is found. Each filter carries its own action:
- 1.Redact — the matched value is replaced with a type-safe placeholder (for example, an email becomes
[EMAIL]and an SSN becomes[SSN]). The request continues to the provider with the sanitized prompt. - 2.Block — the request fails immediately and nothing is sent to the provider. Use this for data classes that must never reach a third party.
- 3.Warn — the request proceeds unchanged, but the detection is logged for review. Use this to measure exposure before enforcing.
Configuring filters
Set PII filtering as a guardrail policy for your organization:
- ▸Enable the
piipolicy on the endpoints you want covered. - ▸Assign an action per filter to match your data-handling requirements.
- ▸Review matches over time and tighten from warn to redact or block once you understand your traffic.
Matches are recorded with their severity, the action taken, and a redacted preview of the matched input — so you get an audit trail without storing the raw sensitive value.
Start new filters in warn mode to baseline real traffic, then promote the high-risk ones to redact or block.
For related controls on model responses, see AI guardrail policies.