← Back to feed

OpenRouter shipped enterprise guardrails on May 29, 2026 — a configurable security and governance layer that sits between incoming API requests and the company’s 400-plus model routing network. The launch comes three days after OpenRouter closed its $113M Series B, and directly targets the compliance gap that has slowed enterprise adoption of multi-model routing infrastructure.

Guardrails apply to workspaces, API keys, and individual team members. They require no changes to existing API integrations.

Four Capability Areas

Budget Enforcement

Spending limits with daily, weekly, or monthly reset windows. Per-entity, not shared: three team members assigned a $50/day guardrail each get independent $50 budgets. API key budgets stack independently on top of member budgets — both are checked on every request. Requests that breach limits fail with HTTP 403.

Zero Data Retention and Model Restrictions

One-click to disable all endpoints that retain or train on data. Supports model allowlists and provider allowlists, and blocklists for individual models or vendors. Workspace account-level privacy settings are inherited as a baseline; guardrails can only add restrictions, not relax them.

Prompt Injection Defense

Deterministic detection across 30+ regex patterns derived from the OWASP LLM Prompt Injection Prevention Cheat Sheet. Covers typoglycemia, encoding-based evasion, and character-spaced evasion. Detection runs before the request reaches any model provider — blocked traffic never leaves OpenRouter.

Three configurable actions: Flag (log and pass through for baselining), Redact (replace matched input with [PROMPT_INJECTION]), Block (403 with pattern metadata).

Data Loss Prevention

Seven built-in PII categories: email, phone, SSN, credit card, IP address, person name, address. Name and address detection uses Microsoft Presidio NLP; all other patterns are regex. Custom regex patterns supported for domain-specific data — internal codenames, proprietary identifiers. Each pattern can be configured independently to redact or block.

Built-in type	Method
Email address	Regex
Phone number	Regex
Social Security number	Regex
Credit card	Regex
IP address	Regex
Person name	NLP (Presidio)
Address	NLP (Presidio)

Architecture

Each workspace gets a default guardrail that applies to all keys and members. Additional guardrails layer on top for specific keys or groups. When multiple guardrails apply, the combination follows strict rules: allowlists intersect (only models approved by all guardrails are available), ZDR takes OR logic (any guardrail enforcing ZDR for a provider scope enforces it), DLP filters union (all active filters apply, block wins over redact).

The management API covers every guardrail operation: create, update, delete, list, assign to keys or members. Designed for automation during team onboarding or key rotation.

curl https://openrouter.ai/api/v1/guardrails \
  -H "Authorization: Bearer $OPENROUTER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "production-safety",
    "limit_usd": 100,
    "reset_interval": "daily",
    "allowed_models": ["anthropic/claude-sonnet-4.6"],
    "content_filter_builtins": [
      {"slug": "regex-prompt-injection", "action": "block"},
      {"slug": "credit-card", "action": "block"}
    ]
  }'

Context

The guardrails product completes the compliance story OpenRouter has been building since launching workspace support. The $113M Series B closed May 26 specifically cited governance tooling as a capital deployment target. The timing is notable: the same week PromptArmor published findings showing ChatGPT’s Google Sheets extension can be injected and turned into a data exfiltration tool — a vector that centralized prompt injection defense at the API gateway layer would have blocked.

OpenRouter routes over 100 trillion tokens per month across more than 50 cloud providers.