Controls run in a fixed order, and the order is in the record
A request is admitted, checked against limits and restrictions, redacted, then passed through inbound guardrails before it reaches a provider. The response comes back through outbound guardrails. Every stage writes its own line into the audit record, with the time it took and the decision it made.
Detect and redact PII before it reaches the model
Three detectors run in sequence: regex recognizers for structured data, named-entity recognition for people and organisations, and an LLM pass for the cases the first two cannot see. A project applies as many recognizer rules as it needs, in any combination: Polish national identifiers alongside NANP phone numbers and SSNs, plus your own patterns. Matches are tokenized, not deleted, so a reply can be re-expanded on the way back.
A separate policy for each direction of traffic
Inbound guards the prompt on its way to the model. Outbound guards the answer on its way back to the user. Tool guardrails sit on the calls an agent makes, where a poisoned tool result is the attack. Each direction has its own rule set, its own action per rule, and its own failure mode.
A runaway agent is a cost incident and a safety one
Limits are set per key, per project and per agent, so one misbehaving loop cannot exhaust a shared quota or a shared budget. Budgets are enforced in path rather than reported the following month. You choose what the ceiling means: block new calls, or warn the owner and keep serving.
An app can only reach what the project is allowed to reach
Each project has an allow list of providers, models and regions. A call that asks for anything outside it is refused in path with a reason the developer can read, not a silent fallback to something cheaper. Restrictions are inherited from the governance policy, so a model that compliance has not approved cannot be reached even by an operator with admin rights in the console.
Decide now what happens when a control cannot run
A detector can time out. A classifier can be unreachable. Every control on this page carries its own failure mode, set per project, so the answer is a decision your compliance team made in advance rather than a default nobody chose. The mode that applied is written into the record for that call.
If the control cannot run, the call does not go through. The right answer for regulated traffic, where an unredacted prompt reaching a provider is worse than an outage.
The call proceeds with the strongest control that is still available: regex without NER, heuristics without the classifier. The gap is recorded, not hidden.
The call proceeds without the control and is flagged in the audit log. Appropriate for development projects and for traffic that carries no personal data.
One stop that reaches every call, when it lands
The kill switch is the control we are still building. It stops traffic in path for a single key, an agent, an MCP server or a whole region: hard kill, safe degrade, or quarantine for capture without effect. It takes effect in path, with no async plumbing and no redeploy, and every engage and restore is signed into the audit log. It is listed here so your review can plan around it, not so a deck can imply it exists.