Integration
Guardrails & fact-checking across every OpenRouter model
OpenRouter solves model choice – Gemini, Claude, GPT, Llama, DeepSeek, Qwen, and hundreds more behind one API – and ships governance of its own: budget caps, allowlists, zero-data-retention, a regex injection screen, PII presets. Keep it on. in/guard/out adds the half a router doesn’t attempt – the model’s responses and the agent’s actions – starting with the table below.
Side by side
| Capability | OpenRouter guardrails | in/guard/out |
|---|---|---|
| Where checks run | Request side only | Request and response |
| Prompt injection detection | ~30 regex patterns, English-only | Patterns plus a multilingual classifier |
| Indirect injection via tool results | — | Scanned before re-entering context |
| PII detection | 7 presets; names & addresses in beta | Full Presidio entity set |
| PII after detection | Redacted or blocked – never restored | Screened to stable placeholders, restored on response |
| PII leaving via tool arguments | — | Taint tracking blocks it |
| Hallucination & numeric grounding | — | Deterministic grounding + fact-check judge |
| Output format (JSON schema) | — | Validate and repair |
| Content safety on responses | — | Profanity cascade + shield classifiers |
| Agent tool-call policy | — | Allow/deny, schemas, permission tiers, sequence policies |
| Budgets | USD caps per key/member, daily–monthly | Those still apply, plus per-run cost/step/tool budgets |
| Model & provider allowlists, ZDR | Built in – keep them on | Not duplicated; adds per-model violation evidence |
| Enforcement modes | Flag, redact, or block | FIX (repair) and PREVENT (block), per key/user/request |
Where the router stops
Every OpenRouter check in the table shares two traits: it runs on requests, and it works by pattern matching. The injection defense is a list of thirty-odd regexes that OpenRouter’s own docs describe as English-only and not exhaustive; redacted PII is never restored; and nothing reads the model’s response at all. in/guard/out’s pipeline starts where that stops – classifier-based injection scanning that scores intent across languages, PII screening that restores, the whole output side (grounding, fact-checking, format enforcement, content safety), and action-level policy over the tool calls a router only ever forwards.
This pairing is where the cost economics get interesting. The reason teams use OpenRouter is to route work to cheaper models; the reason cheaper models feel risky is hallucination and inconsistency. With grounding, fact-checking, and format enforcement on the wire, the quality bar comes from the checks – so the router can chase price while the pipeline holds the line, and the dashboard shows true per-request cost including every guard call.
Setting it up with in/guard/out
1. Configure the upstream
Point your in/guard/out key at OpenRouter with your OpenRouter credentials. Requests forward through, with token pricing attributed per model.
2. Swap the base URL
Your app calls in/guard/out with the same OpenAI-compatible SDK it already uses; model selection works as before.
3. Layer the policies
Keep OpenRouter’s workspace guardrails for spend caps, allowlists, and ZDR; in/guard/out runs the checks they don’t attempt – restore, grounding, output safety, agent rules – identically whichever model serves.
4. Compare models on evidence
Per-request violations and per-stage findings, sliced by model, show which cheap models actually hold up on your traffic.
What OpenRouter’s guardrails do – and what in/guard/out adds
Budget limits
OpenRouter caps USD spend per key or member with daily, weekly, or monthly resets – a solid outer wall. in/guard/out meters the inside: per-run budgets on cost, steps, and tool calls, guard-model sub-calls priced in, so a runaway agent task stops mid-run instead of at month-end.
Allowlists & ZDR
Restricting which models and providers may serve traffic – with per-group zero-data-retention – is governance in/guard/out doesn’t duplicate. It adds the evidence side: per-model violation stats that show which allowlisted models actually hold the bar on your traffic.
Prompt injection defense
OpenRouter scans requests against ~30 OWASP-derived regexes with some evasion handling – deterministic, fast, and by its own docs English-only and not exhaustive. in/guard/out layers a dedicated classifier that scores intent across languages, scans tool results – where indirect injection actually arrives – and backstops misses with action grounding.
Sensitive info (DLP)
Seven built-in presets redact or block PII on the way in – and redaction is one-way: the model answers about [PERSON_NAME] and your user reads placeholders. in/guard/out screens with stable placeholders and restores real values on the response, so protection stops costing answer quality – and taint tracking keeps screened values from exiting via tool arguments.
Custom content filters
Bring-your-own regex, redact or block per request – useful for codenames and internal IP. in/guard/out adds what regex can’t express: JSON-schema validation and repair, sequence policies over tool ordering, and grounding a payment’s IBAN and amount against the run’s sources.
The output gap
Every OpenRouter guardrail runs before the request forwards; none reads what comes back. in/guard/out’s other half lives there: deterministic numeric grounding, fact-checking against sources, format validate-and-repair, content-safety classifiers, canary leak detection – the checks that decide whether the answer ships.
The roster, and what to watch on each
Google Gemini
Gemini 2.5 Pro and Flash – huge context windows that invite huge pastes. Long-context work is where figures drift quietly between page 3 and page 40; deterministic grounding matches every number back to its source.
Anthropic Claude
Opus, Sonnet, and Haiku tiers. Routing Claude through OpenRouter also unlocks in/guard/out’s full agent stack – tool policy, action grounding, budgets – on Claude-driven agents.
OpenAI GPT
The GPT series and its reasoning variants – often the incumbent your cheaper routes get compared against. Per-model violation stats turn that comparison from vibes into a table.
Meta Llama
The open-weight default. Llama-class models are everywhere from fine-tunes to on-prem serving; the pipeline gives their output the same bar as the frontier tiers.
DeepSeek
V3-class chat and R1-class reasoning at aggressive prices – the classic "cheap but is it safe for customers?" candidate. Exactly the traffic to run through grounding in observe mode first.
Alibaba Qwen
Qwen3 – strong multilingual and coding families. Multilingual traffic deserves note: injection patterns are language-agnostic on the wire, and the classifier stages catch what phrase lists miss.
Mistral
European frontier and open models with strong price-performance – the same screening, grounding, and safety bar applies to them as to every other tier.
Google Gemma
Google’s open-weight small models – popular for cheap classification and drafting tiers, which is precisely where format enforcement and fact-checks earn their keep.
Moonshot Kimi
K2-class models built for agentic work. Agent-tuned models emit more tool calls per task – more reason for tiers, sequence policies, and per-run budgets.
Zhipu GLM
GLM-4.x – strong coding and agentic performance per dollar. Same story: capable, cheap, and worth watching with real per-request evidence before you enforce.
xAI Grok
Grok’s fast-moving releases change behavior between versions; a constant check standard on the wire means a model swap doesn’t silently change your safety posture.
Frequently asked questions
OpenRouter already has guardrails – do I still need in/guard/out?
For different work, yes. OpenRouter’s guardrails govern access – spend caps, allowlists, ZDR – and screen requests with regex plus beta NLP presets. They never read a response, never restore a redaction, and treat tool calls as payload. in/guard/out is that missing half; the two layer cleanly, with the router’s checks still running underneath.
Is OpenRouter’s prompt-injection defense enough?
It is a reasonable free first pass: ~30 OWASP-derived regex patterns with typoglycemia, encoding, and character-spacing evasion handling. But it is pattern matching – English-only per its own documentation, and “not exhaustive” by the same page. in/guard/out adds a dedicated classifier that generalizes across languages and phrasings, scans tool results for indirect injection, and – for the attempt that fools every scanner – checks the resulting actions against grounding, tiers, and budgets.
OpenRouter redacts PII – how is screening different?
Redaction is one-way: [EMAIL] goes to the model, placeholders come back to your user, and the response is never scanned. Screen-and-restore uses stable placeholders the model can reason over, then restores the real values on the way back – protection without degraded answers – and taint tracking blocks screened values from leaving via tool arguments.
Do the two budget systems conflict?
They compose. OpenRouter enforces spend per key or member per day, week, or month – the outer wall. in/guard/out budgets per run: cost, steps, and tool calls for one agent task, guard-model sub-calls included, correlated by session. A loop that would burn $40 of a $50 daily cap on one task gets stopped at its own limit instead.
Which models can I route through in/guard/out?
Anything OpenRouter serves – Gemini and Gemma, Claude, GPT, Llama, DeepSeek, Qwen, Mistral, Kimi, GLM, Grok, and the long tail. in/guard/out is model-agnostic: it judges the traffic, not the logo, and per-model pricing metadata keeps cost tracking accurate.
Does tool calling work through the chain?
Yes – OpenRouter exposes OpenAI-compatible tool calling, so the agent guardrails (tool policy, tiers, grounding, taint, budgets) engage exactly as with OpenAI directly.
Related
Run a cheaper model safely
Route OpenRouter traffic through in/guard/out so the checks - not the model tier - hold the quality bar. We are running a limited demo - sign up and we will get you in as soon as we can.