> ## Documentation Index
> Fetch the complete documentation index at: https://phaseo.app/docs/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Phaseo Gateway base URL: https://api.phaseo.app/v1. Send `Authorization: Bearer $PHASEO_API_KEY` with every request.
> Model IDs look like `provider/model`, for example `openai/gpt-6-astra`. Do not guess IDs: list them with `GET /v1/models` or check https://phaseo.app/models. `phaseo/free` routes to an available free model and needs no wallet balance.
> For new text integrations prefer `POST /v1/responses`. `POST /v1/chat/completions` (OpenAI format) and `POST /v1/messages` (Anthropic format) suit existing code.
> The full API contract is https://phaseo.app/docs/openapi/v1/openapi.yaml. Official SDKs: `@phaseo/sdk` (TypeScript) and `phaseo` (Python), plus Go, C#, PHP, Ruby and Rust.
> Search these docs over MCP at https://phaseo.app/docs/mcp, and install Phaseo skills with `npx skills add https://phaseo.app/docs`. If a page is wrong or out of date, report it with the MCP `submit_feedback` tool.
> Manage Phaseo accounts with the `phaseo` CLI (`npm install -g @phaseo/cli`, then `phaseo login` or `phaseo login --device-code`), the `/v1` Management API or the MCP server at `https://mcp.phaseo.app/mcp?access=manage`. Do not send users to the dashboard for account tasks. A person is still needed for sign-up, approving a sign-in, paying the first top-up on the checkout link that `phaseo credits add` returns when no card is saved, confirming each saved-card top-up from the emailed link, and account security (password, MFA, passkeys). Create API keys with `phaseo keys create --name <name> --json`; never guess one. Credit top-ups need `phaseo login --scopes billing:write` first. Task map: https://phaseo.app/docs/v1/developers/manage-from-an-agent.md.

# Roll out guardrails on API keys

> Apply guardrails to API keys, test enforcement before rollout, and verify blocks, redactions, and flags from activity views.

Use this recipe when you need to protect one or more API keys with routing restrictions, prompt-injection checks, or sensitive-info handling.

## 1. Create the guardrail under the workspace

Create guardrails at the workspace level first so the same policy can be reused across multiple keys.

Recommended first pass:

* add model and provider restrictions before content checks
* keep the first rollout narrow to one key or one environment
* name the guardrail after the policy outcome, not the team name

## 2. Attach it to a target API key

From the API key settings page, attach the guardrail to the key that should receive enforcement.

Use this sequence:

1. start with a staging or low-risk key
2. attach one guardrail at a time when possible
3. confirm the key detail dialog shows the applied guardrail

## 3. Set routing restrictions

Common combination:

* provider blocklist for low-trust providers
* model allowlist for the exact production models that should remain routable

Guardrails do not enforce spend limits. To cap spend, set a limit on the API key itself or create a [workspace budget](https://phaseo.app/docs/v1/api-reference/endpoint/budgets-list.md).

Use the live preview in the guardrail editor to verify:

* which providers stay allowed
* which models become blocked
* whether `Only allow` is narrower than intended

## 4. Add prompt-injection and sensitive-info rules

For a practical rollout:

* start prompt injection with `flag` or `redact`
* move to `block` only after reviewing false positives
* use deterministic sensitive-info rules first:
  * email
  * phone
  * SSN
  * credit card
  * IP address

If you need custom patterns, add them as explicit regex rules and test them in the preview input before saving.

## 5. Test the policy before broad rollout

Use the guardrail preview with:

* one benign input
* one clearly disallowed input
* one realistic production-like prompt

Look for:

* correct redaction text
* correct blocked/allowed behavior
* no accidental matches on unrelated content

## 6. Verify enforcement in activity and logs

After sending real requests through the guarded key, verify:

* the Guardrail Enforcement panel on the activity page
* request detail dialogs for blocked or redacted requests
* the API key detail dialog for per-key guardrail activity

You should see:

* blocked counts
* redacted counts
* flagged counts
* the specific guardrail and detector details when enforcement happened

## 7. Expand rollout safely

When the first key behaves correctly:

1. attach the same guardrail to more keys
2. tighten actions from `flag` to `redact` or `block`
3. add higher-latency name and address detection only where the latency tradeoff is acceptable

## Related

* [Presets](https://phaseo.app/docs/v1/guides/presets.md)
* [Quickstart](https://phaseo.app/docs/v1/quickstart.md)
* [Coding agents with `SKILL.md`](./coding-agents-skill-md.mdx)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.