Add a Provider Safety Scan to Your Guardrails

• Content safety on a guardrail profile
• A credential for the provider, or Cloptima-run scanning
• A choice for when the scan cannot run
• A test request that proves it works

You need an existing guardrail profile and an owner or admin role. Content safety comes with AI Growth and Enterprise. It goes in the org baseline or in policy profiles, not both, so each request is checked once.

1. 1

   Add an Azure credential

   In the profile, add an Azure credential with the endpoint and key.

2. 2

   Enter the Content Safety endpoint

   It must match the credential's endpoint, use HTTPS, and end in .cognitiveservices.azure.com, .cognitiveservices.azure.us, or .cognitiveservices.azure.cn.

Cloptima runs every Azure check for you: Prompt Shields on requests, against jailbreak and prompt-injection attacks, and every harm category on requests and responses.

1. 1

   Add a Bedrock credential

   Use AWS access credentials that are allowed to apply the guardrail.

2. 2

   Enter the details

   Provide the AWS region, the Guardrail ID, and the Guardrail version.

1. 1

   Create a service account

   Give it Model Armor User access on the template's project.

2. 2

   Add the service account key

   Add it as a Google service account credential in the profile.

3. 3

   Paste the template name

   Use the form projects/PROJECT/locations/REGION/templates/NAME.

POST https://guardrails.example.com/check
{ "text": "...", "direction": "input", "request_id": "..." }

200 OK
{ "allowed": false, "category": "confidential", "confidence": 0.92 }

from fastapi import FastAPI

app = FastAPI()

@app.post("/check")
def check(body: dict):
    flagged = "confidential" in body["text"].lower()
    return {"allowed": not flagged, "category": "confidential" if flagged else None}

• The address must use HTTPS and be reachable on the public internet
• A reply without a true or false allowed field counts as a failure
• To authenticate calls, add a webhook auth credential and name the header. The default header is Authorization.

• You need AI credits available
• You do not need a cloud account with the provider
• Scans use Cloptima's resource, so you cannot choose a custom guardrail id or template

To mask text in place, use a Redact rule in the profile. Under a policy in Monitor only, findings are recorded instead of blocked, except in the org baseline profile, which always enforces.

In the same section, If the scan can't run chooses what a request does when the provider cannot be reached: continue on your local rules, or block the request.

1. 1

   Send a test prompt

   Use content your provider is configured to flag. For a webhook, use text your handler rejects.

2. 2

   Check the response

   You should see HTTP 403 and the reason gateway_guardrail_blocked. The violation name starts with guardrail_provider_.

3. 3

   Check the audit log

   Provider findings under a policy in Monitor only appear there.