Add a Provider Safety Scan to Your Guardrails

• A provider integration on a guardrail profile
• A credential for the provider, or Cloptima-run scanning
• A scan direction and an action for provider findings
• A test request that proves it works

You need an existing guardrail profile and an owner or admin role. Your organization uses one provider integration at a time, shared across the baseline and the policy's profile.

Timeouts can be set from 1 millisecond to 10 seconds.

1. 1

   Add an Azure credential

   In the profile, add an Azure credential with the endpoint and key.

2. 2

   Enter the Content Safety endpoint

   It must match the credential's endpoint, use HTTPS, and end in .cognitiveservices.azure.com, .azure.us, or .azure.cn.

3. 3

   Choose the checks

   Turn on Prompt Shields, which scans prompts for jailbreak and prompt-injection attacks. Select harm categories for prompts and responses. At least one is required.

1. 1

   Add a Bedrock credential

   Use AWS access credentials that are allowed to apply the guardrail.

2. 2

   Enter the details

   Provide the AWS region, the Guardrail ID, and the Guardrail version.

1. 1

   Create a service account

   Give it Model Armor User access on the template's project.

2. 2

   Add the service account key

   Add it as a Google service account credential in the profile.

3. 3

   Paste the template name

   Use the form projects/PROJECT/locations/REGION/templates/NAME.

POST https://guardrails.example.com/check
{ "text": "...", "direction": "input", "request_id": "..." }

200 OK
{ "allowed": false, "category": "confidential", "confidence": 0.92 }

from fastapi import FastAPI

app = FastAPI()

@app.post("/check")
def check(body: dict):
    flagged = "confidential" in body["text"].lower()
    return {"allowed": not flagged, "category": "confidential" if flagged else None}

• The address must use HTTPS and be reachable on the public internet
• A reply without a true or false allowed field counts as a failure
• To authenticate calls, add a webhook auth credential and name the header. The default header is Authorization.
• Webhook scans have no list price, so a cost cap never applies to them

• You need AI credits available
• You do not need a cloud account with the provider
• Scans use Cloptima's resource, so you cannot choose a custom guardrail id or template

To mask text in place, use a Redact rule in the profile. Use provider findings to block or to observe.

1. 1

   Send a test prompt

   Use content your provider is configured to flag. For a webhook, use text your handler rejects.

2. 2

   Check the response

   With Block, you should see HTTP 403 and the reason gateway_guardrail_blocked. The violation name starts with guardrail_provider_.

3. 3

   Check the audit log

   Provider findings that pass in Observe appear there.