Add guardrails and a budget
The surface from Create your first LLM Surface forwards every prompt to OpenAI unfiltered and has no spend ceiling. This guide adds two capabilities. First, a Prompt Guard element applies PII masking to common patterns in the request before it reaches the model. Second, a usage limit enforces a monthly USD budget that blocks a request before it reaches the provider once the ceiling is hit, rather than billing it afterward.
By the end of this guide, your surface will mask email addresses and credit-card numbers in every request, and reject calls once the surface’s monthly spend cap is reached.
Prerequisites
- The surface from Create your first LLM Surface is active.
Steps
Add a Prompt Guard element

Under SURFACES in the dashboard sidebar, select LLM, then open the surface you created. The canvas already carries a Prompt Guard node on the request path, between the Access Point and the LLM node, shown greyed out until it’s configured. Select it, switch on Enabled, then select Edit request guards… to open its fullscreen editor. If your appliance offers a partial template that merges a pre-configured guardrails bundle onto an existing surface, you can use that shortcut instead.
In the fullscreen editor, add two rules using the built-in patterns email and credit_card, each set to mask the match.
Select the save icon to save the surface.
Send a request containing PII
Replace <YOUR_APPLIANCE_HOST> and <YOUR_SURFACE_ROUTE> with your values from Create your first LLM Surface:
curl -k -X POST "https://<YOUR_APPLIANCE_HOST><YOUR_SURFACE_ROUTE>/v1/chat/completions" \
-H "Content-Type: application/json" \
-d '{
"model": "gpt-5.5",
"messages": [
{ "role": "user", "content": "Draft a reply to jane.doe@example.com about her order." }
]
}'Replace gpt-5.5 with whichever model your surface’s LLM node is actually configured with, if different.
The -k flag disables TLS certificate verification. Use this for local testing only; remove it in production.
Prompt Guard matches the email address before the request reaches OpenAI and masks it, so the model never sees the raw value. See Guardrails → and PII protection and NER IDs → for how masking compares to a NER ID pseudonym.
Add a monthly budget

Select the LLM node on the canvas to open its settings panel, then switch on Enforce a usage limit:
| Field | Value for this guide | Notes |
|---|---|---|
| Monthly budget (USD) | 5 | A low value for this guide, so you can see the limit trigger without waiting for real usage to accumulate. |
| Monthly token cap | (leave blank) | Optional. Leave unset unless you also want a hard token ceiling. |
Select the save icon in the canvas toolbar to persist the change. The limit is enforced immediately: the next request that would push this surface’s month-to-date spend past $5 is blocked with a 429 response before it reaches OpenAI, rather than being allowed through and billed afterward.
Confirm
Open the surface’s Monitoring tab. The masked request from step 2 does not appear in the rejection breakdown at all, since masking a value is not the same as rejecting the call; a rejection only shows up here once Prompt Guard actually blocks a request outright. If you send enough requests to cross the $5 budget from step 3, an entry appears under the usage-limit rejection category and the request returns 429.
Troubleshooting
| Symptom | Likely cause | Fix |
|---|---|---|
| The email in step 2 is not masked in the request sent to OpenAI. | The Prompt Guard element was never added, was removed, or its email rule is missing or set to an action other than mask. | Re-open the surface, confirm a Prompt Guard element is present on the request seam, and that email is listed under its rules with the mask action. |
Every request returns 429, even the first one. | The monthly budget was set too low, or a previous test already consumed the cap. | Open the usage limit and increase Monthly budget (USD), or wait for the next monthly reset. |
| No PII category appears in the Monitoring tab rejection breakdown. | Prompt Guard is configured to mask rather than reject; a mask still processes the request and is not counted as a full rejection. | This is expected for the mask action. To see a rejection count instead, temporarily change the rule’s action to reject and resend the request. |
| A rejection appears, but under Uncategorized rather than PII. | A known gap in the current rejection taxonomy: a built-in Prompt Guard pattern (email, credit_card, and similar) doesn’t yet populate a category on its own rejection reason. | Not a misconfiguration on your surface. Expect Uncategorized for a built-in-pattern rejection until this is addressed upstream. |
Next steps
- Monitor your surface: See the requests from this guide in the surface Monitoring tab and the response headers on every call.
- Guardrails: Add Expert Witnesses, Judge, and Jury for a customer-facing deployment.
- PII protection and NER IDs: How masking compares to a NER ID pseudonym, and when to choose each.
- Cost and usage governance: Per-stage metering, breach alerts, and appliance tier limits.
Glad to hear it! Please tell us how we can improve more.
Sorry to hear that. Please tell us how we can improve.
Thank you for sharing your feedback so we can improve your experience.