---
schema_version: "1"
id: e317956a66ec7fc310dfebf3ccfc612d3b9adb5cc95fe6053208035298a5515e
title: CrowdStrike AIDR Guardrails Policy
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/latest/policies-included-crowdstrike-aidr-guardrails.md
canonical_url: https://docs.mulesoft.com/gateway/latest/policies-included-crowdstrike-aidr-guardrails
source_site: docs.mulesoft.com
content_type: documentation
content_hash: af3a14de2376a6321a34ec26f14ad5878c9abe434a2c2c4bf26afc0f1f12a49b
description: MuleSoft Documentation Site
release: "1.14"
latest: true
---
---
product: Omni Gateway
version: 1.14
is-latest-version: true
keywords: api gateway, flex gateway, gateway, policy, llm, content safety, crowdstrike, falcon, aidr, guardrails, redaction
---

# CrowdStrike AIDR Guardrails Policy

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

<table><colgroup><col> <col></colgroup><tbody><tr><td><p><strong>Policy Name</strong></p></td><td><p>CrowdStrike AIDR Guardrails Policy</p></td></tr><tr><td><p><strong>Summary</strong></p></td><td><p>Evaluates OpenAI-format LLM prompts and responses against CrowdStrike Falcon AI Detection and Response (AIDR), rejecting or redacting flagged content</p></td></tr><tr><td><p><strong>Category</strong></p></td><td><p>LLM</p></td></tr><tr><td><p><strong>First Omni Gateway version available</strong></p></td><td><p>v1.14.0</p></td></tr><tr><td><p><strong>Release Notes</strong></p></td><td><p><a href="https://docs.mulesoft.com/release-notes/gateway/policies/crowdstrike-aidr-guardrails-release-notes">CrowdStrike AIDR Guardrails Policy</a></p></td></tr><tr><td rowspan="2"><p><strong>Returned Status Codes</strong></p></td><td><p>403 - Forbidden: Content rejected by CrowdStrike AIDR</p></td></tr><tr><td><p>503 - Service Unavailable: AIDR call failed, timed out, or returned a verdict the policy can’t use (only when fail-open is disabled)</p></td></tr></tbody></table>

## Summary

The CrowdStrike Falcon AI Detection and Response (AIDR) Guardrails policy provides content
moderation for LLMs by evaluating prompts and responses against
[CrowdStrike Falcon AIDR](https://aidr-docs.crowdstrike.com/). The policy sends the conversation to
AIDR and enforces the returned verdict at the gateway before the request reaches the upstream LLM
(request phase) or before the response is returned to the client (response phase).

The policy supports only OpenAI Chat Completions format traffic, because the AIDR API accepts only
that format.

An AIDR collector token is both the credential and the link to your AIDR policy. Which detectors
run, their thresholds, redaction rules, and whether a detection rejects content are all configured
in the Falcon console, not in the gateway policy. Changes you make in the Falcon console take effect
without needing to modify the gateway policy.

The policy turns each AIDR verdict into one of these gateway actions:

- **Allow**: Content that AIDR doesn’t reject is forwarded unchanged. Detections from an AIDR policy
  in report-only mode are allowed.

- **Redact**: When Enable Transformation is enabled and AIDR returns redacted content, the policy
  replaces the original content with the redacted content and forwards it.

- **Reject**: When AIDR rejects the content, the client receives an HTTP `403` response that names
  the triggered detectors.

The policy rejects content only when the AIDR verdict says to reject it. Detections alone never
cause a rejection.

The policy operates in two independent phases:

- **Request phase**: Sends the prompt messages to AIDR as an input event. Rejected prompts never
  reach the LLM.

- **Response phase**: Sends the LLM completion to AIDR as an output event before returning it to the
  client.

Both phases are enabled by default.

## Before You Begin

Before configuring this policy, you need:

1.  **A CrowdStrike AIDR for Agents subscription.** AIDR for Workforce collectors aren’t supported.

2.  **An AIDR Application collector token**, issued from the Falcon console. The AIDR policy
    assigned to the collector determines how content is evaluated.

3.  **The AIDR endpoint URL for the CrowdStrike cloud that hosts your Falcon tenant.** The cloud is
    the only data residency control AIDR offers, so choose it deliberately. Each URL includes the
    `/aidr/aiguard` path:

    - US-1: `https://api.crowdstrike.com/aidr/aiguard`

    - US-2: `https://api.us-2.crowdstrike.com/aidr/aiguard`

    - EU-1: `https://api.eu-1.crowdstrike.com/aidr/aiguard`

Prompts and responses leave your network when they’re sent to CrowdStrike for evaluation. Ensure the
Omni Gateway can reach the AIDR host outbound. To keep content out of CrowdStrike logs, configure
content logging exclusions in the Falcon console.

Traffic in any other format, non-`POST` requests, and requests without a JSON body pass through
unscanned.

## Configuring Policy Parameters

### Omni Gateway Local Mode

The CrowdStrike AIDR Guardrails policy isn’t supported in Local Mode.

### Managed Omni Gateway and Omni Gateway Connected Mode

When you apply the policy from the UI, the following parameters are displayed:

### Basic Configuration

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Element</th><th>Required</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p>AIDR Endpoint</p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>Base URL of the AIDR API for the CrowdStrike cloud that hosts your Falcon tenant: <code>https://api.crowdstrike.com/aidr/aiguard</code> (US-1), <code>https://api.us-2.crowdstrike.com/aidr/aiguard</code> (US-2), or <code>https://api.eu-1.crowdstrike.com/aidr/aiguard</code> (EU-1). Include the <code>/aidr/aiguard</code> path. The policy appends <code>/v1/guard_chat_completions</code> and <code>/v1/unredact</code> at call time.</p></div></div></td></tr><tr><td><div><div><p>Collector Token</p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>AIDR Application collector token. The token authenticates each call and selects the AIDR policy assigned to the collector. The collector must belong to an AIDR for Agents subscription. This value is sensitive and is never logged.</p></div></div></td></tr><tr><td><div><div><p>Moderate Request</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>When enabled (default), the policy evaluates the prompt messages against AIDR before forwarding them to the upstream LLM. Rejected prompts never reach the LLM.</p></div></div></td></tr><tr><td><div><div><p>Moderate Response</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>When enabled (default), the policy evaluates the LLM completion against AIDR before returning it to the client.</p></div><div><p>Streaming responses (<code>text/event-stream</code>) are also evaluated. The policy buffers the entire stream and holds the response until the evaluation completes. This breaks the streaming experience for the client and increases latency and memory use.</p></div></div></td></tr></tbody></table>

### Advanced Configuration

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Element</th><th>Required</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p>Request Collector Token</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Collector token to use for the request phase, so prompts can use a different AIDR policy. When not set, the policy uses Collector Token.</p></div></div></td></tr><tr><td><div><div><p>Response Collector Token</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Collector token to use for the response phase, so completions can use a different AIDR policy. When not set, the policy uses Collector Token.</p></div></div></td></tr><tr><td><div><div><p>Application ID</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Application identifier sent on every AIDR call. Use it to identify this API on the AIDR Findings page.</p></div></div></td></tr><tr><td><div><div><p>Collector Instance ID</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Identifier that distinguishes gateway instances or environments that share one collector.</p></div></div></td></tr><tr><td><div><div><p>Enable Transformation</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>When enabled, the policy replaces the original content with the redacted content that AIDR returns. If the redacted content doesn’t match the original messages one for one, the policy doesn’t apply it and handles the call as failed. See <a href="#fail-open-and-fail-closed">Fail Open and Fail Closed</a>. Default: disabled.</p></div></div></td></tr><tr><td><div><div><p>Enable Unredact</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>When enabled, the policy restores redacted values in the LLM response, so the LLM never sees the original sensitive values but the client does. Requires Enable Transformation and Moderate Request. See <a href="#redact-and-unredact">Redact and Unredact</a>. Default: disabled.</p></div></div></td></tr><tr><td><div><div><p>Sampling Rate</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Percentage of requests sent to AIDR for evaluation. Must be between <code>0</code> and <code>100</code>. At <code>100</code>, every request is evaluated. Use a lower value to limit AIDR usage. Default: <code>100</code>.</p></div></div></td></tr><tr><td><div><div><p>History Depth</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Maximum number of prior conversation turns sent to AIDR on each call. <code>0</code> sends the full conversation. AIDR rejects payloads larger than 1 MiB, so set a limit if your clients send long conversations. Default: <code>0</code>.</p></div></div></td></tr><tr><td><div><div><p>API Timeout (ms)</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Timeout for each AIDR call in milliseconds. Must be between <code>1000</code> and <code>30000</code>. When Enable Unredact is enabled, the response phase makes two calls, so it can take up to twice this value. Default: <code>5000</code>.</p></div></div></td></tr><tr><td><div><div><p>Fail Open</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Determines behavior when an AIDR call fails, times out, or returns a verdict the policy can’t use:</p></div><div><ul><li><p>Disabled (default): Rejects with HTTP <code>503</code>.</p></li><li><p>Enabled: Allows traffic to proceed unscanned (fail-open mode).</p></li></ul></div></div></td></tr></tbody></table>

## How This Policy Works

The CrowdStrike AIDR Guardrails policy integrates with CrowdStrike Falcon AIDR to evaluate LLM
prompts and responses.

### Request and Response Moderation

The policy supports independent evaluation for request and response:

1.  **Request Phase** (when Moderate Request is enabled):

    1.  The policy checks that the request is a `POST` request in OpenAI format with a JSON body.
        Other traffic passes through unscanned.

    2.  The policy decides whether to sample the request, based on Sampling Rate. Requests that
        aren’t sampled are allowed without evaluation in both phases.

    3.  The policy sends the prompt messages, limited by History Depth, to AIDR as an input event,
        with Application ID and Collector Instance ID.

    4.  The policy enforces the AIDR verdict. If the prompt is allowed, the policy forwards it to
        the upstream LLM. If AIDR redacts the prompt and Enable Transformation is enabled, the
        policy forwards the redacted prompt. If AIDR rejects the prompt, the policy returns HTTP
        `403`.

2.  **Response Phase** (when Moderate Response is enabled):

    1.  The policy buffers the LLM response. For a streaming response, the policy rebuilds the full
        completion from the stream.

    2.  The policy sends the completion to AIDR as an output event.

    3.  The policy enforces the AIDR verdict. If the completion is allowed, the policy returns it
        unchanged, or with redacted values restored when Enable Unredact is enabled. If AIDR redacts
        the completion and Enable Transformation is enabled, the policy returns the redacted
        completion. If AIDR rejects the completion, the policy replaces the response with an HTTP
        `403` response.

        > [!NOTE] For streaming responses, the policy can’t apply redacted content or restore
        > redacted values. If AIDR redacts a streaming response, the policy handles the call as
        > failed. See [Fail Open and Fail Closed](#fail-open-and-fail-closed).

### Redact and Unredact

When Enable Transformation and Enable Unredact are both enabled, the policy can keep sensitive
values from the LLM while still returning them to the client:

1.  In the request phase, AIDR redacts sensitive values in the prompt, and the policy forwards the
    redacted prompt to the LLM.

2.  In the response phase, the policy asks AIDR to restore the redacted values in the LLM completion
    before returning it to the client.

Only reversible redaction configured in the Falcon console (format-preserving encryption) can be
restored. Values replaced with a placeholder, for example, `<US_SSN>`, can’t be restored.

The response phase restores values only when AIDR allows the completion. If AIDR redacts the
completion, the client receives the redacted completion.

If restoring values fails, Fail Open determines the result. When Fail Open is disabled, the policy
returns HTTP `503`. When Fail Open is enabled, the client receives the redacted completion.

### Fail Open and Fail Closed

The policy handles these conditions as a failed call:

- The AIDR call returns an error or times out.

- AIDR returns a verdict that doesn’t say whether to reject the content.

- AIDR returns redacted content that the policy can’t apply to the original messages, or to a
  streaming response.

When Fail Open is disabled, the policy rejects the request or response with HTTP `503`. When Fail
Open is enabled, the policy allows the traffic unscanned.

## Example Configurations

The following examples demonstrate common configuration patterns for the CrowdStrike AIDR Guardrails
policy.

### Minimal Configuration

Only the two required fields. Both phases are evaluated, every request is sampled, and failed calls
are rejected with a `5000` ms timeout.

```yaml
- policyRef:
    name: crowdstrike-aidr-guardrails-policy-v1-0-impl
    namespace: default
  config:
    aidrEndpoint: https://api.crowdstrike.com/aidr/aiguard
    collectorToken: "${CROWDSTRIKE_AIDR_COLLECTOR_TOKEN}"
```

### Regional Endpoint, Per-Phase Collectors, and Attribution

An EU-1 endpoint, separate collectors for prompts and completions, and application and instance
identifiers for the AIDR Findings page.

```yaml
- policyRef:
    name: crowdstrike-aidr-guardrails-policy-v1-0-impl
    namespace: default
  config:
    aidrEndpoint: https://api.eu-1.crowdstrike.com/aidr/aiguard
    collectorToken: "${CROWDSTRIKE_AIDR_COLLECTOR_TOKEN}"
    advancedConfiguration:
      requestCollectorToken: "${CROWDSTRIKE_AIDR_INPUT_TOKEN}"
      responseCollectorToken: "${CROWDSTRIKE_AIDR_OUTPUT_TOKEN}"
      applicationId: checkout-assistant
      collectorInstanceId: gateway-prod-eu
      apiTimeoutMs: 8000
```

### Redact and Unredact With Sampling

Redacts sensitive values before the prompt reaches the LLM, restores them in the response to the
client, and evaluates 25% of requests to limit AIDR usage.

```yaml
- policyRef:
    name: crowdstrike-aidr-guardrails-policy-v1-0-impl
    namespace: default
  config:
    aidrEndpoint: https://api.crowdstrike.com/aidr/aiguard
    collectorToken: "${CROWDSTRIKE_AIDR_COLLECTOR_TOKEN}"
    advancedConfiguration:
      enableTransformation: true
      enableUnredact: true
      samplingRate: 25
```

### Request-Only, Fail-Open, Limited History

Only the prompt is evaluated, only the last 10 conversation turns are sent to AIDR, and if AIDR is
unreachable the request proceeds unscanned.

```yaml
- policyRef:
    name: crowdstrike-aidr-guardrails-policy-v1-0-impl
    namespace: default
  config:
    aidrEndpoint: https://api.us-2.crowdstrike.com/aidr/aiguard
    collectorToken: "${CROWDSTRIKE_AIDR_COLLECTOR_TOKEN}"
    moderateRequest: true
    moderateResponse: false
    advancedConfiguration:
      historyDepth: 10
      failOpen: true
```

## See Also

- [CrowdStrike AIDR documentation](https://aidr-docs.crowdstrike.com/)

- [Azure Content Safety Policy](https://docs.mulesoft.com/gateway/latest/policies-included-azure-content-safety)

- [Amazon Bedrock Guardrails Policy](https://docs.mulesoft.com/gateway/latest/policies-included-bedrock-guardrails)

- [Creating and Managing Model Proxies](https://docs.mulesoft.com/general/model-proxy)

- [Applying Model Proxy Policies](https://docs.mulesoft.com/general/model-proxy-policies)