---
schema_version: "1"
id: 25133f53a1d896aed0aeff268df9c75a58bc5bf4c08084baa25ae8839fb22594
title: Google Model Armor Guardrails Policy
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/latest/policies-included-google-model-armor-guardrails.md
canonical_url: https://docs.mulesoft.com/gateway/latest/policies-included-google-model-armor-guardrails
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 41e342ebad592dc5768140d7d4437725c40775c2822c677efa97ec7104e0515c
description: MuleSoft Documentation Site
release: "1.14"
latest: true
---
---
product: Omni Gateway
version: 1.14
is-latest-version: true
keywords: api gateway, flex gateway, gateway, policy, llm, content safety, google, google cloud, model armor, guardrails, redaction
---

# Google Model Armor Guardrails Policy

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

<table><colgroup><col> <col></colgroup><tbody><tr><td><p><strong>Policy Name</strong></p></td><td><p>Google Model Armor Guardrails Policy</p></td></tr><tr><td><p><strong>Summary</strong></p></td><td><p>Evaluates OpenAI and Gemini format LLM prompts and responses against a Google Cloud Model Armor template, blocking or redacting flagged content</p></td></tr><tr><td><p><strong>Category</strong></p></td><td><p>LLM</p></td></tr><tr><td><p><strong>First Omni Gateway version available</strong></p></td><td><p>v1.14.0</p></td></tr><tr><td><p><strong>Release Notes</strong></p></td><td><p><a href="https://docs.mulesoft.com/release-notes/gateway/policies/google-model-armor-guardrails-release-notes">Google Model Armor Guardrails Policy</a></p></td></tr><tr><td rowspan="2"><p><strong>Returned Status Codes</strong></p></td><td><p>403 - Forbidden: Content blocked by Google Model Armor</p></td></tr><tr><td><p>503 - Service Unavailable: Model Armor or the Google OAuth token endpoint call failed, timed out, or returned no usable verdict (only when fail-open is disabled)</p></td></tr></tbody></table>

## Summary

The Google Model Armor Guardrails policy provides content moderation for LLMs by evaluating prompts
and responses against a
[Google Cloud Model Armor](https://cloud.google.com/security/products/model-armor) template. The
policy calls the Model Armor `sanitizeUserPrompt` operation in the request phase and the
`sanitizeModelResponse` operation in the response phase, and enforces the returned verdict at the
gateway before the request reaches the upstream LLM or before the response is returned to the
client.

Which Model Armor filters run and how they behave (filter selection, confidence levels, Sensitive
Data Protection (SDP) configuration, and filter version) is owned by your Model Armor template in
Google Cloud, not the policy. The policy references the template, authenticates with a Google Cloud
service account, and turns the Model Armor verdict into a gateway action:

- **Allow**: Content with no filter match is forwarded unchanged.

- **Redact**: When SDP de-identification is enabled, sensitive content is replaced with the Model
  Armor de-identified text, then forwarded.

- **Reject**: Content that matches a filter is rejected with HTTP status `403`.

The policy operates in two independent phases:

- **Request phase**: Sends the recent conversation history of the request to `sanitizeUserPrompt`.
  Rejected prompts never reach the LLM.

- **Response phase**: Sends the LLM completion to `sanitizeModelResponse` before returning it to the
  client.

Both phases are enabled by default. Every moderated request and response emits observability headers
and metrics, and rejections record a policy violation.

## Before You Begin

Before configuring this policy, you need:

1.  **A Google Cloud project with the Model Armor API enabled.**

2.  **A Model Armor template** in that project that defines the filters to apply. You can use one
    template for both phases or separate templates for prompts and responses.

3.  **A Google Cloud service account key** (JSON) for a service account that has permission to call
    Model Armor sanitize operations on the template’s project and location. If the template uses
    advanced SDP configuration (linked inspect or de-identify templates), the service account also
    needs the Sensitive Data Protection permissions those templates require. For the required roles,
    see the
    [Model Armor documentation](https://cloud.google.com/security-command-center/docs/model-armor-overview).

4.  **The regional Model Armor endpoint** that matches the template’s location, for example,
    `https://modelarmor.us-central1.rep.googleapis.com`.

Ensure that Omni Gateway can reach the Model Armor endpoint and the Google OAuth token endpoint
(`https://oauth2.googleapis.com`) outbound.

The policy reads the `x-input-format` header, which the LLM proxy sets, to identify the caller’s LLM
format: `openai` or `gemini`. Requests with a missing or different format value, non-POST requests,
and requests without a JSON body pass through unscanned.

## Configuring Policy Parameters

### Omni Gateway Local Mode

The Google Model Armor Guardrails policy isn’t supported in Local Mode.

### Managed Omni Gateway and Omni Gateway Connected Mode

When you apply the policy from the UI, the following parameters are displayed:

### Basic Configuration

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Element</th><th>Required</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p>Model Armor Endpoint</p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>Regional Model Armor API base URL, for example, <code>https://modelarmor.us-central1.rep.googleapis.com</code>. The region must match the value of <strong>Location</strong>. The policy doesn’t validate this match. A mismatch surfaces as a Model Armor API error at runtime.</p></div></div></td></tr><tr><td><div><div><p>Service Account Key</p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>Google Cloud service account key JSON that the policy uses to obtain an OAuth 2.0 access token for the Model Armor API. This value is sensitive and is never logged.</p></div></div></td></tr><tr><td><div><div><p>Project</p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>Google Cloud project ID that owns the Model Armor template.</p></div></div></td></tr><tr><td><div><div><p>Location</p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>Model Armor location, either a region (for example, <code>us-central1</code> or <code>europe-west2</code>) or a multi-region (<code>us</code> or <code>eu</code>). Must match the region of <strong>Model Armor Endpoint</strong>.</p></div></div></td></tr><tr><td><div><div><p>Template</p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>Model Armor template ID. The policy combines <strong>Project</strong>, <strong>Location</strong>, and <strong>Template</strong> into the template resource name <code>projects/{project}/locations/{location}/templates/{template}</code>. Applies to both phases unless overridden by <strong>Request Template</strong> or <strong>Response Template</strong>.</p></div></div></td></tr><tr><td><div><div><p>Google OAuth Token Endpoint</p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>Google OAuth 2.0 token endpoint used to obtain the access token. Set this to <code>https://oauth2.googleapis.com</code> unless you use a non-default OAuth host.</p></div></div></td></tr><tr><td><div><div><p>Moderate Request</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>When enabled (default), the policy evaluates the prompt with <code>sanitizeUserPrompt</code> before forwarding it to the upstream LLM. Rejected prompts never reach the LLM.</p></div></div></td></tr><tr><td><div><div><p>Moderate Response</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>When enabled (default), the policy evaluates the LLM completion with <code>sanitizeModelResponse</code> before returning it to the client.</p></div><div><p>Streaming responses (<code>text/event-stream</code>) are also scanned. The policy buffers the entire stream and holds the response until the scan completes. This breaks the streaming experience for the client and increases latency and memory use.</p></div></div></td></tr></tbody></table>

### Advanced Configuration

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Element</th><th>Required</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p>Request Template</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Model Armor template ID to use for the request phase instead of <strong>Template</strong>.</p></div></div></td></tr><tr><td><div><div><p>Response Template</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Model Armor template ID to use for the response phase instead of <strong>Template</strong>.</p></div></div></td></tr><tr><td><div><div><p>Enable Multi-Language Detection</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>When enabled, the policy sets the Model Armor multi-language detection flag on each sanitize call so that non-English content is screened. Default: disabled.</p></div></div></td></tr><tr><td><div><div><p>De-identify Request</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>When enabled and the request-phase template uses advanced SDP with a de-identify template, an SDP match replaces the prompt with the de-identified text instead of rejecting it. Default: disabled. See <a href="#sdp-de-identification">SDP De-identification</a>.</p></div></div></td></tr><tr><td><div><div><p>De-identify Response</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>When enabled and the response-phase template uses advanced SDP with a de-identify template, an SDP match replaces the completion with the de-identified text instead of rejecting it. Applies to non-streaming responses only. On a streaming response, an SDP match is rejected. Default: disabled. See <a href="#sdp-de-identification">SDP De-identification</a>.</p></div></div></td></tr><tr><td><div><div><p>Inspect Only</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>When enabled, the policy reports verdicts in the observability headers but never rejects traffic. Use this to observe what Model Armor would block before enforcing a template. Default: disabled.</p></div></div></td></tr><tr><td><div><div><p>History Depth</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Maximum number of recent conversation messages included in the request-phase scan. 0 (default) scans the full conversation history. If the scanned text exceeds the Model Armor size limits, Model Armor skips detection and the policy forwards the request unscanned, with skip_detection in the reason header. Set this value to keep long conversations within he Model Armor size limits.</p></div></div></td></tr><tr><td><div><div><p>API Timeout (ms)</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Timeout in milliseconds for each Model Armor sanitize call and each OAuth token call. Must be between <code>1000</code> and <code>30000</code>. Values outside this range are set to the nearest limit. Default: <code>5000</code>.</p></div></div></td></tr><tr><td><div><div><p>Fail Open</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Determines behavior when the Model Armor call or the OAuth token call fails, times out, or returns no usable verdict:</p></div><div><ul><li><p>Disabled (default): Rejects with HTTP <code>503</code>.</p></li><li><p>Enabled: Allows traffic to proceed unscanned. The failure reason is still emitted in the reason header.</p></li></ul></div></div></td></tr></tbody></table>

## How This Policy Works

The Google Model Armor Guardrails policy integrates with Google Cloud Model Armor to evaluate LLM
prompts and responses.

### Authentication

The policy authenticates to Model Armor with an OAuth 2.0 access token that it obtains from the
Google OAuth token endpoint by using the configured service account key. The token is scoped to
`https://www.googleapis.com/auth/cloud-platform`, cached per gateway replica, and refreshed before
it expires.

The first request on each replica, and each token refresh, makes an extra call to the token endpoint
before the sanitize call. Each call is bounded by **API Timeout (ms)**, so these requests can take
up to twice the timeout before the fail-open or fail-closed behavior applies. Subsequent requests
use the cached token and add no authentication latency.

A token failure, such as an expired or revoked service account key, is handled the same way as a
Model Armor call failure.

### Request and Response Moderation

The policy supports independent evaluation for request and response:

1.  **Request Phase** (when Moderate Request is enabled):

    1.  The policy resolves the caller’s LLM format from the `x-input-format` header. Non-POST
        requests, unsupported formats, and non-JSON or empty bodies pass through unscanned.

    2.  The policy extracts the conversation text from the request body, limited by **History
        Depth**. For OpenAI, the policy supports the Chat Completions and Responses APIs. For
        Gemini, the policy supports `generateContent` and `streamGenerateContent` request bodies. If
        no text can be extracted, the request passes through unscanned.

    3.  The policy sends the text to `sanitizeUserPrompt` with the request-phase template.

    4.  The policy enforces the returned verdict. See [Outcomes and Actions](#outcomes-and-actions).

2.  **Response Phase** (when Moderate Response is enabled):

    1.  The policy buffers the LLM response and extracts the completion text. For streaming
        responses, the policy reassembles the completion from the stream’s chunks. If no completion
        text can be extracted, the response passes through unscanned.

    2.  The policy sends the completion to `sanitizeModelResponse` with the response-phase template.

    3.  The policy enforces the returned verdict. See [Outcomes and Actions](#outcomes-and-actions).

        > [!NOTE] Streaming responses (`text/event-stream`) are buffered and scanned when Moderate
        > Response is enabled. The client doesn’t receive the response until the scan completes. For
        > Gemini, only streaming with `alt=sse` is scanned.

If the request phase rejects the request, the response phase doesn’t run.

### Outcomes and Actions

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Model Armor Verdict</th><th>Action</th><th>Effect</th></tr></thead><tbody><tr><td><div><div><p>No match</p></div></div></td><td><div><div><p>Allow</p></div></div></td><td><div><div><p>Content is forwarded unchanged.</p></div></div></td></tr><tr><td><div><div><p>Match on SDP only, with de-identification enabled for the phase</p></div></div></td><td><div><div><p>Redact</p></div></div></td><td><div><div><p>The prompt or completion is replaced with the de-identified text that Model Armor returns, and traffic continues. See <a href="#sdp-de-identification">SDP De-identification</a>.</p></div></div></td></tr><tr><td><div><div><p>Match</p></div></div></td><td><div><div><p>Reject</p></div></div></td><td><div><div><p>The request phase returns an HTTP <code>403</code> response instead of calling the LLM. The response phase rewrites the LLM response to an HTTP <code>403</code> response. A policy violation is recorded.</p></div></div></td></tr><tr><td><div><div><p>Match, with Inspect Only enabled</p></div></div></td><td><div><div><p>Allow</p></div></div></td><td><div><div><p>Traffic continues. The matched filters populate the reason header.</p></div></div></td></tr><tr><td><div><div><p>Error, timeout, or no usable verdict</p></div></div></td><td><div><div><p>Depends on Fail Open</p></div></div></td><td><div><div><p>When fail-open is disabled, the policy returns an HTTP <code>503</code> response and records a policy violation. When fail-open is enabled, traffic passes through unscanned.</p></div></div></td></tr></tbody></table>

If Model Armor skips detection for a filter, for example, because the content exceeds the Model
Armor size limits, the skip doesn’t block traffic. The policy adds `skip_detection` to the reason
header so the coverage gap is visible.

Model Armor scans only the first 40 URLs in each interaction for malicious URL detection.

### SDP De-identification

By default, an SDP match rejects the content. To redact sensitive data instead, enable **De-identify
Request** or **De-identify Response** and reference a Model Armor template that uses advanced SDP
with a de-identify template.

The policy rejects the content instead of redacting it when:

- The template doesn’t return de-identified text, for example, because it has no de-identify
  template.

- A filter other than SDP also matched.

- The scanned text spans more than one message or content part, so the policy can’t write the
  de-identified text back to a single field. For example, a multi-turn conversation scanned with the
  default **History Depth** of `0`, or a multimodal message with several content parts.

- The response is a stream. The policy can’t write the de-identified text back into a stream.

## Example Configurations

The following examples demonstrate common configuration patterns for the Google Model Armor
Guardrails policy.

### Minimal Configuration: Both Phases, One Template

`moderateRequest` and `moderateResponse` default to `true`, so both the prompt and the completion
are scanned against the same template, and the policy fails closed with a 5000 ms timeout.

```yaml
- policyRef:
    name: google-model-armor-guardrails-policy-v1-0-impl
    namespace: default
  config:
    modelArmorEndpoint: https://modelarmor.europe-west2.rep.googleapis.com
    tokenEndpoint: https://oauth2.googleapis.com
    serviceAccountKey: "${GOOGLE_MODEL_ARMOR_SA_KEY}"
    project: my-security-project
    location: europe-west2
    template: prod-guardrail
```

### Separate Request and Response Templates

A prompt-injection-focused template for the request phase and a data-leakage-focused template for
the response phase.

```yaml
- policyRef:
    name: google-model-armor-guardrails-policy-v1-0-impl
    namespace: default
  config:
    modelArmorEndpoint: https://modelarmor.us.rep.googleapis.com
    tokenEndpoint: https://oauth2.googleapis.com
    serviceAccountKey: "${GOOGLE_MODEL_ARMOR_SA_KEY}"
    project: my-security-project
    location: us
    template: shared-baseline
    advancedConfiguration:
      requestTemplate: injection-strict-input
      responseTemplate: leakage-strict-output
      apiTimeoutMs: 8000
```

### SDP De-identification

On an SDP match, sensitive data is redacted in place and traffic continues. Matches on other filters
are still rejected.

```yaml
- policyRef:
    name: google-model-armor-guardrails-policy-v1-0-impl
    namespace: default
  config:
    modelArmorEndpoint: https://modelarmor.us-central1.rep.googleapis.com
    tokenEndpoint: https://oauth2.googleapis.com
    serviceAccountKey: "${GOOGLE_MODEL_ARMOR_SA_KEY}"
    project: my-security-project
    location: us-central1
    template: sdp-deidentify-guardrail
    advancedConfiguration:
      deidentifyRequest: true
      deidentifyResponse: true
      historyDepth: 1
      enableMultiLanguageDetection: true
```

`historyDepth: 1` limits the request scan to the last message so that the de-identified text can be
written back to the request.

### Inspect Only, Fail Open

No traffic is ever rejected. Matched filters surface in the reason header, and if Model Armor is
unreachable, traffic proceeds unscanned. Use this to measure the impact of a template before
enforcing it.

```yaml
- policyRef:
    name: google-model-armor-guardrails-policy-v1-0-impl
    namespace: default
  config:
    modelArmorEndpoint: https://modelarmor.us-central1.rep.googleapis.com
    tokenEndpoint: https://oauth2.googleapis.com
    serviceAccountKey: "${GOOGLE_MODEL_ARMOR_SA_KEY}"
    project: my-security-project
    location: us-central1
    template: prod-guardrail
    advancedConfiguration:
      inspectOnly: true
      failOpen: true
```

## See Also

- [Google Cloud Model Armor documentation](https://cloud.google.com/security-command-center/docs/model-armor-overview)

- [Azure Content Safety Policy](https://docs.mulesoft.com/gateway/latest/policies-included-azure-content-safety)

- [Amazon Bedrock Guardrails Policy](https://docs.mulesoft.com/gateway/latest/policies-included-bedrock-guardrails)

- [Creating and Managing Model Proxies](https://docs.mulesoft.com/general/model-proxy)

- [Applying Model Proxy Policies](https://docs.mulesoft.com/general/model-proxy-policies)