Contact Us 1-800-596-4880
  1. Homepage
  2. Omni Gateway (1.14)
  3. Securing Omni Gateway Instances with Policies
  4. Inbound Policies Directory

  5. F5 Guardrails

F5 Guardrails Policy

Policy Name

F5 Guardrails Policy

Summary

Evaluates LLM prompts and responses against F5 AI Guardrails, blocking, flagging, or redacting flagged content

Category

LLM

First Omni Gateway version available

v1.14.0

Release Notes

F5 Guardrails Policy

Returned Status Codes

200 - OK: Content blocked by F5 AI Guardrails. The response is a native content-filter response for the caller’s LLM format.

503 - Service Unavailable: F5 scan call failed or returned no verdict (only when fail-open is disabled)

Summary

The F5 Guardrails policy provides content moderation for LLMs by evaluating prompts and responses against F5 AI Guardrails. The policy calls the F5 (POST /backend/v1/scans) API and enforces the returned verdict at the gateway before the request reaches the upstream LLM (request phase) or before the response is returned to the client (response phase).

Which F5 scanners run and how they behave (harmful content, prompt injection, PII and other sensitive data, data leakage, and so on) is owned by your F5 project configuration, not the policy. The policy is the enforcement point that turns an F5 verdict into a gateway action:

  • Allow: Cleared content is forwarded unchanged.

  • Flag: Flagged content is allowed but a policy violation is recorded (audit).

  • Redact: Sensitive content is masked in place using F5’s redaction, then forwarded.

  • Reject: Blocked content is rejected. The client receives a native content-filter response for its LLM format (OpenAI, Anthropic, or Gemini) with HTTP status 200.

The policy operates in two independent phases:

  • Request phase: Sends the whole request body to F5 with scanDirection: request. Rejected prompts never reach the LLM.

  • Response phase: Sends the whole LLM response body to F5 with scanDirection: response before returning it to the client. This response phase is off by default.

Every scan emits observability headers, a scan ID for correlation with the F5 console, a per-call metric, and records a policy violation for the Flag or Reject outcomes.

Before You Begin

Before configuring this policy, you need:

  1. F5 AI Guardrails access (SaaS tenant or a self-hosted deployment).

  2. An F5 AI Guardrails endpoint URL, for example, https://us1.calypsoai.app.

  3. An F5 API token issued from the F5 console.

  4. (Optional) An F5 project ID or friendly ID whose F5 scanner configuration the scan should use.

If you connect to F5 SaaS, ensure the Omni Gateway can reach the F5 host outbound.

The policy reads the x-input-format header, which the LLM proxy sets, to identify the caller’s LLM format: openai, anthropic, or gemini. If the header is absent, the policy uses openai. Traffic with any other format value, or a non-JSON body, passes through unscanned.

Configuring Policy Parameters

Omni Gateway Local Mode

The F5 Guardrails policy isn’t supported in Local Mode.

Managed Omni Gateway and Omni Gateway Connected Mode

When you apply the policy from the UI, the following parameters are displayed:

Basic Configuration

Element Required Description

F5 AI Guardrails Endpoint

Yes

F5 AI Guardrails base URL, for example, https://us1.calypsoai.app. The policy appends /backend/v1/scans at call time.

F5 API Token

Yes

F5 AI Guardrails API token. Enter the raw token without a Bearer prefix. The policy sends it as Authorization: Bearer <token> on every scan call. This value is sensitive and is never logged.

F5 Project

No

F5 project ID or friendly ID. When set, it’s sent as the project field so the scan uses that project’s F5 scanner configuration. When omitted, the token’s globally available F5 scanners are used.

Moderate Request

No

When enabled (default), the policy evaluates the user prompt against F5 AI Guardrails (scanDirection: request) before forwarding to the upstream LLM. Rejected prompts never reach the LLM.

Moderate Response

No

When enabled, the policy evaluates the LLM response (scanDirection: response) before returning it to the client. Default: disabled.

Streaming responses (text/event-stream) are also scanned. The policy buffers the entire stream and holds the response until the scan completes. This breaks the streaming experience for the client and increases latency and memory use.

Advanced Configuration

Element Required Description

Apply Redaction

No

When enabled (default), a redacted outcome rewrites the request or response body with the F5-supplied masked text and lets traffic continue. When disabled, a redacted outcome is handled like a blocked outcome and rejected with a native content-filter response (HTTP 200). See Outcomes and Actions.

Flag Only (Audit Mode)

No

When enabled, the scan carries flagOnly: true so blockable F5 scanners return flagged instead of blocked, and the policy never rejects for an F5 scanner hit. A policy violation is still recorded. Use this to observe what F5 would block without enforcing. Default: disabled.

Disabled Scanners

No

F5 scanner IDs to disable, sent as the disabled array. Applies to both phases unless overridden per phase by Request-Phase or Response-Phase Scanner Overrides. Overrides the project or token defaults for the named F5 scanners.

Force-Enabled Scanners

No

F5 scanner IDs to force-enable, sent as the forceEnabled array, even if disabled in the project. Applies to both phases unless overridden per phase.

Request-Phase Scanner Overrides

No

Per-phase F5 scanner selection for the request (prompt) scan, with optional disabledScanners and forceEnabledScanners arrays. See Per-Phase Scanner Selection.

Response-Phase Scanner Overrides

No

Per-phase F5 scanner selection for the response (completion) scan. Same shape as Request-Phase Scanner Overrides. See Per-Phase Scanner Selection.

Verbose

No

When enabled, the policy requests more detailed scanner results from F5. The extra detail enriches the reason header and debug logs. Default: disabled.

API Timeout (ms)

No

Per-request timeout for each F5 scan call in milliseconds. Must be between 1000 and 30000. Default: 5000.

Fail Open

No

Determines behavior when the F5 scan call fails, times out, or returns no verdict:

  • Disabled (default): Rejects with HTTP 503.

  • Enabled: Allows traffic to proceed unscanned (fail-open mode).

How This Policy Works

The F5 Guardrails policy integrates with F5 AI Guardrails to evaluate LLM prompts and responses.

Request and Response Moderation

The policy supports independent evaluation for request and response:

  1. Request Phase (when Moderate Request is enabled):

    1. The policy resolves the caller’s LLM format from the x-input-format header. Traffic in an unsupported format, or with a non-JSON or empty body, passes through unscanned.

    2. The policy sends the whole request body to POST {endpoint}/backend/v1/scans with scanDirection: request.

    3. The policy enforces the returned outcome. See Outcomes and Actions.

    4. If the prompt passes (cleared or flagged), the policy forwards the request to the upstream LLM. On redacted, it forwards a masked version. On blocked, it returns a native content-filter response with HTTP 200.

  2. Response Phase (when Moderate Response is enabled):

    1. The policy buffers the LLM response.

    2. The policy sends the whole response body to F5 with scanDirection: response.

    3. The policy enforces the returned outcome. See Outcomes and Actions.

    4. If the response passes, the policy forwards it unchanged. On redacted, the body is rewritten with the masked body. On blocked, the response is rewritten to a native content-filter response with HTTP 200.

      Streaming responses (text/event-stream) are buffered and scanned when Moderate Response is enabled. The client doesn’t receive the response until the scan completes.

When both phases scan, the client-visible response headers reflect the response-phase decision. They reflect the request-phase decision only when the response isn’t scanned.

Outcomes and Actions

The policy enforces the global result.outcome returned by F5:

F5 Outcome Action Effect

cleared

Allow

Content is forwarded unchanged. No policy violation recorded.

flagged

Flag

Traffic continues, a policy violation is recorded, and the failed F5 scanner names populate the reason header. This is the outcome for audit (non-blocking) F5 scanners and for every blockable F5 scanner when Flag Only is enabled.

redacted

Redact

When Apply Redaction is enabled (default), the whole request or response body is replaced with the masked body that F5 returns, traffic continues, and a policy violation is recorded. If F5 returns no masked body, the policy fails closed and rejects the content with the reason redaction_failed. When Apply Redaction is disabled, the outcome is treated as blocked.

blocked

Reject

The request phase returns a native content-filter response instead of calling the LLM; the response phase rewrites the LLM response to a native content-filter response. Both use HTTP 200. A policy violation is recorded. Any unrecognized outcome is also treated as blocked so an unexpected verdict never silently passes.

none (no verdict)

Indeterminate

An empty or none outcome isn’t treated as a block. It’s resolved by the Fail Open setting: fail-closed returns an HTTP 503 error with the reason none_response, fail-open passes traffic through unscanned.

Every non-cleared outcome records a policy violation and adds the failed F5 scanner names to the reason header.

Per-Phase Scanner Selection

The disabled and forceEnabled F5 scanner lists sent on each scan are resolved per phase, so the request (prompt) and response (completion) phases can target different F5 scanner sets:

  • The request phase uses Request-Phase Scanner Overrides when set, otherwise the global Disabled Scanners and Force-Enabled Scanners lists.

  • The response phase uses response-phase scanner overrides with the same global fallback.

  • Each list falls back independently. An explicitly empty per-phase array ([]) replaces (clears) the global list for that phase; an unset array falls back to the global list.

When neither per-phase override is set, the global lists apply to both phases. If a per-phase override is set for a phase whose moderation is disabled, the override can never take effect, and the policy logs a startup warning.

Example Configurations

Minimal Configuration — Both Phases, Enforce and Redact

moderateRequest and applyRedaction default to true, so the prompt is scanned, sensitive data is masked in place on a redacted verdict, and blocked content returns a native content-filter response. moderateResponse defaults to false. Add it to also scan the LLM response.

- policyRef:
    name: f5-guardrails-policy-v1-0-impl
    namespace: default
  config:
    f5Endpoint: https://us1.calypsoai.app
    f5ApiToken: "${F5_GUARDRAILS_TOKEN}"
    f5Project: "<your-f5-project-id>"

Audit Mode — Observe Without Enforcing

No request is ever blocked. Every F5 scanner hit surfaces as flag with a policy violation and reason header. Use this to measure impact before switching to enforcement.

- policyRef:
    name: f5-guardrails-policy-v1-0-impl
    namespace: default
  config:
    f5Endpoint: https://us1.calypsoai.app
    f5ApiToken: "${F5_GUARDRAILS_TOKEN}"
    f5Project: "<your-f5-project-id>"
    advancedConfiguration:
      flagOnly: true
      applyRedaction: false

Request-Only, Fail-Open, Custom Scanners

Only the prompt is scanned, one F5 scanner is disabled for this route, and if F5 is unreachable the request proceeds unscanned (with the reason header emitted).

- policyRef:
    name: f5-guardrails-policy-v1-0-impl
    namespace: default
  config:
    f5Endpoint: https://eu1.calypsoai.app
    f5ApiToken: "${F5_GUARDRAILS_TOKEN}"
    f5Project: "prod-chat"
    moderateRequest: true
    moderateResponse: false
    advancedConfiguration:
      disabledScanners: ["01983d0c-f1cc-700a-ab56-6600efc7dfb9"]
      apiTimeoutMs: 8000
      failOpen: true

Per-Phase Scanner Selection

The request scan and response scan target independent F5 scanner sets. The request phase clears the global disable list and force-enables an F5 scanner; the response phase keeps the global disable and adds another F5 scanner.

- policyRef:
    name: f5-guardrails-policy-v1-0-impl
    namespace: default
  config:
    f5Endpoint: https://us1.calypsoai.app
    f5ApiToken: "${F5_GUARDRAILS_TOKEN}"
    f5Project: "prod-chat"
    advancedConfiguration:
      disabledScanners: ["01983d0c-f1cc-700a-ab56-6600efc7dfb9"]
      requestScanners:
        disabledScanners: []
        forceEnabledScanners: ["019f3a1b-2c3d-4e5f-6071-8293a4b5c6d7"]
      responseScanners:
        forceEnabledScanners: ["01a2b3c4-d5e6-7089-abcd-ef0123456789"]

See Also