>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3584851. --> Reported by: [marcus_johansson](https://www.drupal.org/user/385947) Related to !1495 >>> <p>[Tracker]<br> <strong>Update Summary: </strong>[One-line status update for stakeholders]<br> <strong>Short Description: </strong>Allow configuring one or more guardrail sets to be applied globally to every AI request via the pre-request event.<br> <strong>Check-in Date: </strong>MM/DD/YYYY<br> [/Tracker]</p> <h3 id="summary-problem-motivation">Problem/Motivation</h3> <p>Today, the <code>GuardrailsEventSubscriber</code> only runs guardrails when the input explicitly has a guardrail set attached (via <code>InputInterface::getGuardrailSet()</code>). This means any caller that does not opt in - custom code, third-party modules, agents, tools, or features that build their own <code>ChatInput</code> - bypasses guardrails entirely.</p> <p>Site builders that want to enforce safety, compliance, or PII guardrails across every AI call currently have to rely on each integration point remembering to attach a guardrail set. That is fragile and easy to miss, and it makes it impossible to guarantee that a given site never sends prompts to a provider without going through a given set of checks.</p> <p>We should give site builders a way to configure "global" guardrails: guardrail sets that are always applied to every request, regardless of whether the caller attached one. This can be implemented cleanly by subscribing to the documented pre-request event and applying the configured guardrail sets there. See the pre-request event example in the <a href="https://project.pages.drupalcode.org/ai/1.3.x/developers/events/#example-1-pre-request">AI module events documentation</a>.</p> <h3 id="summary-proposed-resolution">Proposed resolution</h3> <ul> <li><span class="drupalorg-gitlab-issue-link project-issue-status-info project-issue-status-2"><a href="https://www.drupal.org/project/ai/issues/3584849" title="Status: Fixed">#3584849: Allow InputInterface to hold and run multiple guardrail sets</a></span> needs to be merged first</li> <li>Add a new setting to <code>ai.settings.yml</code> (for example <code>global_guardrails</code>) that stores a list of guardrail set IDs to apply to every request.</li> <li>Add a UI for this setting. The form most likely belongs under the existing Guardrails form/section rather than the general AI settings, since the concept is guardrail-specific. Open question: surface it as a separate "Global guardrails" tab/fieldset, or inline at the top of the guardrail set list.</li> <li>Implement an event subscriber on the pre-request event that loads the configured global guardrail sets and applies them to the input, reusing the existing <code>GuardrailsEventSubscriber</code> logic (pre- and post-generate) so behavior is identical to per-request guardrails.</li> <li>Make sure the <code>StopResult</code>/threshold aggregation still works correctly when multiple sets are evaluated in sequence.</li> <li>Add tests covering: no input guardrail set + global set applies, input guardrail set + global set both apply, stop threshold triggered by global guardrail, and rewrite input/output results from a global guardrail.</li> <li>Document the new setting under the Guardrails documentation and note that it uses the pre-request event so module developers understand when it fires.</li> </ul> <h3 id="summary-ai-usage">AI usage (if applicable)</h3> <p>[x] AI Assisted Issue<br> This issue was generated with AI assistance, but was reviewed and refined by the creator.</p> <p>[ ] AI Assisted Code<br> [x] AI Generated Code<br> [ ] Vibe Coded</p> <p>- <strong>This issue was created with the help of AI</strong></p> > Related issue: [Issue #3584849](https://www.drupal.org/node/3584849)