> ## Documentation Index
> Fetch the complete documentation index at: https://docs.prysm1.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance routing

> Policy-as-Code: load your approved providers and PRYSM routes every request only to models that satisfy your jurisdiction, framework, certification, and data-residency rules — with an auditable attestation of where each request could go.

More and more teams run multi-model workloads, but few can answer the questions that
matter to a security or legal review: **which provider actually served this request, under
which jurisdiction was it processed, and where is the data retained?** Compliance routing
turns those answers into a guarantee you declare once and enforce on every call.

You load the AIs your organization approves; PRYSM **routes only to models that satisfy
your policy** and refuses the rest — before a model is ever scored or called.

<Note>
  Compliance is **strictly opt-in**. With no policy set, routing is byte-for-byte
  unchanged and every model is eligible. A policy only ever *removes* models from
  consideration — it never changes how the survivors are ranked.
</Note>

## The four pieces

<CardGroup cols={2}>
  <Card title="Regulatory Compliance Matrix" icon="table-cells">
    A baseline map of each provider → jurisdiction, data regions, supported frameworks,
    certifications, and retention posture.
  </Card>

  <Card title="Policy-as-Code" icon="file-shield">
    Your declarative rules: approved providers, jurisdictions, required frameworks &
    certifications, data residency, blocked data classes, zero-retention.
  </Card>

  <Card title="Content classification" icon="magnifying-glass">
    A fast, local scan that flags PII / PHI / FINANCIAL / SECRETS in the prompt — by
    pattern only, never by calling a model.
  </Card>

  <Card title="Hard exclusion filter" icon="filter-circle-xmark">
    Non-compliant models are removed from the candidate pool *before* scoring, so the
    engine cannot pick one — and each decision is attested.
  </Card>
</CardGroup>

## The policy

A policy is a small set of constraints. Every field is optional; set only what you need.

| Field                    | Meaning                                                                                       |
| ------------------------ | --------------------------------------------------------------------------------------------- |
| `provider_allowlist`     | If set, **only** these providers are eligible.                                                |
| `provider_denylist`      | These providers are always excluded.                                                          |
| `jurisdiction`           | The provider's governing jurisdiction must be one of these (e.g. `US`, `EU`).                 |
| `data_residency`         | The provider's data regions must be a **subset** of these — no leakage outside the region.    |
| `frameworks`             | The provider must support **all** of these (e.g. `GDPR`, `CCPA`, `LGPD`).                     |
| `certifications`         | The provider must hold **all** of these (e.g. `SOC2`, `ISO27001`, `HIPAA`).                   |
| `block_data_classes`     | Data classes that may not reach a non-cleared provider: `PII`, `PHI`, `FINANCIAL`, `SECRETS`. |
| `require_zero_retention` | The provider must offer a zero-retention / no-train mode.                                     |

<Warning>
  The compliance matrix is an **editable baseline for routing decisions, not legal advice**
  and not a verified statement of any third party's certifications. Confirm a provider's
  posture against your own contracts before relying on it.
</Warning>

## Content classification (the prompt never leaves to be classified)

Before routing, PRYSM scans the request text **locally** for sensitive data classes using
regex / keyword / checksum heuristics only. The text is *never* sent to a model to be
classified, and the scan does nothing but match patterns:

* **PII** — emails, phone numbers, national IDs.
* **PHI** — medical-record and health identifiers (clears only via a `HIPAA` certification).
* **FINANCIAL** — card numbers (Luhn-checked), IBANs, account numbers.
* **SECRETS** — API keys, access tokens, private keys.

If a detected class appears in your `block_data_classes` and no approved provider is
cleared for it, the candidate pool collapses to empty and the request is refused
(`fail-closed`) rather than routed somewhere it shouldn't go.

## Hard exclusion *before* scoring

This is the core guarantee. PRYSM applies the policy as a **filter on the candidate pool**,
then routes among only what survives. A non-compliant model is never scored, never a
fallback, and never reachable — not by a routing rule, not by a hard `model` lock.

```
prompt ─▶ classify (local) ─▶ COMPLIANCE FILTER ─▶ route / orchestrate ─▶ attest
                                     │
                non-compliant models removed from the pool here
```

This applies everywhere a model is chosen: [`/v1/chat/completions`](/api-reference/chat-completions),
[`/v2/orchestrate`](/api-reference/orchestrate), and [`/v2/code`](/api-reference/code).

## Preview before you spend

[`/v2/compliance/preview`](/api-reference/compliance-preview) is a **pure dry-run** — no
model is called, so it costs nothing and needs no provider keys. It shows exactly what a
policy would do for a given prompt:

* the data classes the text triggers, and what matched;
* which models are **allowed** vs **excluded**, with a reason per exclusion;
* the **Compliance Cost Premium** — what staying compliant costs versus the cheapest
  unrestricted model;
* a sample **attestation** hash for your audit trail.

```python theme={null}
from prysm import Prysm

client = Prysm()
p = client.compliance_preview(
    "summarize this patient's chart",
    compliance={"frameworks": ["HIPAA"], "block_data_classes": ["PHI"]},
)
print(p["allowed_models"])              # only HIPAA-cleared providers survive
print(p["compliance_cost_premium"])     # what that costs vs. unrestricted
```

## Set it where it belongs

<CardGroup cols={2}>
  <Card title="In BRAIN.md (version-controlled)" icon="file-code">
    Add a `compliance:` block so the policy is reviewed in pull requests and applied to
    every request automatically.
  </Card>

  <Card title="Inline per request" icon="sliders">
    Pass `compliance=` to `orchestrate()` / `complete()` (or the `compliance` field in the
    REST body) to confine a single call.
  </Card>
</CardGroup>

```yaml BRAIN.md theme={null}
# Only EU-resident, GDPR-supporting providers may serve any request,
# and personal data may never reach a provider outside the EU.
compliance:
  jurisdiction: ["EU"]
  frameworks: ["GDPR"]
  data_residency: ["EU"]
  block_data_classes: ["PII"]
```

## Auditable by design

Every confined run carries a **compliance attestation** — a SHA-256 receipt binding the
policy, the detected data classes, the exclusion decisions, and the chosen model. Paired
with [PrysmProof](/concepts/prysmproof), it proves not just *that* a response was produced,
but that it was produced **within policy** — and what it cost relative to the unrestricted
reference.

<CardGroup cols={2}>
  <Card title="Preview endpoint" icon="eye" href="/api-reference/compliance-preview">
    Dry-run a policy against any prompt — allowed/excluded models, classes, CCP, attestation.
  </Card>

  <Card title="BRAIN.md" icon="file-code" href="/concepts/brain-md">
    Declare the `compliance:` block alongside your routing rules and cost guardrails.
  </Card>

  <Card title="AgentGuard" icon="shield-halved" href="/concepts/agentguard">
    Compliance pairs with cost caps and model blocks — both run after selection and win.
  </Card>

  <Card title="PrysmProof" icon="fingerprint" href="/concepts/prysmproof">
    The verifiable receipt the compliance attestation attaches to.
  </Card>
</CardGroup>