Integrate and govern every model call that runs through a LiteLLM

LiteLLM is now a first-class source. Point a proxy at the platform and each call is checked against your prompt policies before it reaches the model, so a prompt that violates policy is stopped at the proxy rather than caught after inference and billed for. The model's reply comes back through the same ingestion path and lands in the same session, attributed to the same person, which means risk analysis reads a complete exchange instead of half of one. Because the enforcement sits at the proxy, this covers every model your LiteLLM deployment fronts without changes to the applications calling it. Identity is resolved from the virtual key's organization-scoped email, so an integration key or a client-supplied end-user field can never stand in for a real actor, and LiteLLM's own call, trace, user, team, and end-user IDs travel through as telemetry dimensions you can pivot on later.

Features

• Prompt policies are enforced before inference #4812 - An authenticated LiteLLM Generic Guardrail endpoint evaluates each prompt against your policies on the pre-call hook and records blocked prompts as durable findings. Non-interactive calls are blocked outright rather than issued an acknowledgement link no one is there to click. (Author: @danielkov)
• Responses are captured into the session that produced them #4815 - Post-call responses are stored as assistant messages through the same ingestion path every other source uses, and a per-call attribution cache keeps the pre-call actor and session attached so a prompt and its reply never split across two identities. On a cache miss, attribution falls back to trusted response metadata and never to the integration key. Tool calls in the model output are retained as metadata rather than turned into execution records, and captured responses feed asynchronous risk analysis. (Author: @danielkov)
• Internal: trusted in-process hook ingestion #4808 - The groundwork the two features above are built on. A trusted entry point lets an in-process caller ingest with a pre-authenticated organization and project identity, mirroring the enforcement, idempotency, telemetry, and conversation capture of the public path without a network hop, and stripping transport credentials before applying the supplied identity. No user-visible change on its own. (Author: @danielkov)