Azure OpenAI
Evaluate input before Azure OpenAI runs and buffer output for a second decision.
Recipe: use your deployment name and an API version supported by that deployment. The public OpenAI live test does not certify Azure networking, identity or model deployment settings.
Prepare the boundary
Complete the quickstart, set NYRAXIS_API_KEY and NYRAXIS_BASE_URL, and configure an applicable policy for the docs-integration agent. Keep all credentials server-side.
python -m pip install nyraxis-sdk==1.3.2 openaiSave nyraxis_gate.py beside your application. It evaluates input before calling your generator, requires a complete non-empty policy evaluation, then checks buffered output before returning it. Permission errors, incomplete checks and transport failures interrupt the operation.
Connect Azure OpenAI
Set the provider environment variables referenced below. Save this as example.py beside nyraxis_gate.py, then run python example.py.
import os
from openai import AzureOpenAI
from nyraxis_gate import guarded_text_call
model = AzureOpenAI(api_key=os.environ["AZURE_OPENAI_API_KEY"], azure_endpoint=os.environ["AZURE_OPENAI_ENDPOINT"], api_version=os.environ["AZURE_OPENAI_API_VERSION"])
def generate(prompt):
result = model.chat.completions.create(model=os.environ["AZURE_OPENAI_DEPLOYMENT"], messages=[{"role": "user", "content": prompt}])
return result.choices[0].message.content or ""
print(guarded_text_call("Explain how to contact support.", generate))The provider API follows its upstream documentation. Pin that provider/framework version in your application lockfile. Recipe status is distinct from a live account test; review the support matrix.
Verify this integration
Run one safe prompt, one synthetic Secrets detection input, and one case where the generated output contains the synthetic password marker. Count provider calls: input blocking should stop the generator; output blocking should prevent the buffered answer from reaching the user. Repeat with an unreachable Nyraxis API and verify that the request does not proceed.
This boundary checks complete text. It does not automatically authorize tools, inspect every internal step, or block tokens after they have been emitted. Add application permissions before side effects and separate gates for intermediate untrusted data.