The routing decision
happens on-device,
before data leaves

from ogentic_router import Policy, Router

policy = Policy.from_yaml("policy.yaml")
router = Router(policy)          # default classifier: ogentic-shield

decision = router.route(
    "Draft a note about the privileged settlement memo."
)

print(decision.backend_id)   # -> ollama-local   (privilege stays local)
print(decision.rule_id)      # -> privilege-stays-local
print(decision.reasoning)    # -> why this rule fired

# route() returns a decision, not a completion — you dispatch to
# decision.backend_id yourself, after the choice is already recordable.

# 1. start the local router (one terminal)
#    ROUTER_CONFIG=router.yaml ogentic-router serve   # 127.0.0.1:8080

from openai import OpenAI

client = OpenAI(
    base_url="http://127.0.0.1:8080/v1",   # <- the only change
    api_key="not-used-by-the-router",       # server holds real keys
)

resp = client.chat.completions.create(
    model="gpt-4o-mini",
    messages=[{"role": "user", "content": "Say hello."}],
)

# Inspect what the router will do: GET /v1/policy

version: 1
default_backend: ollama-local

deny_cloud:                      # fail-closed (on by default)
  enforce: true
  groups: [PRIVILEGE, PHI, MNPI]

rules:                           # first match wins
  - id: privilege-stays-local
    when: { groups_include: [PRIVILEGE, PHI, MNPI] }
    route: ollama-local
  - id: medium-redact-then-cloud
    when: { sensitivity_score_gte: 30 }
    route: openai-cloud
    transform: shield_redact
  - id: low-cloud
    when: { sensitivity_score_gte: 0 }
    route: openai-cloud

pip install "ogentic-router[shield,cloud,local]"

# route one prompt; print the decision (never calls a backend)
ogentic-router route --policy policy.yaml \
  --prompt "attorney work product"

# the safe "what would happen" inspector — no server, no model call
ogentic-router policies dry-run policy.yaml --prompt "..."

# boot the OpenAI-shaped server (or the stdio MCP surface with --mcp)
ogentic-router serve --config router.yaml --port 8080