Request routing is a policy mechanism that sends a prompt, task, or API call to a different model, system, or workflow path based on rules such as sensitivity, user role, content type, or risk score. In practice, a normal request might go to a general-purpose model, while a sensitive request is redirected to a stricter system with more logging, verification, or human review.
In cyber security, request routing matters because it helps control what an AI agent is allowed to do. It can keep high-risk tasks out of broad-use paths, reduce exposure of secrets, and separate defensive analysis from actions that touch files, tools, or networks. Attackers may try to influence routing by disguising malicious requests as harmless ones, while defenders use routing to contain blast radius, enforce policy, and apply stronger safeguards to suspicious workflows. Proper routing is one of the core controls that turns AI from an open-ended helper into a governed security component.