From bcee01a7a7a3a29c5f6e54a0045ff3688d2dbdef Mon Sep 17 00:00:00 2001
From: mateo-berri <277851410+mateo-berri@users.noreply.github.com>
Date: Sat, 29 Aug 2026 21:52:52 -0700
Subject: [PATCH] fix(policy_engine): merge guardrail metadata writes back on
 block and modify_response so failure spend records keep guardrail cost and
 status

---
 .../proxy/policy_engine/pipeline_executor.py  |  2 +
 litellm/proxy/utils.py                        |  7 +++-
 .../proxy_logging/test_guardrail_pipeline.py  | 38 +++++++++++++++++++
 3 files changed, 46 insertions(+), 1 deletion(-)

diff --git a/litellm/proxy/policy_engine/pipeline_executor.py b/litellm/proxy/policy_engine/pipeline_executor.py
index 4c192a50096..0c3ceb53707 100644
--- a/litellm/proxy/policy_engine/pipeline_executor.py
+++ b/litellm/proxy/policy_engine/pipeline_executor.py
@@ -236,6 +236,7 @@ class PipelineExecutor:
                     step_results=step_results,
                     error_message=error_detail,
                     original_exception=original_exception,
+                    modified_data=working_data if working_data != data else None,
                 )
 
             if action == "modify_response":
@@ -243,6 +244,7 @@ class PipelineExecutor:
                     terminal_action="modify_response",
                     step_results=step_results,
                     modify_response_message=step.modify_response_message or error_detail,
+                    modified_data=working_data if working_data != data else None,
                 )
 
             # action == "next" → continue to next step
diff --git a/litellm/proxy/utils.py b/litellm/proxy/utils.py
index f9d018bc452..dbcea834d50 100644
--- a/litellm/proxy/utils.py
+++ b/litellm/proxy/utils.py
@@ -1838,7 +1838,9 @@ class ProxyLogging:
         payload (already sent upstream) must stay untouched; a replacement
         response carried in ``modified_data`` is adopted by the caller, and
         metadata-bucket writes (applied guardrails, guardrail logging info)
-        are merged back so headers and spend logs still see them. On the
+        are merged back so headers and spend logs still see them, on block
+        and modify_response too, so failure spend records keep guardrail
+        cost and status. On the
         streaming path it is the buffered chunk list, carried into
         ``ModifyResponseException.original_response`` for usage reporting.
         """
@@ -1850,6 +1852,9 @@ class ProxyLogging:
                     _merge_pipeline_metadata_writes(data, result.modified_data)
             return data
 
+        if result.modified_data is not None:
+            _merge_pipeline_metadata_writes(data, result.modified_data)
+
         if result.terminal_action == "block":
             original_exception: Final = result.original_exception
             if original_exception is not None and not _exception_changes_request_flow(original_exception):
diff --git a/tests/test_litellm/proxy/utils/proxy_logging/test_guardrail_pipeline.py b/tests/test_litellm/proxy/utils/proxy_logging/test_guardrail_pipeline.py
index 74bd2e483cc..d9b3578c966 100644
--- a/tests/test_litellm/proxy/utils/proxy_logging/test_guardrail_pipeline.py
+++ b/tests/test_litellm/proxy/utils/proxy_logging/test_guardrail_pipeline.py
@@ -1197,6 +1197,44 @@ async def test_post_call_pipeline_guardrail_metadata_writes_reach_request_data(
     assert slg_entries[0]["guardrail_name"] == "gr-post"
 
 
+@pytest.mark.asyncio
+async def test_post_call_pipeline_block_keeps_guardrail_metadata_writes(
+    proxy_logging, make_user_api_key_auth, monkeypatch
+):
+    class BlockingWriterGuardrail(CustomGuardrail):
+        async def async_post_call_success_hook(self, data, user_api_key_dict, response):
+            add_guardrail_to_applied_guardrails_header(request_data=data, guardrail_name="gr-post")
+            self.add_standard_logging_guardrail_information_to_request_data(
+                guardrail_json_response={"verdict": "fail"},
+                request_data=data,
+                guardrail_status="guardrail_intervened",
+            )
+            raise HTTPException(status_code=400, detail={"error": "output blocked"})
+
+    monkeypatch.setattr(
+        litellm,
+        "callbacks",
+        [
+            BlockingWriterGuardrail(
+                guardrail_name="gr-post", event_hook=GuardrailEventHooks.post_call, default_on=False
+            )
+        ],
+    )
+    monkeypatch.setattr("litellm.proxy.proxy_server.llm_router", None, raising=False)
+    data = _post_call_pipeline_data()
+
+    with pytest.raises(HTTPException):
+        await proxy_logging.post_call_success_hook(
+            data=data, response=litellm.ModelResponse(), user_api_key_dict=make_user_api_key_auth()
+        )
+
+    assert data["metadata"]["applied_guardrails"] == ["gr-post"]
+    slg_entries = data["metadata"]["standard_logging_guardrail_information"]
+    assert len(slg_entries) == 1
+    assert slg_entries[0]["guardrail_name"] == "gr-post"
+    assert slg_entries[0]["guardrail_status"] == "guardrail_intervened"
+
+
 @pytest.mark.asyncio
 async def test_post_call_pipeline_managed_parallel_guardrail_runs_exactly_once(
     proxy_logging, make_user_api_key_auth, monkeypatch