diff --git a/.env.template b/.env.template
index f00784cd..abfe09f6 100644
--- a/.env.template
+++ b/.env.template
@@ -329,6 +329,13 @@
 # (e.g. /v1/chat/completions and /v1/responses items).
 # ENABLE_GUARDRAILS_FOR_BATCH_PROCESSING=false
 
+# Enable/disable outbound header policies globally (default: true)
+# HEADER_POLICIES_ENABLED=true
+
+# Replace header_policies.policies with a JSON array. Prefer config.yaml for
+# readability and ${VARIABLE} expansion for literal secret values.
+# HEADER_POLICIES_JSON=[{"name":"pin-beta","step":20,"methods":["POST"],"paths":["/v1/chat/completions"],"actions":[{"action":"set","header":"Anthropic-Beta","value":"context-1m-2025-08-07"}]}]
+
 # In-memory buffer size before flushing to storage (default: 1000)
 # USAGE_BUFFER_SIZE=1000
 
diff --git a/CLAUDE.md b/CLAUDE.md
index 4e35afdd..8f8a01c2 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -132,7 +132,8 @@ Full reference: `.env.template` and `config/config.yaml`
 - **HTTP client:** `HTTP_TIMEOUT` (600s), `HTTP_RESPONSE_HEADER_TIMEOUT` (600s); also settable via the `http:` block in `config.yaml` (env vars win)
 - **Resilience:** Configured via `config/config.yaml` - global `resilience.retry.*` and `resilience.circuit_breaker.*` defaults with optional per-provider overrides under `providers.<name>.resilience.retry.*` and `providers.<name>.resilience.circuit_breaker.*`. Retry defaults: `max_retries` (3), `initial_backoff` (1s), `max_backoff` (30s), `backoff_factor` (2.0), `jitter_factor` (0.1). Circuit breaker defaults: `failure_threshold` (5), `success_threshold` (2), `timeout` (30s). Breaker state is per-process and exported as the `gomodel_circuit_breaker_state` gauge when metrics are enabled. The dashboard's provider status also folds in real-traffic request health: each provider's runtime row carries `request_health` (last observed breaker state plus per-model request/error counts over a 10-minute sliding window; a model with ≥3 errors and a ≥50% error rate is flagged). An open breaker turns the provider card's status pill to "Circuit Open" (unhealthy), a half-open breaker or a flagged model degrades an otherwise healthy provider ("Recovering"/"Degraded"), and the expanded card details list recent per-model traffic with the latest error. Signals only worsen the discovery-based status, never improve it; tracking is in-memory per instance, and providers with no recent requests show discovery-based status only.
 - **Metrics:** `METRICS_ENABLED` (false), `METRICS_ENDPOINT` (/metrics)
-- **Guardrails:** Definitions are persisted in the `guardrail_definitions` store and managed via the admin API/dashboard; `config/config.yaml` entries are validated and upserted into that store at startup (a seed, not the source of truth). `GUARDRAILS_ENABLED` env var gates the feature.
+- **Guardrails:** Message guardrail definitions are managed through the Guardrails dashboard and `/admin/guardrails`; `config/config.yaml` entries seed the store at startup. `GUARDRAILS_ENABLED` gates the feature. Types: `system_prompt` and `llm_based_altering`.
+- **Header policies:** Outbound provider-request header policies are a separate egress subsystem with dedicated `header_policy_definitions` persistence, managed through the Header Policies dashboard and `/admin/header-policies`. Declare them under `header_policies.policies` or `HEADER_POLICIES_JSON`; `HEADER_POLICIES_ENABLED` is the independent kill switch. Conditions support `matches`/`equals`/`present`; actions support `set` with `value` or `from_header`, and `remove`. Credential, transport, and payload-metadata headers are rejected. Policies apply on translated, passthrough, realtime, WebRTC, and MCP upstream requests, participate in response-cache identity, and record redacted/name-only deltas on audit `request_revisions`; values copied from credential-like source headers stay redacted under innocuous target names. Realtime/MCP workflow matching is user-path/global only, so constrain provider-specific rules with `paths`. Historical `header_modification` guardrail rows are migrated once to the dedicated store and legacy workflow references remain readable.
 - **Provider API key rotation:** Any API-key provider accepts several keys: `<PROVIDER>[_SUFFIX]_API_KEY_<n>` env vars (numbered from 2; `_1` is accepted as a synonym for the unsuffixed key) or `providers.<name>.api_keys` in `config.yaml` (merged after `api_key`, de-duplicated, unresolved `${...}` entries dropped; env replaces the whole YAML list). Two or more keys turn on round-robin rotation, drawn per outbound HTTP request — including retries, so a 429'd request retries under the next key. Realtime websocket sessions pick a key per session. Counters are in-memory per instance. The trailing number names a key, not a provider: `OPENAI_API_KEY_2` is key 2 of `openai`, while `OPENAI_REGION_2_API_KEY` is the sole key of provider `openai-region-2`. **Rotation defeats provider prompt caching** (providers scope the cache to the key that filled it); use it to lift per-key rate limits, not to save cost. Keyless (Ollama, vLLM) and non-API-key providers (Vertex, Bedrock) are unaffected.
 - **Providers:** `OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, `ANTHROPIC_DEFAULT_MAX_TOKENS` (optional default `max_tokens` for Anthropic-translated requests that omit it; default 4096), `GEMINI_API_KEY`, `USE_GOOGLE_GEMINI_NATIVE_API` (true by default; false uses Gemini's OpenAI-compatible chat API), `XAI_API_KEY`, `GROQ_API_KEY`, `FIREWORKS_API_KEY`, `FIREWORKS_BASE_URL` (optional Fireworks AI endpoint override; default `https://api.fireworks.ai/inference/v1`), `META_API_KEY`, `META_BASE_URL` (optional Meta Model API endpoint override; default `https://api.meta.ai/v1`; Muse Spark models, e.g. `muse-spark-1.1`), `OPENROUTER_API_KEY`, `OPENROUTER_SITE_URL`/`OPENROUTER_APP_NAME` (optional OpenRouter attribution headers), `ZAI_API_KEY`, `ZAI_BASE_URL` (optional Z.ai endpoint override), `MINIMAX_API_KEY`, `MINIMAX_BASE_URL` (optional MiniMax endpoint override), `XIAOMI_API_KEY`, `XIAOMI_BASE_URL` (optional Xiaomi MiMo endpoint override), `OPENCODE_GO_API_KEY`, `OPENCODE_GO_BASE_URL` (optional OpenCode Go/Zen endpoint override; default `https://opencode.ai/zen/go/v1`), `OPENCODE_GO_MESSAGES_MODELS` (optional comma-separated model IDs routed to the Anthropic-native `/messages` endpoint instead of `/chat/completions`; default `qwen3.7-max`), `BAILIAN_API_KEY`, `BAILIAN_BASE_URL` (optional Bailian base URL for region switching; default `https://dashscope.aliyuncs.com/compatible-mode/v1`), `AZURE_API_KEY`, `AZURE_BASE_URL` (Azure OpenAI deployment base URL), `AZURE_API_VERSION` (optional Azure API version), `ORACLE_API_KEY` (Oracle API key), `ORACLE_BASE_URL` (Oracle OpenAI-compatible base URL), `BEDROCK_BASE_URL` (Bedrock Runtime region or endpoint), `BEDROCK_MANTLE_API_KEY`, `BEDROCK_MANTLE_BASE_URL` (Mantle region or endpoint), `BEDROCK_MANTLE_API_MODE` (`auto`, `openai`, or `standard`), `<PROVIDER>[_SUFFIX]_MODELS` (comma-separated configured model list for any provider type), `OLLAMA_BASE_URL`, `VLLM_BASE_URL`, `VLLM_API_KEY` (optional upstream vLLM bearer token)
 - **Provider model metadata:** `providers.<name>.models` accepts either model IDs (strings) or `{id, metadata}` objects. When `metadata` is supplied (`display_name`, `context_window`, `max_output_tokens`, `modes`, `capabilities`, `pricing`, …) it is merged onto the remote ai-model-list entry during enrichment, with operator values winning per-field. Primary use case: advertising context windows, capabilities, and pricing for local models (Ollama) and other custom endpoints whose IDs are not in the upstream registry.
diff --git a/cmd/gomodel/docs/docs.go b/cmd/gomodel/docs/docs.go
index 506f7dbe..b72f2756 100644
--- a/cmd/gomodel/docs/docs.go
+++ b/cmd/gomodel/docs/docs.go
@@ -1124,7 +1124,7 @@ const docTemplate = `{
                 "parameters": [
                     {
                         "type": "string",
-                        "description": "MCP server name",
+                        "description": "MCP server slug",
                         "name": "name",
                         "in": "path",
                         "required": true
@@ -1174,7 +1174,7 @@ const docTemplate = `{
         },
         "/admin/mcp-servers/{name}/catalog": {
             "get": {
-                "description": "Lists the tools, prompts, resources, and resource templates the named server currently exposes through the gateway, after operator tool filters. Names are the upstream originals; the aggregated /mcp endpoint prefixes them with the server name.",
+                "description": "Lists the tools, prompts, resources, and resource templates the named server currently exposes through the gateway, after operator tool filters. Names are the upstream originals; the aggregated /mcp endpoint prefixes them with the server slug.",
                 "produces": [
                     "application/json"
                 ],
@@ -1185,7 +1185,7 @@ const docTemplate = `{
                 "parameters": [
                     {
                         "type": "string",
-                        "description": "MCP server name",
+                        "description": "MCP server slug",
                         "name": "name",
                         "in": "path",
                         "required": true
@@ -1236,7 +1236,7 @@ const docTemplate = `{
                 "parameters": [
                     {
                         "type": "string",
-                        "description": "MCP server name",
+                        "description": "MCP server slug",
                         "name": "name",
                         "in": "path",
                         "required": true
@@ -2782,7 +2782,7 @@ const docTemplate = `{
         },
         "/mcp": {
             "get": {
-                "description": "Streamable-HTTP MCP endpoint aggregating every configured upstream MCP server visible to the caller. Tools and prompts are namespaced as {server}_{name}. POST carries JSON-RPC messages, GET opens the server-notification SSE stream, DELETE ends the session. The X-MCP-Servers request header optionally narrows the visible servers to a comma-separated subset.",
+                "description": "Streamable-HTTP MCP endpoint aggregating every configured upstream MCP server visible to the caller. Tools and prompts are namespaced as {slug}_{name}. POST carries JSON-RPC messages, GET opens the server-notification SSE stream, DELETE ends the session. The X-MCP-Servers request header optionally narrows the visible servers to a comma-separated subset of server slugs.",
                 "consumes": [
                     "application/json"
                 ],
@@ -2828,7 +2828,7 @@ const docTemplate = `{
                 ]
             },
             "post": {
-                "description": "Streamable-HTTP MCP endpoint aggregating every configured upstream MCP server visible to the caller. Tools and prompts are namespaced as {server}_{name}. POST carries JSON-RPC messages, GET opens the server-notification SSE stream, DELETE ends the session. The X-MCP-Servers request header optionally narrows the visible servers to a comma-separated subset.",
+                "description": "Streamable-HTTP MCP endpoint aggregating every configured upstream MCP server visible to the caller. Tools and prompts are namespaced as {slug}_{name}. POST carries JSON-RPC messages, GET opens the server-notification SSE stream, DELETE ends the session. The X-MCP-Servers request header optionally narrows the visible servers to a comma-separated subset of server slugs.",
                 "consumes": [
                     "application/json"
                 ],
@@ -2874,7 +2874,7 @@ const docTemplate = `{
                 ]
             },
             "delete": {
-                "description": "Streamable-HTTP MCP endpoint aggregating every configured upstream MCP server visible to the caller. Tools and prompts are namespaced as {server}_{name}. POST carries JSON-RPC messages, GET opens the server-notification SSE stream, DELETE ends the session. The X-MCP-Servers request header optionally narrows the visible servers to a comma-separated subset.",
+                "description": "Streamable-HTTP MCP endpoint aggregating every configured upstream MCP server visible to the caller. Tools and prompts are namespaced as {slug}_{name}. POST carries JSON-RPC messages, GET opens the server-notification SSE stream, DELETE ends the session. The X-MCP-Servers request header optionally narrows the visible servers to a comma-separated subset of server slugs.",
                 "consumes": [
                     "application/json"
                 ],
@@ -2937,7 +2937,7 @@ const docTemplate = `{
                 "parameters": [
                     {
                         "type": "string",
-                        "description": "Configured MCP server name",
+                        "description": "Configured MCP server slug",
                         "name": "server",
                         "in": "path",
                         "required": true
@@ -2998,7 +2998,7 @@ const docTemplate = `{
                 "parameters": [
                     {
                         "type": "string",
-                        "description": "Configured MCP server name",
+                        "description": "Configured MCP server slug",
                         "name": "server",
                         "in": "path",
                         "required": true
@@ -3059,7 +3059,7 @@ const docTemplate = `{
                 "parameters": [
                     {
                         "type": "string",
-                        "description": "Configured MCP server name",
+                        "description": "Configured MCP server slug",
                         "name": "server",
                         "in": "path",
                         "required": true
@@ -6142,6 +6142,9 @@ const docTemplate = `{
                 "resource_count": {
                     "type": "integer"
                 },
+                "slug": {
+                    "type": "string"
+                },
                 "status": {
                     "type": "string"
                 },
@@ -6501,6 +6504,9 @@ const docTemplate = `{
                 "name": {
                     "type": "string"
                 },
+                "slug": {
+                    "type": "string"
+                },
                 "tool_timeout_seconds": {
                     "type": "integer"
                 },
@@ -6916,6 +6922,21 @@ const docTemplate = `{
                 }
             }
         },
+        "auditlog.HeaderRevisionSnapshot": {
+            "type": "object",
+            "properties": {
+                "removed": {
+                    "description": "Removed contains the names of headers the revision removes.",
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "set": {
+                    "description": "Set contains either map[string]string values or a []string of names,\naccording to the LOGGING_LOG_HEADERS policy described above."
+                }
+            }
+        },
         "auditlog.LogData": {
             "type": "object",
             "properties": {
@@ -6969,7 +6990,7 @@ const docTemplate = `{
                     }
                 },
                 "request_revisions": {
-                    "description": "RequestRevisions captures the ingress request-rewrite chain: one entry\nper registered rewriter that changed the body, in application order.\nRequestBody always remains the original client request; the last\nrevision is what was forwarded downstream.",
+                    "description": "RequestRevisions captures intended request-processing changes in\napplication order: body rewrites and outbound header modifications.\nRequestBody always remains the original client request. A revision records\nwhat would be applied if execution reaches provider egress; it is not proof\nof egress.",
                     "type": "array",
                     "items": {
                         "$ref": "#/definitions/auditlog.RequestRevisionSnapshot"
@@ -7117,6 +7138,14 @@ const docTemplate = `{
                 "detail": {
                     "description": "Detail is an optional rewriter-provided structured summary of what\nchanged (for example a compression block report)."
                 },
+                "headers": {
+                    "description": "Headers records the outbound provider-request header changes made by\nthis revision. Only the delta is stored; absent means unchanged.",
+                    "allOf": [
+                        {
+                            "$ref": "#/definitions/auditlog.HeaderRevisionSnapshot"
+                        }
+                    ]
+                },
                 "rewriter": {
                     "type": "string"
                 },
diff --git a/config/config.example.yaml b/config/config.example.yaml
index 0b53f49e..bd0a951f 100644
--- a/config/config.example.yaml
+++ b/config/config.example.yaml
@@ -279,6 +279,30 @@ guardrails:
     #     skip_content_prefix: "### safe"
     #     # prompt: "Custom rewrite instructions here."
 
+header_policies:
+  enabled: true # env: HEADER_POLICIES_ENABLED; default true
+  policies:
+    # Named outbound policies are bound to the managed default workflow by step.
+    # Conditions all have to match; actions run in order. Credential, transport,
+    # content-type, and content-encoding headers cannot be read or changed.
+    # - name: "pin-anthropic-beta"
+    #   description: "Enable the long-context Anthropic beta for Cline clients"
+    #   step: 20
+    #   methods: ["POST"] # optional; empty matches every method
+    #   paths: ["/v1/chat/completions", "/p/anthropic/*"] # trailing * matches a prefix
+    #   when:
+    #     - header: "User-Agent"
+    #       matches: "^cline/" # RE2 regex; or use equals/present
+    #   actions:
+    #     - action: "set"
+    #       header: "Anthropic-Beta"
+    #       value: "context-1m-2025-08-07"
+    #     - action: "set"
+    #       header: "X-Team"
+    #       from_header: "X-Client-Team"
+    #     - action: "remove"
+    #       header: "X-Internal-Debug"
+
 failover:
   enabled: true # env: FAILOVER_ENABLED; default true
   manual_rules_path: "config/failover.example.json" # optional JSON map: {"primary-model": ["fallback-1", "provider/model"]}
diff --git a/config/config.go b/config/config.go
index 9e6b0c2f..0109e85d 100644
--- a/config/config.go
+++ b/config/config.go
@@ -20,23 +20,24 @@ import (
 
 // Config holds the application configuration.
 type Config struct {
-	Server     ServerConfig     `yaml:"server"`
-	Models     ModelsConfig     `yaml:"models"`
-	Cache      CacheConfig      `yaml:"cache"`
-	Storage    StorageConfig    `yaml:"storage"`
-	Logging    LogConfig        `yaml:"logging"`
-	Usage      UsageConfig      `yaml:"usage"`
-	Budgets    BudgetsConfig    `yaml:"budgets"`
-	RateLimits RateLimitsConfig `yaml:"rate_limits"`
-	Metrics    MetricsConfig    `yaml:"metrics"`
-	HTTP       HTTPConfig       `yaml:"http"`
-	Admin      AdminConfig      `yaml:"admin"`
-	Guardrails GuardrailsConfig `yaml:"guardrails"`
-	Failover   FailoverConfig   `yaml:"failover"`
-	Workflows  WorkflowsConfig  `yaml:"workflows"`
-	Resilience ResilienceConfig `yaml:"resilience"`
-	Tagging    TaggingConfig    `yaml:"tagging"`
-	MCP        MCPConfig        `yaml:"mcp"`
+	Server         ServerConfig         `yaml:"server"`
+	Models         ModelsConfig         `yaml:"models"`
+	Cache          CacheConfig          `yaml:"cache"`
+	Storage        StorageConfig        `yaml:"storage"`
+	Logging        LogConfig            `yaml:"logging"`
+	Usage          UsageConfig          `yaml:"usage"`
+	Budgets        BudgetsConfig        `yaml:"budgets"`
+	RateLimits     RateLimitsConfig     `yaml:"rate_limits"`
+	Metrics        MetricsConfig        `yaml:"metrics"`
+	HTTP           HTTPConfig           `yaml:"http"`
+	Admin          AdminConfig          `yaml:"admin"`
+	Guardrails     GuardrailsConfig     `yaml:"guardrails"`
+	HeaderPolicies HeaderPoliciesConfig `yaml:"header_policies"`
+	Failover       FailoverConfig       `yaml:"failover"`
+	Workflows      WorkflowsConfig      `yaml:"workflows"`
+	Resilience     ResilienceConfig     `yaml:"resilience"`
+	Tagging        TaggingConfig        `yaml:"tagging"`
+	MCP            MCPConfig            `yaml:"mcp"`
 
 	// VirtualModels declares redirects, load balancers, and access policies as
 	// infrastructure-as-code. They override admin-store rows of the same source.
@@ -147,7 +148,8 @@ func buildDefaultConfig() *Config {
 			LiveLogsReplayLimit:      1000,
 			LiveLogsHeartbeatSeconds: 15,
 		},
-		Guardrails: GuardrailsConfig{},
+		Guardrails:     GuardrailsConfig{},
+		HeaderPolicies: HeaderPoliciesConfig{Enabled: true},
 		MCP: MCPConfig{
 			Enabled: true,
 		},
@@ -185,6 +187,9 @@ func Load() (*LoadResult, error) {
 	if err := applyEnvOverrides(cfg); err != nil {
 		return nil, err
 	}
+	if err := applyHeaderPoliciesEnv(cfg); err != nil {
+		return nil, err
+	}
 	if err := applyVirtualModelsEnv(cfg, strict); err != nil {
 		return nil, err
 	}
diff --git a/config/config_test.go b/config/config_test.go
index 51d2102a..7c79aefe 100644
--- a/config/config_test.go
+++ b/config/config_test.go
@@ -63,7 +63,7 @@ func clearAllConfigEnvVars(t *testing.T) {
 		"RATE_LIMITS_ENABLED",
 		"DASHBOARD_LIVE_LOGS_ENABLED", "DASHBOARD_LIVE_LOGS_BUFFER_SIZE",
 		"DASHBOARD_LIVE_LOGS_REPLAY_LIMIT", "DASHBOARD_LIVE_LOGS_HEARTBEAT_SECONDS",
-		"GUARDRAILS_ENABLED", "ENABLE_GUARDRAILS_FOR_BATCH_PROCESSING",
+		"GUARDRAILS_ENABLED", "ENABLE_GUARDRAILS_FOR_BATCH_PROCESSING", "HEADER_POLICIES_ENABLED", "HEADER_POLICIES_JSON",
 		"FAILOVER_MODE", "FAILOVER_MANUAL_RULES_PATH", "FAILOVER_ENABLED", "FAILOVER_RULES_JSON", "FAILOVER_DISABLED_MODELS", "FAILOVER_DISABLED_MODELS_JSON",
 		"MODELS_ENABLED_BY_DEFAULT", "KEEP_ONLY_ALIASES_AT_MODELS_ENDPOINT", "CONFIGURED_PROVIDER_MODELS_MODE",
 		"HTTP_TIMEOUT", "HTTP_RESPONSE_HEADER_TIMEOUT",
@@ -99,6 +99,9 @@ func withTempDir(t *testing.T, fn func(dir string)) {
 
 func TestBuildDefaultConfig(t *testing.T) {
 	cfg := buildDefaultConfig()
+	if !cfg.HeaderPolicies.Enabled {
+		t.Fatal("expected HeaderPolicies.Enabled=true")
+	}
 
 	if cfg.Server.Port != "8080" {
 		t.Errorf("expected Server.Port=8080, got %s", cfg.Server.Port)
@@ -253,6 +256,92 @@ func TestBuildDefaultConfig(t *testing.T) {
 	}
 }
 
+func TestLoad_HeaderPoliciesFromYAML(t *testing.T) {
+	clearAllConfigEnvVars(t)
+	withTempDir(t, func(_ string) {
+		if err := os.WriteFile("config.yaml", []byte(`
+header_policies:
+  enabled: true
+  policies:
+    - name: pin-beta
+      description: Anthropic beta
+      step: 20
+      methods: [POST]
+      paths: [/v1/chat/completions, /p/anthropic/*]
+      when:
+        - header: User-Agent
+          matches: ^cline/
+      actions:
+        - action: set
+          header: Anthropic-Beta
+          value: context-1m
+`), 0o600); err != nil {
+			t.Fatalf("write config: %v", err)
+		}
+		result, err := Load()
+		if err != nil {
+			t.Fatalf("Load() error = %v", err)
+		}
+		policies := result.Config.HeaderPolicies.Policies
+		if len(policies) != 1 || policies[0].Name != "pin-beta" || policies[0].Step != 20 {
+			t.Fatalf("policies = %#v", policies)
+		}
+		if len(policies[0].Paths) != 2 || policies[0].Paths[1] != "/p/anthropic/*" {
+			t.Fatalf("paths = %#v", policies[0].Paths)
+		}
+	})
+}
+
+func TestLoad_HeaderPoliciesJSONOverridesYAML(t *testing.T) {
+	clearAllConfigEnvVars(t)
+	t.Setenv("HEADER_POLICIES_ENABLED", "false")
+	t.Setenv("HEADER_POLICIES_JSON", `[{"name":"from-env","step":30,"paths":["/v1/*"],"actions":[{"action":"set","header":"X-Team","from_header":"X-Client-Team"}]}]`)
+	withTempDir(t, func(_ string) {
+		if err := os.WriteFile("config.yaml", []byte(`
+header_policies:
+  policies:
+    - name: from-yaml
+      actions:
+        - action: remove
+          header: X-Debug
+`), 0o600); err != nil {
+			t.Fatalf("write config: %v", err)
+		}
+		result, err := Load()
+		if err != nil {
+			t.Fatalf("Load() error = %v", err)
+		}
+		if result.Config.HeaderPolicies.Enabled {
+			t.Fatal("HEADER_POLICIES_ENABLED=false was ignored")
+		}
+		policies := result.Config.HeaderPolicies.Policies
+		if len(policies) != 1 || policies[0].Name != "from-env" || policies[0].Actions[0].FromHeader != "X-Client-Team" {
+			t.Fatalf("policies = %#v", policies)
+		}
+	})
+}
+
+func TestLoad_HeaderPoliciesJSONRejectsUnknownFields(t *testing.T) {
+	clearAllConfigEnvVars(t)
+	t.Setenv("HEADER_POLICIES_JSON", `[{"name":"bad","actons":[]}]`)
+	withTempDir(t, func(_ string) {
+		_, err := Load()
+		if err == nil || !strings.Contains(err.Error(), "HEADER_POLICIES_JSON") {
+			t.Fatalf("Load() error = %v", err)
+		}
+	})
+}
+
+func TestLoad_HeaderPoliciesJSONRejectsTrailingData(t *testing.T) {
+	clearAllConfigEnvVars(t)
+	t.Setenv("HEADER_POLICIES_JSON", `[] {}`)
+	withTempDir(t, func(_ string) {
+		if _, err := Load(); err == nil {
+			t.Fatal("Load() error = nil, want trailing JSON error")
+		}
+	})
+}
+
 func TestLoadBudgetEnvUserPath(t *testing.T) {
 	clearAllConfigEnvVars(t)
 
diff --git a/config/guardrails.go b/config/guardrails.go
index 5f729f71..12aaa9df 100644
--- a/config/guardrails.go
+++ b/config/guardrails.go
@@ -23,7 +23,9 @@ type GuardrailRuleConfig struct {
 	// Name is a unique identifier for this guardrail instance (used in logs and errors)
 	Name string `yaml:"name"`
 
-	// Type selects the guardrail implementation: "system_prompt" or "llm_based_altering"
+	// Type selects the guardrail implementation: "system_prompt" or
+	// "llm_based_altering". "header_modification" remains accepted only as a
+	// deprecated migration input; use header_policies instead.
 	Type string `yaml:"type"`
 
 	// UserPath scopes internal auxiliary guardrail requests for workflow
@@ -40,6 +42,9 @@ type GuardrailRuleConfig struct {
 
 	// LLMBasedAltering holds settings when Type is "llm_based_altering"
 	LLMBasedAltering LLMBasedAlteringSettings `yaml:"llm_based_altering"`
+
+	// HeaderModification holds settings when Type is "header_modification"
+	HeaderModification HeaderModificationSettings `yaml:"header_modification"`
 }
 
 // SystemPromptSettings holds the type-specific settings for a system_prompt guardrail.
@@ -79,3 +84,53 @@ type LLMBasedAlteringSettings struct {
 	// Default: 4096
 	MaxTokens int `yaml:"max_tokens"`
 }
+
+// HeaderModificationSettings is the deprecated guardrails representation of
+// an outbound header policy. New configuration uses HeaderPoliciesConfig.
+type HeaderModificationSettings struct {
+	// Methods optionally limits the policy to these HTTP methods.
+	Methods []string `yaml:"methods"`
+
+	// Endpoints optionally limits the policy to public request paths. A trailing
+	// '*' matches a prefix.
+	Endpoints []string `yaml:"endpoints"`
+
+	// When lists inbound-header conditions; all must match. Empty = always apply.
+	When []HeaderConditionConfig `yaml:"when"`
+
+	// Actions lists outbound header changes applied in order.
+	Actions []HeaderActionConfig `yaml:"actions"`
+}
+
+// HeaderConditionConfig is one inbound-header predicate.
+type HeaderConditionConfig struct {
+	// Header is the inbound header name to inspect.
+	Header string `json:"header" yaml:"header"`
+
+	// Equals matches when any inbound value equals this string exactly.
+	Equals *string `json:"equals,omitempty" yaml:"equals"`
+
+	// Matches matches when any inbound value matches this RE2 regular expression.
+	Matches *string `json:"matches,omitempty" yaml:"matches"`
+
+	// Present requires the header to exist (true) or be absent (false).
+	// Ignored when Equals or Matches is set; defaults to true otherwise.
+	Present *bool `json:"present,omitempty" yaml:"present"`
+}
+
+// HeaderActionConfig is one outbound-header change.
+type HeaderActionConfig struct {
+	// Action is "set" (replace/add) or "remove".
+	Action string `json:"action" yaml:"action"`
+
+	// Header is the outbound header to change. Credential and transport
+	// headers (Authorization, Cookie, Host, Content-Length, ...) are rejected.
+	Header string `json:"header" yaml:"header"`
+
+	// Value is the literal value for "set".
+	Value *string `json:"value,omitempty" yaml:"value"`
+
+	// FromHeader copies the first inbound value of this header for "set".
+	// When the inbound header is absent, the action is skipped.
+	FromHeader string `json:"from_header,omitempty" yaml:"from_header"`
+}
diff --git a/config/header_policies.go b/config/header_policies.go
new file mode 100644
index 00000000..6699ddd6
--- /dev/null
+++ b/config/header_policies.go
@@ -0,0 +1,48 @@
+package config
+
+import (
+	"fmt"
+	"strings"
+)
+
+// HeaderPoliciesConfig configures reusable outbound request-header policies.
+type HeaderPoliciesConfig struct {
+	// Enabled is an operational kill switch. With no policies configured, the
+	// enabled default has no effect on requests.
+	Enabled bool `yaml:"enabled" env:"HEADER_POLICIES_ENABLED"`
+
+	// Policies seeds named definitions and binds them to the managed default
+	// workflow using each policy's Step.
+	Policies []HeaderPolicyConfig `yaml:"policies"`
+
+	// PoliciesJSON replaces Policies when HEADER_POLICIES_JSON is set.
+	PoliciesJSON string `yaml:"-" env:"HEADER_POLICIES_JSON"`
+}
+
+// HeaderPolicyConfig is one declarative outbound header policy.
+type HeaderPolicyConfig struct {
+	Name        string                  `json:"name" yaml:"name"`
+	Description string                  `json:"description,omitempty" yaml:"description"`
+	Step        int                     `json:"step,omitempty" yaml:"step"`
+	Methods     []string                `json:"methods,omitempty" yaml:"methods"`
+	Paths       []string                `json:"paths,omitempty" yaml:"paths"`
+	When        []HeaderConditionConfig `json:"when,omitempty" yaml:"when"`
+	Actions     []HeaderActionConfig    `json:"actions" yaml:"actions"`
+}
+
+func applyHeaderPoliciesEnv(cfg *Config) error {
+	if cfg == nil {
+		return nil
+	}
+	raw := strings.TrimSpace(cfg.HeaderPolicies.PoliciesJSON)
+	if raw == "" {
+		return nil
+	}
+	raw = expandString(raw)
+	var policies []HeaderPolicyConfig
+	if err := decodeStrictJSON(raw, &policies); err != nil {
+		return fmt.Errorf("invalid HEADER_POLICIES_JSON: %w", err)
+	}
+	cfg.HeaderPolicies.Policies = policies
+	return nil
+}
diff --git a/docs/advanced/guardrails.mdx b/docs/advanced/guardrails.mdx
index 53ff41e0..610ed6a0 100644
--- a/docs/advanced/guardrails.mdx
+++ b/docs/advanced/guardrails.mdx
@@ -113,7 +113,7 @@ export GUARDRAILS_ENABLED=true
 | Field  | Required | Description                                                         |
 | ------ | -------- | ------------------------------------------------------------------- |
 | `name` | Yes      | Human-readable identifier. Supports spaces and unicode, but not `/`. |
-| `type` | Yes      | Guardrail type: `system_prompt` or `llm_based_altering`.            |
+| `type` | Yes      | Definition type: `system_prompt` or `llm_based_altering`. |
 | `user_path` | No  | Optional base user path for internal auxiliary guardrail requests. |
 | `order`| No       | Execution order. Default `0`. Same value = parallel, different = sequential. |
 
@@ -230,6 +230,12 @@ Guardrails are explicitly skipped for that internal request to avoid recursion.
     roles: ["user"]
 ```
 
+<Note>
+  Outbound request-header changes are configured as [Header Policies](/advanced/header-policies),
+  not as message guardrails. Historical `header_modification` guardrail definitions remain readable
+  for migration, but new definitions use the dedicated configuration and admin API.
+</Note>
+
 ## Examples
 
 ### Single Safety Guardrail
diff --git a/docs/advanced/header-policies.mdx b/docs/advanced/header-policies.mdx
new file mode 100644
index 00000000..d0a786d6
--- /dev/null
+++ b/docs/advanced/header-policies.mdx
@@ -0,0 +1,185 @@
+---
+title: "Header Policies"
+description: "Conditionally set or remove outbound provider-request headers without treating transport policy as a message guardrail."
+icon: "panels-top-left"
+---
+
+## Overview
+
+Header policies change headers on the outbound request to an LLM provider. They are a dedicated
+egress-policy stage, separate from [Guardrails](/advanced/guardrails), which operate on normalized
+messages.
+
+Use header policies to adapt existing clients without changing them. Common examples include
+pinning an `Anthropic-Beta` feature, copying a tenant header into a provider-specific header, or
+removing internal diagnostics before provider egress.
+
+```mermaid
+flowchart LR
+    A[Inbound request] --> B[Authentication and routing]
+    B --> C[Workflow selection]
+    C --> D[Resolve header-policy plan]
+    D --> E[Cache lookup]
+    E --> F[Build selected provider attempt]
+    F --> G[Apply header-policy plan]
+    G --> H[Provider egress]
+```
+
+The resolved plan is immutable for the request. It applies to translated HTTP, passthrough,
+realtime WebSocket and WebRTC provider requests, and MCP upstream HTTP requests. It does not
+propagate into internal guardrail or embedding calls, and it does not carry into a different
+failover provider. Retries of the selected primary provider reuse the same plan.
+
+## Configuration
+
+Header policies have their own top-level configuration:
+
+```yaml
+header_policies:
+  enabled: true
+  policies:
+    - name: "pin-anthropic-beta"
+      description: "Enable the long-context beta for Cline"
+      step: 10
+      methods: ["POST"]
+      paths: ["/v1/messages", "/p/anthropic/*"]
+      when:
+        - header: "User-Agent"
+          matches: "^cline/"
+      actions:
+        - action: "set"
+          header: "Anthropic-Beta"
+          value: "context-1m-2025-08-07"
+        - action: "set"
+          header: "X-Team"
+          from_header: "X-Client-Team"
+        - action: "remove"
+          header: "X-Internal-Debug"
+```
+
+`enabled` defaults to `true`. With no policies configured, this default has no effect. Set it to
+`false` as an operational kill switch without deleting policy definitions or their workflow
+bindings; turning it back on resumes the existing bindings.
+
+Every policy configured in YAML is stored as a reusable definition and attached to the managed
+default workflow. `step` controls ordering: lower steps run first, and a later action can replace an
+earlier action on the same header.
+
+### Environment variables
+
+```bash
+export HEADER_POLICIES_ENABLED=true
+export HEADER_POLICIES_JSON='[{"name":"remove-debug","actions":[{"action":"remove","header":"X-Internal-Debug"}]}]'
+```
+
+`HEADER_POLICIES_JSON` replaces `header_policies.policies` when set. It uses the same flattened
+fields as YAML and rejects unknown fields.
+
+## Matching and actions
+
+| Field | Required | Description |
+| --- | --- | --- |
+| `name` | Yes | Unique reusable policy name. Names are shared with guardrails and cannot contain `/`. |
+| `description` | No | Operator-facing description. |
+| `step` | No | Ordering in the managed default workflow. Default `0`. |
+| `methods` | No | HTTP methods to match. Empty matches every method. |
+| `paths` | No | Public request paths. A trailing `*` matches a prefix. |
+| `when` | No | Inbound-header conditions. All must match; empty means always. |
+| `actions` | Yes | Outbound header mutations, applied in order. |
+
+Each condition names a `header` and at most one predicate:
+
+- `matches`: an RE2 regular expression
+- `equals`: an exact value; `equals: ""` matches a present header with an empty value
+- `present: true` or `present: false`: an explicit existence check
+
+With no predicate, a condition means that the header must be present.
+
+An action is `set` or `remove`. A `set` action takes exactly one of:
+
+- `value`, including an explicit empty value
+- `from_header`, which copies the first inbound value; the action is skipped if the source is absent
+
+<Warning>
+  Credential headers such as `Authorization`, `Cookie`, and `X-Api-Key`, and transport headers such
+  as `Host`, `Content-Length`, and `Connection`, cannot be condition sources or action targets.
+  `Accept-Encoding`, `Content-Encoding`, and `Content-Type` are also reserved because changing them
+  can break decompression or body parsing. Authoring validation rejects these headers, and runtime
+  enforcement provides a second boundary.
+</Warning>
+
+## Workflows
+
+Managed definitions can be attached explicitly to an API-authored workflow:
+
+```json
+{
+  "workflow_payload": {
+    "schema_version": 1,
+    "features": { "guardrails": false },
+    "header_policies": [
+      { "ref": "pin-anthropic-beta", "step": 10 }
+    ]
+  }
+}
+```
+
+Header policies remain active when the workflow's message `guardrails` feature is false. Their
+effective resolved plan, including values copied with `from_header`, participates in exact and
+semantic response-cache identity.
+
+Realtime and MCP workflow selection currently matches only `user_path` and global workflow scopes.
+Provider- and model-scoped workflows do not bind to those operations, even when a realtime model is
+present in the query or session body. The matched workflow's feature flags still apply to the whole
+realtime or MCP request.
+
+<Warning>
+  An unscoped policy also reaches MCP upstream servers. Use `paths` such as `/v1/*` or
+  `/p/anthropic/*` when a header is meaningful only to model-provider APIs, and include `/mcp*`
+  only when the policy is intentionally shared with MCP egress.
+</Warning>
+
+## Dashboard and admin API
+
+Use **Header Policies** in the dashboard to create, edit, and delete definitions. It is intentionally
+separate from the Guardrails page.
+
+The same operations are available through the admin API:
+
+| Method | Endpoint | Description |
+| --- | --- | --- |
+| `GET` | `/admin/header-policies` | List definitions. |
+| `PUT` | `/admin/header-policies` | Create or replace a flattened definition. |
+| `DELETE` | `/admin/header-policies` | Delete by JSON body: `{ "name": "..." }`. |
+
+A definition referenced by an active workflow cannot be deleted. A name cannot be shared by a
+guardrail and a header policy.
+
+## Audit visibility
+
+Every policy that changes a request adds a delta to the audit entry's request-revision chain, the
+same revision mechanism used by body rewriters. The dashboard audit-log drawer displays it in a
+**Rewritten** tab.
+
+- With `LOGGING_LOG_HEADERS=true`, set values are stored after header redaction. Credential-like
+  names containing segments such as `auth`, `key`, `secret`, `session`, `token`, or `credential`
+  are redacted. Values copied with `from_header` from such a source remain redacted even when the
+  target header has an innocuous name.
+- With header logging disabled, only changed header names are stored.
+- Removed headers always contain names only.
+- A policy that does not match records no revision.
+
+Revisions describe the intended change at request admission; they are not proof that execution
+reached provider egress.
+
+## Migrating preview configuration
+
+Historical configurations using `guardrails.rules[].type: header_modification` and historical
+workflow references under `guardrails` remain readable. At startup, GoModel moves stored preview
+definitions from the guardrail store into the dedicated `header_policy_definitions` table (or
+MongoDB collection), removes the legacy rows, and keeps compiling legacy workflow references into
+the egress stage. The migration is idempotent; an existing dedicated definition wins by name.
+
+Move each definition to `header_policies.policies`, rename `order` to `step`, rename `endpoints` to
+`paths`, and remove the `type` and `header_modification` wrapper. New definitions are not accepted
+through `/admin/guardrails`.
diff --git a/docs/advanced/workflows.mdx b/docs/advanced/workflows.mdx
index ac6406dd..978da04f 100644
--- a/docs/advanced/workflows.mdx
+++ b/docs/advanced/workflows.mdx
@@ -15,6 +15,7 @@ They currently control gateway-owned behavior such as:
 - audit logging
 - usage tracking
 - guardrails
+- outbound header policies
 - translated-route failover
 
 Each request matches exactly one active workflow.
@@ -115,7 +116,10 @@ curl -X POST http://localhost:8080/admin/workflows \
         "guardrails": false,
         "failover": true
       },
-      "guardrails": []
+      "guardrails": [],
+      "header_policies": [
+        { "ref": "pin-anthropic-beta", "step": 10 }
+      ]
     }
   }'
 ```
@@ -126,3 +130,5 @@ curl -X POST http://localhost:8080/admin/workflows \
 - `scope_user_path` is normalized to canonical slash form
 - managed API keys can override the request user path header; workflow matching uses the effective request user path
 - budget enforcement runs only when the global budget feature and the matched workflow's `budget` feature are both enabled; see [Budgets](/features/budgets)
+- `header_policies` are an egress stage independent of the message `guardrails` feature flag; their resolved plan participates in response-cache identity and applies only to the selected primary provider route; see [Header Policies](/advanced/header-policies)
+- `HEADER_POLICIES_ENABLED=false` is the global operational kill switch; workflow definitions remain stored and compilable while application is disabled
diff --git a/docs/docs.json b/docs/docs.json
index 308b2495..aac5c81e 100644
--- a/docs/docs.json
+++ b/docs/docs.json
@@ -101,6 +101,7 @@
                             "advanced/audio-api",
                             "advanced/usage-api",
                             "advanced/guardrails",
+                            "advanced/header-policies",
                             "advanced/workflows",
                             "advanced/admin-endpoints"
                         ]
diff --git a/docs/openapi.json b/docs/openapi.json
index d97aadec..9abec07d 100644
--- a/docs/openapi.json
+++ b/docs/openapi.json
@@ -1472,7 +1472,7 @@
         "summary": "Delete one admin-managed MCP server",
         "parameters": [
           {
-            "description": "MCP server name",
+            "description": "MCP server slug",
             "name": "name",
             "in": "path",
             "required": true,
@@ -1550,14 +1550,14 @@
     },
     "/admin/mcp-servers/{name}/catalog": {
       "get": {
-        "description": "Lists the tools, prompts, resources, and resource templates the named server currently exposes through the gateway, after operator tool filters. Names are the upstream originals; the aggregated /mcp endpoint prefixes them with the server name.",
+        "description": "Lists the tools, prompts, resources, and resource templates the named server currently exposes through the gateway, after operator tool filters. Names are the upstream originals; the aggregated /mcp endpoint prefixes them with the server slug.",
         "tags": [
           "admin"
         ],
         "summary": "Inspect one MCP server's current catalog",
         "parameters": [
           {
-            "description": "MCP server name",
+            "description": "MCP server slug",
             "name": "name",
             "in": "path",
             "required": true,
@@ -1628,7 +1628,7 @@
         "summary": "Force-redial one MCP server and return its fresh state",
         "parameters": [
           {
-            "description": "MCP server name",
+            "description": "MCP server slug",
             "name": "name",
             "in": "path",
             "required": true,
@@ -3693,7 +3693,7 @@
     },
     "/mcp": {
       "get": {
-        "description": "Streamable-HTTP MCP endpoint aggregating every configured upstream MCP server visible to the caller. Tools and prompts are namespaced as {server}_{name}. POST carries JSON-RPC messages, GET opens the server-notification SSE stream, DELETE ends the session. The X-MCP-Servers request header optionally narrows the visible servers to a comma-separated subset.",
+        "description": "Streamable-HTTP MCP endpoint aggregating every configured upstream MCP server visible to the caller. Tools and prompts are namespaced as {slug}_{name}. POST carries JSON-RPC messages, GET opens the server-notification SSE stream, DELETE ends the session. The X-MCP-Servers request header optionally narrows the visible servers to a comma-separated subset of server slugs.",
         "tags": [
           "mcp"
         ],
@@ -3774,7 +3774,7 @@
         }
       },
       "post": {
-        "description": "Streamable-HTTP MCP endpoint aggregating every configured upstream MCP server visible to the caller. Tools and prompts are namespaced as {server}_{name}. POST carries JSON-RPC messages, GET opens the server-notification SSE stream, DELETE ends the session. The X-MCP-Servers request header optionally narrows the visible servers to a comma-separated subset.",
+        "description": "Streamable-HTTP MCP endpoint aggregating every configured upstream MCP server visible to the caller. Tools and prompts are namespaced as {slug}_{name}. POST carries JSON-RPC messages, GET opens the server-notification SSE stream, DELETE ends the session. The X-MCP-Servers request header optionally narrows the visible servers to a comma-separated subset of server slugs.",
         "tags": [
           "mcp"
         ],
@@ -3855,7 +3855,7 @@
         }
       },
       "delete": {
-        "description": "Streamable-HTTP MCP endpoint aggregating every configured upstream MCP server visible to the caller. Tools and prompts are namespaced as {server}_{name}. POST carries JSON-RPC messages, GET opens the server-notification SSE stream, DELETE ends the session. The X-MCP-Servers request header optionally narrows the visible servers to a comma-separated subset.",
+        "description": "Streamable-HTTP MCP endpoint aggregating every configured upstream MCP server visible to the caller. Tools and prompts are namespaced as {slug}_{name}. POST carries JSON-RPC messages, GET opens the server-notification SSE stream, DELETE ends the session. The X-MCP-Servers request header optionally narrows the visible servers to a comma-separated subset of server slugs.",
         "tags": [
           "mcp"
         ],
@@ -3945,7 +3945,7 @@
         "summary": "MCP gateway (single server)",
         "parameters": [
           {
-            "description": "Configured MCP server name",
+            "description": "Configured MCP server slug",
             "name": "server",
             "in": "path",
             "required": true,
@@ -4052,7 +4052,7 @@
         "summary": "MCP gateway (single server)",
         "parameters": [
           {
-            "description": "Configured MCP server name",
+            "description": "Configured MCP server slug",
             "name": "server",
             "in": "path",
             "required": true,
@@ -4159,7 +4159,7 @@
         "summary": "MCP gateway (single server)",
         "parameters": [
           {
-            "description": "Configured MCP server name",
+            "description": "Configured MCP server slug",
             "name": "server",
             "in": "path",
             "required": true,
@@ -8979,6 +8979,9 @@
           "resource_count": {
             "type": "integer"
           },
+          "slug": {
+            "type": "string"
+          },
           "status": {
             "type": "string"
           },
@@ -9345,6 +9348,9 @@
           "name": {
             "type": "string"
           },
+          "slug": {
+            "type": "string"
+          },
           "tool_timeout_seconds": {
             "type": "integer"
           },
@@ -9764,6 +9770,21 @@
           }
         }
       },
+      "auditlog.HeaderRevisionSnapshot": {
+        "type": "object",
+        "properties": {
+          "removed": {
+            "description": "Removed contains the names of headers the revision removes.",
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "set": {
+            "description": "Set contains either map[string]string values or a []string of names,\naccording to the LOGGING_LOG_HEADERS policy described above."
+          }
+        }
+      },
       "auditlog.LogData": {
         "type": "object",
         "properties": {
@@ -9817,7 +9838,7 @@
             }
           },
           "request_revisions": {
-            "description": "RequestRevisions captures the ingress request-rewrite chain: one entry\nper registered rewriter that changed the body, in application order.\nRequestBody always remains the original client request; the last\nrevision is what was forwarded downstream.",
+            "description": "RequestRevisions captures intended request-processing changes in\napplication order: body rewrites and outbound header modifications.\nRequestBody always remains the original client request. A revision records\nwhat would be applied if execution reaches provider egress; it is not proof\nof egress.",
             "type": "array",
             "items": {
               "$ref": "#/components/schemas/auditlog.RequestRevisionSnapshot"
@@ -9965,6 +9986,14 @@
           "detail": {
             "description": "Detail is an optional rewriter-provided structured summary of what\nchanged (for example a compression block report)."
           },
+          "headers": {
+            "description": "Headers records the outbound provider-request header changes made by\nthis revision. Only the delta is stored; absent means unchanged.",
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/auditlog.HeaderRevisionSnapshot"
+              }
+            ]
+          },
           "rewriter": {
             "type": "string"
           },
diff --git a/internal/admin/dashboard/static/css/dashboard.css b/internal/admin/dashboard/static/css/dashboard.css
index acc1cf02..7f998338 100644
--- a/internal/admin/dashboard/static/css/dashboard.css
+++ b/internal/admin/dashboard/static/css/dashboard.css
@@ -5262,6 +5262,29 @@ body.conversation-drawer-open {
   min-width: 0;
 }
 
+.guardrail-header-rows {
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+  align-items: flex-start;
+}
+
+.guardrail-header-row {
+  display: grid;
+  grid-template-columns: minmax(0, 1.1fr) minmax(120px, auto) minmax(0, 1fr) auto;
+  gap: 8px;
+  align-items: center;
+  width: 100%;
+}
+
+.guardrail-action-row {
+  grid-template-columns: minmax(120px, auto) minmax(0, 1.1fr) minmax(0, 1fr) auto;
+}
+
+.guardrail-header-row .guardrail-header-row-spacer {
+  min-width: 0;
+}
+
 .settings-guardrail-type-pill {
   display: inline-flex;
   align-items: center;
diff --git a/internal/admin/dashboard/static/js/dashboard.js b/internal/admin/dashboard/static/js/dashboard.js
index 3496b1f7..6ad3f06c 100644
--- a/internal/admin/dashboard/static/js/dashboard.js
+++ b/internal/admin/dashboard/static/js/dashboard.js
@@ -234,6 +234,7 @@ function dashboard() {
         "workflows",
         "audit-logs",
         "guardrails",
+        "header-policies",
         "mcp-servers",
         "auth-keys",
         "settings",
@@ -269,6 +270,9 @@ function dashboard() {
       ) {
         this.fetchGuardrailsPage();
       }
+      if (page === "header-policies" && typeof this.fetchHeaderPolicies === "function") {
+        this.fetchHeaderPolicies();
+      }
       if (
         page === "mcp-servers" &&
         typeof this.fetchMcpServersPage === "function"
@@ -477,6 +481,7 @@ function dashboard() {
         this.failoverDraftsOpen ||
         (this.page === "workflows" && this.workflowFormOpen) ||
         (this.page === "guardrails" && this.guardrailFormOpen) ||
+        (this.page === "header-policies" && this.headerPolicyFormOpen) ||
         (this.page === "mcp-servers" &&
           (this.mcpServerFormOpen || this.mcpCatalogOpen)) ||
         (this.page === "auth-keys" && this.authKeyFormOpen) ||
@@ -788,6 +793,9 @@ function dashboard() {
       ) {
         requests.push(this.fetchGuardrailsPage());
       }
+      if (this.page === "header-policies" && typeof this.fetchHeaderPolicies === "function") {
+        requests.push(this.fetchHeaderPolicies());
+      }
       if (this.page === "usage" && typeof this.fetchUsagePage === "function") {
         requests.push(this.fetchUsagePage());
       }
@@ -1242,6 +1250,12 @@ function dashboard() {
         : null,
       "dashboardGuardrailsModule",
     ),
+    resolveModuleFactory(
+      typeof dashboardHeaderPoliciesModule === "function"
+        ? dashboardHeaderPoliciesModule
+        : null,
+      "dashboardHeaderPoliciesModule",
+    ),
     resolveModuleFactory(
       typeof dashboardBudgetsModule === "function"
         ? dashboardBudgetsModule
diff --git a/internal/admin/dashboard/static/js/modules/audit-list.js b/internal/admin/dashboard/static/js/modules/audit-list.js
index 1317185f..255a064c 100644
--- a/internal/admin/dashboard/static/js/modules/audit-list.js
+++ b/internal/admin/dashboard/static/js/modules/audit-list.js
@@ -534,7 +534,8 @@
             },
 
             // auditRequestRevisions returns the ingress rewrite chain recorded for
-            // the entry (one item per rewriter that changed the request body).
+            // the entry (one item per rewriter or header-modification step that
+            // changed the request body or the outbound headers).
             auditRequestRevisions(entry) {
                 return entry && entry.data && Array.isArray(entry.data.request_revisions)
                     ? entry.data.request_revisions
@@ -555,15 +556,27 @@
             // auditRequestRevisionPane renders one ingress rewrite: a structured
             // summary of what the rewriter changed plus the rewritten body when
             // it was captured. The original client request stays on the Request
-            // tab; the last revision is what the provider actually received.
+            // tab. Revisions describe intended changes and do not prove egress.
             auditRequestRevisionPane(entry, revision) {
                 const body = revision && revision.body;
                 const hasBody = body != null && body !== '';
+                const headerDelta = (revision && revision.headers) || null;
                 const single = this.auditRequestRevisions(entry).length <= 1;
                 const summary = {
-                    rewriter: (revision && revision.rewriter) || '',
-                    bytes: Number(revision && revision.bytes_before || 0) + ' \u2192 ' + Number(revision && revision.bytes_after || 0)
+                    rewriter: (revision && revision.rewriter) || ''
                 };
+                if (!headerDelta || revision.bytes_before || revision.bytes_after) {
+                    summary.bytes = Number(revision && revision.bytes_before || 0) + ' \u2192 ' + Number(revision && revision.bytes_after || 0);
+                }
+                // Only changed headers are recorded. Depending on
+                // LOGGING_LOG_HEADERS, set is either a redacted name/value
+                // object or a names-only array; removed always carries names.
+                if (headerDelta && headerDelta.set) {
+                    summary.headers_set = headerDelta.set;
+                }
+                if (headerDelta && headerDelta.removed) {
+                    summary.headers_removed = headerDelta.removed;
+                }
                 if (revision && revision.detail != null) {
                     summary.detail = revision.detail;
                 }
@@ -587,7 +600,7 @@
                     body,
                     showEmpty: false,
                     emptyMessage: '',
-                    showTooLarge: !hasBody,
+                    showTooLarge: !hasBody && !headerDelta,
                     tooLargeMessage: 'Rewritten body not captured (body logging disabled or body too large).'
                 };
             },
diff --git a/internal/admin/dashboard/static/js/modules/audit-list.test.cjs b/internal/admin/dashboard/static/js/modules/audit-list.test.cjs
index 61ad8129..c939293a 100644
--- a/internal/admin/dashboard/static/js/modules/audit-list.test.cjs
+++ b/internal/admin/dashboard/static/js/modules/audit-list.test.cjs
@@ -988,3 +988,68 @@ test('entries without revisions render no revision tabs', () => {
     assert.equal(module.auditPanes(entry).map((p) => p.id).join(','), 'request,response');
     assert.equal(module.auditRequestRevisions(entry).length, 0);
 });
+
+test('auditRequestRevisionPane renders header-only revisions with the delta and no body warning', () => {
+    const module = createAuditListModule();
+    const entry = {
+        data: {
+            request_revisions: [{
+                seq: 1,
+                rewriter: 'pin-beta',
+                bytes_before: 0,
+                bytes_after: 0,
+                headers: {
+                    set: { 'Anthropic-Beta': 'context-1m' },
+                    removed: ['X-Debug']
+                }
+            }]
+        }
+    };
+
+    const pane = module.auditRequestRevisionPane(entry, entry.data.request_revisions[0]);
+
+    assert.equal(pane.headers.rewriter, 'pin-beta');
+    assert.equal('bytes' in pane.headers, false, 'byte sizes are meaningless for header-only revisions');
+    assert.deepEqual(JSON.parse(JSON.stringify(pane.headers.headers_set)), { 'Anthropic-Beta': 'context-1m' });
+    assert.deepEqual(JSON.parse(JSON.stringify(pane.headers.headers_removed)), ['X-Debug']);
+    assert.equal(pane.showBody, false);
+    assert.equal(pane.showTooLarge, false, 'header-only revisions must not warn about missing bodies');
+    assert.equal(pane.savingsLabel, '');
+});
+
+test('auditRequestRevisionPane renders names-only set deltas when header value logging is disabled', () => {
+    const module = createAuditListModule();
+    const entry = {
+        data: {
+            request_revisions: [{
+                seq: 1,
+                rewriter: 'pin-beta',
+                headers: {
+                    set: ['Anthropic-Beta', 'X-Custom-Auth'],
+                    removed: ['X-Debug']
+                }
+            }]
+        }
+    };
+
+    const pane = module.auditRequestRevisionPane(entry, entry.data.request_revisions[0]);
+
+    assert.deepEqual(JSON.parse(JSON.stringify(pane.headers.headers_set)), ['Anthropic-Beta', 'X-Custom-Auth']);
+    assert.deepEqual(JSON.parse(JSON.stringify(pane.headers.headers_removed)), ['X-Debug']);
+    assert.equal(pane.showTooLarge, false);
+});
+
+test('auditRequestRevisionPane keeps byte sizes and warning for body rewrites', () => {
+    const module = createAuditListModule();
+    const entry = {
+        data: {
+            request_revisions: [{ seq: 1, rewriter: 'compress', bytes_before: 100, bytes_after: 60 }]
+        }
+    };
+
+    const pane = module.auditRequestRevisionPane(entry, entry.data.request_revisions[0]);
+
+    assert.equal(pane.headers.bytes, '100 → 60');
+    assert.equal('headers_set' in pane.headers, false);
+    assert.equal(pane.showTooLarge, true);
+});
diff --git a/internal/admin/dashboard/static/js/modules/guardrails.js b/internal/admin/dashboard/static/js/modules/guardrails.js
index ad4602a7..ba0a64a0 100644
--- a/internal/admin/dashboard/static/js/modules/guardrails.js
+++ b/internal/admin/dashboard/static/js/modules/guardrails.js
@@ -145,7 +145,7 @@
                         const parsed = Number(trimmed);
                         nextConfig[field.key] = Number.isFinite(parsed) ? parsed : trimmed;
                     }
-                } else if (field.input === 'checkboxes') {
+				} else if (field.input === 'checkboxes') {
                     nextConfig[field.key] = this.normalizeGuardrailArrayValue(value);
                 } else {
                     nextConfig[field.key] = value;
@@ -156,6 +156,10 @@
                 };
             },
 
+            sanitizeGuardrailConfig(_type, config) {
+                return config;
+            },
+
             syncGuardrailTypeSelectValue() {
                 const select = this.$refs && this.$refs.guardrailTypeSelect;
                 if (!select) {
@@ -372,7 +376,7 @@
                     type,
                     description: String(this.guardrailForm.description || '').trim() || undefined,
                     user_path: String(this.guardrailForm.user_path || '').trim() || undefined,
-                    config: this.cloneGuardrailJSON(this.guardrailForm.config)
+                    config: this.sanitizeGuardrailConfig(type, this.cloneGuardrailJSON(this.guardrailForm.config))
                 };
 
                 try {
diff --git a/internal/admin/dashboard/static/js/modules/header-policies.js b/internal/admin/dashboard/static/js/modules/header-policies.js
new file mode 100644
index 00000000..f57bcf1c
--- /dev/null
+++ b/internal/admin/dashboard/static/js/modules/header-policies.js
@@ -0,0 +1,273 @@
+(function(global) {
+    function dashboardHeaderPoliciesModule() {
+        return {
+            headerPolicies: [],
+            headerPoliciesAvailable: true,
+            headerPoliciesLoading: false,
+            headerPolicyError: '',
+            headerPolicyNotice: '',
+            headerPolicyFilter: '',
+            headerPolicyFormOpen: false,
+            headerPolicyFormSubmitting: false,
+            headerPolicyDeletingName: '',
+            headerPolicyFormMode: 'create',
+            headerPolicyFormOriginalName: '',
+            headerPolicyForm: {
+                name: '', description: '', methods: [], paths: '', when: [],
+                actions: [{ action: 'set', header: '', value: '' }]
+            },
+
+            defaultHeaderPolicyForm() {
+                return { name: '', description: '', methods: [], paths: '', when: [], actions: [{ action: 'set', header: '', value: '' }] };
+            },
+
+            get filteredHeaderPolicies() {
+                const filter = String(this.headerPolicyFilter || '').trim().toLowerCase();
+                if (!filter) return this.headerPolicies;
+                return (this.headerPolicies || []).filter((policy) => [policy.name, policy.description, policy.summary]
+                    .some((value) => String(value || '').toLowerCase().includes(filter)));
+            },
+
+            headerPoliciesRuntimeEnabled() {
+                return typeof this.workflowRuntimeBooleanFlag === 'function'
+                    ? this.workflowRuntimeBooleanFlag('HEADER_POLICIES_ENABLED', true)
+                    : true;
+            },
+
+            headerPolicyMethodSelected(method) {
+                return (this.headerPolicyForm.methods || []).includes(method);
+            },
+
+            toggleHeaderPolicyMethod(method, checked) {
+                const current = Array.isArray(this.headerPolicyForm.methods) ? this.headerPolicyForm.methods : [];
+                this.headerPolicyForm.methods = checked
+                    ? Array.from(new Set([...current, method]))
+                    : current.filter((item) => item !== method);
+            },
+
+            addHeaderPolicyCondition() {
+                this.headerPolicyForm.when.push({ header: '' });
+            },
+
+            removeHeaderPolicyCondition(index) {
+                this.headerPolicyForm.when.splice(index, 1);
+            },
+
+            headerPolicyConditionMode(row) {
+                if (row && row.matches !== undefined) return 'matches';
+                if (row && row.equals !== undefined) return 'equals';
+                if (row && row.present === false) return 'absent';
+                return 'present';
+            },
+
+            setHeaderPolicyConditionMode(index, mode) {
+                const current = this.headerPolicyForm.when[index] || {};
+                const next = { header: current.header || '' };
+                if (mode === 'matches') next.matches = '';
+                if (mode === 'equals') next.equals = '';
+                if (mode === 'absent') next.present = false;
+                this.headerPolicyForm.when.splice(index, 1, next);
+            },
+
+            setHeaderPolicyConditionValue(index, value) {
+                const row = this.headerPolicyForm.when[index];
+                const mode = this.headerPolicyConditionMode(row);
+                if (mode === 'equals' || mode === 'matches') row[mode] = value;
+            },
+
+            addHeaderPolicyAction() {
+                this.headerPolicyForm.actions.push({ action: 'set', header: '', value: '' });
+            },
+
+            removeHeaderPolicyAction(index) {
+                this.headerPolicyForm.actions.splice(index, 1);
+            },
+
+            headerPolicyActionMode(row) {
+                if (row && row.action === 'remove') return 'remove';
+                if (row && row.from_header !== undefined) return 'copy';
+                return 'set';
+            },
+
+            setHeaderPolicyActionMode(index, mode) {
+                const header = (this.headerPolicyForm.actions[index] || {}).header || '';
+                const next = mode === 'remove'
+                    ? { action: 'remove', header }
+                    : mode === 'copy'
+                        ? { action: 'set', header, from_header: '' }
+                        : { action: 'set', header, value: '' };
+                this.headerPolicyForm.actions.splice(index, 1, next);
+            },
+
+            setHeaderPolicyActionValue(index, value) {
+                const row = this.headerPolicyForm.actions[index];
+                if (this.headerPolicyActionMode(row) === 'copy') row.from_header = value;
+                else row.value = value;
+            },
+
+            openHeaderPolicyCreate() {
+                this.headerPolicyFormMode = 'create';
+                this.headerPolicyFormOriginalName = '';
+                this.headerPolicyError = '';
+                this.headerPolicyNotice = '';
+                this.headerPolicyForm = this.defaultHeaderPolicyForm();
+                this.headerPolicyFormOpen = true;
+            },
+
+            openHeaderPolicyEdit(policy) {
+                this.headerPolicyFormMode = 'edit';
+                this.headerPolicyFormOriginalName = String(policy && policy.name || '').trim();
+                this.headerPolicyError = '';
+                this.headerPolicyNotice = '';
+                this.headerPolicyForm = {
+                    name: this.headerPolicyFormOriginalName,
+                    description: String(policy && policy.description || '').trim(),
+                    methods: Array.isArray(policy && policy.methods) ? [...policy.methods] : [],
+                    paths: Array.isArray(policy && policy.paths) ? policy.paths.join(', ') : '',
+                    when: Array.isArray(policy && policy.when) ? JSON.parse(JSON.stringify(policy.when)) : [],
+                    actions: Array.isArray(policy && policy.actions) ? JSON.parse(JSON.stringify(policy.actions)) : []
+                };
+                this.headerPolicyFormOpen = true;
+            },
+
+            closeHeaderPolicyForm() {
+                this.headerPolicyFormOpen = false;
+                this.headerPolicyFormMode = 'create';
+                this.headerPolicyFormOriginalName = '';
+                this.headerPolicyError = '';
+                this.headerPolicyForm = this.defaultHeaderPolicyForm();
+            },
+
+            headerPolicyPayload() {
+                const paths = String(this.headerPolicyForm.paths || '').split(',').map((item) => item.trim()).filter(Boolean);
+                const when = (this.headerPolicyForm.when || [])
+                    .filter((row) => String(row && row.header || '').trim())
+                    .map((row) => {
+                        const next = { header: String(row.header).trim() };
+                        const mode = this.headerPolicyConditionMode(row);
+                        if (mode === 'absent') next.present = false;
+                        if (mode === 'equals' || mode === 'matches') next[mode] = String(row[mode] ?? '');
+                        return next;
+                    });
+                const actions = (this.headerPolicyForm.actions || [])
+                    .filter((row) => String(row && row.header || '').trim())
+                    .map((row) => {
+                        const mode = this.headerPolicyActionMode(row);
+                        const next = { action: mode === 'remove' ? 'remove' : 'set', header: String(row.header).trim() };
+                        if (mode === 'copy') next.from_header = String(row.from_header || '').trim();
+                        if (mode === 'set') next.value = String(row.value ?? '');
+                        return next;
+                    });
+                return {
+                    name: String(this.headerPolicyForm.name || '').trim(),
+                    description: String(this.headerPolicyForm.description || '').trim() || undefined,
+                    methods: (this.headerPolicyForm.methods || []).length ? this.headerPolicyForm.methods : undefined,
+                    paths: paths.length ? paths : undefined,
+                    when: when.length ? when : undefined,
+                    actions
+                };
+            },
+
+            async headerPolicyResponseMessage(res, fallback) {
+                try {
+                    const payload = await res.json();
+                    if (payload && payload.error && payload.error.message) return payload.error.message;
+                } catch (_) {
+                    // Ignore invalid or empty responses and return the fallback.
+                }
+                return fallback;
+            },
+
+            async fetchHeaderPolicies() {
+                this.headerPoliciesLoading = true;
+                this.headerPolicyError = '';
+                try {
+                    const request = typeof this.requestOptions === 'function' ? this.requestOptions() : { headers: this.headers() };
+                    const res = await fetch('/admin/header-policies', request);
+                    if (res.status === 503) {
+                        this.headerPoliciesAvailable = false;
+                        this.headerPolicies = [];
+                        return;
+                    }
+                    const handled = this.handleFetchResponse(res, 'header policies', request);
+                    if (typeof this.isStaleAuthFetchResult === 'function' && this.isStaleAuthFetchResult(handled)) return;
+                    this.headerPoliciesAvailable = true;
+                    if (!handled) {
+                        this.headerPolicies = [];
+                        return;
+                    }
+                    const payload = await res.json();
+                    this.headerPolicies = Array.isArray(payload) ? payload : [];
+                } catch (e) {
+                    console.error('Failed to fetch header policies:', e);
+                    this.headerPolicies = [];
+                    this.headerPolicyError = 'Unable to load header policies.';
+                } finally {
+                    this.headerPoliciesLoading = false;
+                }
+            },
+
+            async submitHeaderPolicyForm() {
+                const payload = this.headerPolicyPayload();
+                if (!payload.name) {
+                    this.headerPolicyError = 'Name is required.';
+                    return;
+                }
+                if (!payload.actions.length) {
+                    this.headerPolicyError = 'At least one complete action is required.';
+                    return;
+                }
+                this.headerPolicyFormSubmitting = true;
+                this.headerPolicyError = '';
+                this.headerPolicyNotice = '';
+                try {
+                    const request = this.requestOptions({ method: 'PUT', body: JSON.stringify(payload) });
+                    const res = await fetch('/admin/header-policies', request);
+                    const handled = this.handleFetchResponse(res, 'save header policy', request);
+                    if (typeof this.isStaleAuthFetchResult === 'function' && this.isStaleAuthFetchResult(handled)) return;
+                    if (!handled) {
+                        this.headerPolicyError = await this.headerPolicyResponseMessage(res, 'Failed to save header policy.');
+                        return;
+                    }
+                    await this.fetchHeaderPolicies();
+                    if (typeof this.fetchWorkflowHeaderPolicies === 'function') this.fetchWorkflowHeaderPolicies();
+                    this.headerPolicyNotice = 'Header policy "' + payload.name + '" saved.';
+                    this.closeHeaderPolicyForm();
+                } catch (e) {
+                    console.error('Failed to save header policy:', e);
+                    this.headerPolicyError = 'Failed to save header policy.';
+                } finally {
+                    this.headerPolicyFormSubmitting = false;
+                }
+            },
+
+            async deleteHeaderPolicy(policy) {
+                const name = String(policy && policy.name || '').trim();
+                if (!name || this.headerPolicyDeletingName) return;
+                if (!window.confirm('Delete header policy "' + name + '"? Workflows that reference it must be updated first.')) return;
+                this.headerPolicyDeletingName = name;
+                this.headerPolicyError = '';
+                try {
+                    const request = this.requestOptions({ method: 'DELETE', body: JSON.stringify({ name }) });
+                    const res = await fetch('/admin/header-policies', request);
+                    const handled = this.handleFetchResponse(res, 'delete header policy', request);
+                    if (typeof this.isStaleAuthFetchResult === 'function' && this.isStaleAuthFetchResult(handled)) return;
+                    if (!handled) {
+                        this.headerPolicyError = await this.headerPolicyResponseMessage(res, 'Failed to delete header policy.');
+                        return;
+                    }
+                    await this.fetchHeaderPolicies();
+                    if (typeof this.fetchWorkflowHeaderPolicies === 'function') this.fetchWorkflowHeaderPolicies();
+                    this.headerPolicyNotice = 'Header policy "' + name + '" deleted.';
+                } catch (e) {
+                    console.error('Failed to delete header policy:', e);
+                    this.headerPolicyError = 'Failed to delete header policy.';
+                } finally {
+                    this.headerPolicyDeletingName = '';
+                }
+            }
+        };
+    }
+
+    global.dashboardHeaderPoliciesModule = dashboardHeaderPoliciesModule;
+})(window);
diff --git a/internal/admin/dashboard/static/js/modules/header-policies.test.cjs b/internal/admin/dashboard/static/js/modules/header-policies.test.cjs
new file mode 100644
index 00000000..93d696dc
--- /dev/null
+++ b/internal/admin/dashboard/static/js/modules/header-policies.test.cjs
@@ -0,0 +1,101 @@
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const test = require('node:test');
+const vm = require('node:vm');
+
+function createModule(overrides = {}, globals = {}) {
+    const source = fs.readFileSync(path.join(__dirname, 'header-policies.js'), 'utf8');
+    const context = {
+        window: { confirm: () => true },
+        console,
+        fetch: globals.fetch || (async () => ({ status: 200, json: async () => [] }))
+    };
+    vm.runInNewContext(source, context);
+    return {
+        ...context.window.dashboardHeaderPoliciesModule(),
+        requestOptions: (options = {}) => options,
+        handleFetchResponse: (response) => response.status >= 200 && response.status < 300,
+        headers: () => ({}),
+        ...overrides
+    };
+}
+
+test('headerPolicyPayload emits the dedicated API shape and preserves empty literals', () => {
+    const module = createModule();
+    module.headerPolicyForm = {
+        name: ' pin-beta ',
+        description: ' beta ',
+        methods: ['POST'],
+        paths: '/v1/chat/completions, /p/anthropic/*',
+        when: [{ header: 'X-Empty', equals: '' }],
+        actions: [{ action: 'set', header: 'X-Empty-Upstream', value: '' }]
+    };
+    const payload = module.headerPolicyPayload();
+    assert.equal(JSON.stringify(payload), JSON.stringify({
+        name: 'pin-beta',
+        description: 'beta',
+        methods: ['POST'],
+        paths: ['/v1/chat/completions', '/p/anthropic/*'],
+        when: [{ header: 'X-Empty', equals: '' }],
+        actions: [{ action: 'set', header: 'X-Empty-Upstream', value: '' }]
+    }));
+});
+
+for (const operation of ['save', 'delete']) {
+    test(`${operation} surfaces the API validation message`, async () => {
+        const response = {
+            status: 400,
+            statusText: 'Bad Request',
+            json: async () => ({ error: { message: 'header Content-Type cannot be used in header policies' } })
+        };
+        const module = createModule({}, { fetch: async () => response });
+        if (operation === 'save') {
+            module.headerPolicyForm = {
+                name: 'invalid', description: '', methods: [], paths: '', when: [],
+                actions: [{ action: 'set', header: 'Content-Type', value: 'text/plain' }]
+            };
+            await module.submitHeaderPolicyForm();
+        } else {
+            await module.deleteHeaderPolicy({ name: 'in-use' });
+        }
+        assert.equal(module.headerPolicyError, 'header Content-Type cannot be used in header policies');
+    });
+}
+
+test('openHeaderPolicyEdit hydrates the flattened definition shape', () => {
+    const module = createModule();
+    module.openHeaderPolicyEdit({
+        name: 'pin-beta', methods: ['POST'], paths: ['/v1/*'],
+        when: [{ header: 'User-Agent', matches: '^cline/' }],
+        actions: [{ action: 'remove', header: 'X-Debug' }]
+    });
+    assert.equal(module.headerPolicyFormOpen, true);
+    assert.equal(module.headerPolicyForm.paths, '/v1/*');
+    assert.equal(module.headerPolicyForm.actions[0].action, 'remove');
+});
+
+test('fetchHeaderPolicies reads the dedicated endpoint', async () => {
+    let requested = '';
+    const originalFetch = global.fetch;
+    global.fetch = async (url) => {
+        requested = url;
+        return { status: 200, json: async () => [{ name: 'headers' }] };
+    };
+    try {
+        const source = fs.readFileSync(path.join(__dirname, 'header-policies.js'), 'utf8');
+        const context = { window: { confirm: () => true }, console, fetch: global.fetch };
+        vm.runInNewContext(source, context);
+        const module = {
+            ...context.window.dashboardHeaderPoliciesModule(),
+            requestOptions: () => ({}),
+            handleFetchResponse: () => true,
+            headers: () => ({})
+        };
+        await module.fetchHeaderPolicies();
+        assert.equal(requested, '/admin/header-policies');
+        assert.equal(module.headerPolicies.length, 1);
+    } finally {
+        global.fetch = originalFetch;
+    }
+});
diff --git a/internal/admin/dashboard/static/js/modules/workflows.js b/internal/admin/dashboard/static/js/modules/workflows.js
index a70dd3d3..ba191ed0 100644
--- a/internal/admin/dashboard/static/js/modules/workflows.js
+++ b/internal/admin/dashboard/static/js/modules/workflows.js
@@ -45,6 +45,7 @@
                 scope_user_path: ''
             },
             guardrailRefs: [],
+            headerPolicyRefs: [],
             workflowForm: {
                 scope_provider: '',
                 scope_model: '',
@@ -59,7 +60,8 @@
                     guardrails: false,
                     failover: true
                 },
-                guardrails: []
+                guardrails: [],
+                header_policies: []
             },
 
             defaultWorkflowForm() {
@@ -77,7 +79,8 @@
                         guardrails: false,
                         failover: true
                     },
-                    guardrails: []
+                    guardrails: [],
+                    header_policies: []
                 };
             },
 
@@ -89,6 +92,7 @@
 	                    'BUDGETS_ENABLED',
 	                    'RATE_LIMITS_ENABLED',
 	                    'GUARDRAILS_ENABLED',
+	                    'HEADER_POLICIES_ENABLED',
 	                    'CACHE_ENABLED',
 	                    'REDIS_URL',
 	                    'SEMANTIC_CACHE_ENABLED',
@@ -242,6 +246,9 @@
                         workflow.workflow_hash,
                         ...(Array.isArray(workflow.workflow_payload && workflow.workflow_payload.guardrails)
                             ? workflow.workflow_payload.guardrails.map((step) => step.ref)
+                            : []),
+                        ...(Array.isArray(workflow.workflow_payload && workflow.workflow_payload.header_policies)
+                            ? workflow.workflow_payload.header_policies.map((step) => step.ref)
                             : [])
                     ];
                     return fields.some((value) => String(value || '').toLowerCase().includes(filter));
@@ -405,6 +412,7 @@
                 features.failover = rawFeatures.failover;
                 const guardrailsEnabled = !!features.guardrails;
                 const guardrails = guardrailsEnabled ? this.workflowSourceGuardrails(form) : [];
+                const headerPolicies = this.workflowSourceHeaderPolicies(form);
                 const scopeType = this.workflowScopeType(scope);
                 const scopeDisplay = this.workflowScopeDisplay(scope);
 
@@ -429,7 +437,8 @@
                             guardrails: guardrailsEnabled,
                             failover: !!features.failover
                         },
-                        guardrails
+                        guardrails,
+                        ...(headerPolicies.length ? { header_policies: headerPolicies } : {})
                     }
                 };
             },
@@ -493,6 +502,24 @@
                     .filter((step) => Number.isInteger(step.step) && step.step >= 0);
             },
 
+            workflowSourceHeaderPolicies(source) {
+                const raw = Array.isArray(source && source.workflow_payload && source.workflow_payload.header_policies)
+                    ? source.workflow_payload.header_policies
+                    : Array.isArray(source && source.header_policies)
+                        ? source.header_policies
+                        : [];
+                return raw
+                    .map((step) => ({
+                        ref: String(step && step.ref || '').trim(),
+                        step: this.parseWorkflowGuardrailStep(step && step.step)
+                    }))
+                    .filter((step) => Number.isInteger(step.step) && step.step >= 0);
+            },
+
+            workflowHeaderPolicies(workflow) {
+                return this.workflowSourceHeaderPolicies(workflow);
+            },
+
             canDeactivateWorkflow(workflow) {
                 return String(workflow && workflow.scope_type || '').trim() !== 'global';
             },
@@ -567,7 +594,7 @@
                 const storedFeatures = workflow.workflow_payload && workflow.workflow_payload.features
                     ? this.workflowNormalizedFeatures(workflow.workflow_payload.features)
                     : this.workflowSourceFeatures(workflow);
-                const storedGuardrails = Array.isArray(workflow.workflow_payload && workflow.workflow_payload.guardrails)
+                let storedGuardrails = Array.isArray(workflow.workflow_payload && workflow.workflow_payload.guardrails)
                     ? workflow.workflow_payload.guardrails
                         .map((step) => ({
                             ref: String(step && step.ref || '').trim(),
@@ -575,6 +602,16 @@
                         }))
                         .filter((step) => Number.isInteger(step.step) && step.step >= 0)
                     : this.workflowSourceGuardrails(workflow);
+                let storedHeaderPolicies = this.workflowSourceHeaderPolicies(workflow);
+                const hasDedicatedHeaderPolicies = Array.isArray(workflow.workflow_payload && workflow.workflow_payload.header_policies);
+                if (!hasDedicatedHeaderPolicies && storedGuardrails.length > 0) {
+                    const knownHeaderPolicies = new Set((this.headerPolicyRefs || []).map((ref) => String(ref || '').trim()));
+                    const legacyHeaderPolicies = storedGuardrails.filter((step) => knownHeaderPolicies.has(step.ref));
+                    if (legacyHeaderPolicies.length > 0) {
+                        storedHeaderPolicies = legacyHeaderPolicies;
+                        storedGuardrails = storedGuardrails.filter((step) => !knownHeaderPolicies.has(step.ref));
+                    }
+                }
                 this.workflowForm = {
                     scope_provider: this.workflowScopeProviderValue(workflow.scope),
                     scope_model: String(workflow.scope && workflow.scope.scope_model || ''),
@@ -592,6 +629,10 @@
                     guardrails: storedGuardrails.map((step) => ({
                         ref: String(step && step.ref || ''),
                         step: Number.isFinite(step && step.step) ? step.step : 10
+                    })),
+                    header_policies: storedHeaderPolicies.map((step) => ({
+                        ref: String(step && step.ref || ''),
+                        step: Number.isFinite(step && step.step) ? step.step : 10
                     }))
                 };
                 this.focusWorkflowForm();
@@ -637,6 +678,20 @@
                 this.workflowForm.guardrails.splice(index, 1);
             },
 
+            addWorkflowHeaderPolicyStep() {
+                const steps = Array.isArray(this.workflowForm.header_policies) ? this.workflowForm.header_policies : [];
+                const nextStep = steps.reduce((maxStep, step) => {
+                    const parsed = Number(step && step.step);
+                    return Number.isFinite(parsed) ? Math.max(maxStep, parsed) : maxStep;
+                }, 0) + 10;
+                this.workflowForm.header_policies.push(this.defaultWorkflowGuardrailStep(nextStep));
+            },
+
+            removeWorkflowHeaderPolicyStep(index) {
+                if (!Array.isArray(this.workflowForm.header_policies)) return;
+                this.workflowForm.header_policies.splice(index, 1);
+            },
+
             workflowScopeUserPathValidationError(value) {
                 const trimmed = String(value || '').trim();
                 if (!trimmed) {
@@ -720,6 +775,10 @@
                         };
                     })
                     : [];
+                const headerPolicies = (Array.isArray(form.header_policies) ? form.header_policies : []).map((step) => ({
+                    ref: String(step && step.ref || '').trim(),
+                    step: this.parseWorkflowGuardrailStep(step && step.step)
+                }));
 
                 const payload = {
                     scope_provider_name: provider,
@@ -736,7 +795,8 @@
                             budget: !!features.budget,
                             guardrails: !!features.guardrails
                         },
-                        guardrails
+                        guardrails,
+                        ...(headerPolicies.length ? { header_policies: headerPolicies } : {})
                     }
                 };
                 if (includeFailover) {
@@ -855,12 +915,12 @@
                 const guardrails = Array.isArray(payload.workflow_payload && payload.workflow_payload.guardrails)
                     ? payload.workflow_payload.guardrails
                     : [];
-                if (!features.guardrails) {
-                    return '';
-                }
+                const headerPolicies = Array.isArray(payload.workflow_payload && payload.workflow_payload.header_policies)
+                    ? payload.workflow_payload.header_policies
+                    : [];
 
                 const seen = new Set();
-                for (const step of guardrails) {
+                for (const step of features.guardrails ? guardrails : []) {
                     if (!step.ref) {
                         return 'Each guardrail step needs a guardrail ref.';
                     }
@@ -873,6 +933,20 @@
                     seen.add(step.ref);
                 }
 
+                const seenPolicies = new Set();
+                for (const step of headerPolicies) {
+                    if (!step.ref) {
+                        return 'Each header policy step needs a policy ref.';
+                    }
+                    if (!Number.isInteger(step.step) || step.step < 0) {
+                        return 'Each header policy step must use a non-negative integer step number.';
+                    }
+                    if (seenPolicies.has(step.ref)) {
+                        return 'Each header policy ref may appear only once in a workflow.';
+                    }
+                    seenPolicies.add(step.ref);
+                }
+
                 return '';
             },
 
@@ -952,11 +1026,30 @@
                 }
             },
 
+            async fetchWorkflowHeaderPolicies() {
+                try {
+                    const request = typeof this.requestOptions === 'function' ? this.requestOptions() : { headers: this.headers() };
+                    const res = await fetch('/admin/workflows/header-policies', request);
+                    const handled = this.handleFetchResponse(res, 'workflow header policies', request);
+                    if (typeof this.isStaleAuthFetchResult === 'function' && this.isStaleAuthFetchResult(handled)) return;
+                    if (!handled) {
+                        this.headerPolicyRefs = [];
+                        return;
+                    }
+                    const payload = await res.json();
+                    this.headerPolicyRefs = Array.isArray(payload) ? payload : [];
+                } catch (e) {
+                    console.error('Failed to fetch workflow header policies:', e);
+                    this.headerPolicyRefs = [];
+                }
+            },
+
             async fetchWorkflowsPage() {
                 await Promise.all([
                     this.fetchWorkflowRuntimeConfig(),
                     this.fetchWorkflows(),
-                    this.fetchWorkflowGuardrails()
+                    this.fetchWorkflowGuardrails(),
+                    this.fetchWorkflowHeaderPolicies()
                 ]);
             },
 
diff --git a/internal/admin/dashboard/static/js/modules/workflows.test.cjs b/internal/admin/dashboard/static/js/modules/workflows.test.cjs
index 5a743fb6..be4deda2 100644
--- a/internal/admin/dashboard/static/js/modules/workflows.test.cjs
+++ b/internal/admin/dashboard/static/js/modules/workflows.test.cjs
@@ -1036,6 +1036,40 @@ test('openWorkflowCreate drops blank guardrail steps instead of hydrating them a
     );
 });
 
+for (const guardrailsEnabled of [true, false]) {
+    test(`openWorkflowCreate migrates legacy header-policy steps when guardrails are ${guardrailsEnabled ? 'enabled' : 'disabled'}`, () => {
+        const module = createWorkflowsModule();
+        module.focusWorkflowForm = () => {};
+        module.headerPolicyRefs = ['pin-beta'];
+
+        module.openWorkflowCreate({
+            scope: {},
+            workflow_payload: {
+                features: {
+                    cache: true,
+                    audit: true,
+                    usage: true,
+                    guardrails: guardrailsEnabled,
+                    failover: true
+                },
+                guardrails: [
+                    { ref: 'message-safety', step: 10 },
+                    { ref: 'pin-beta', step: 20 }
+                ]
+            }
+        });
+
+        assert.equal(
+            JSON.stringify(module.workflowForm.guardrails),
+            JSON.stringify([{ ref: 'message-safety', step: 10 }])
+        );
+        assert.equal(
+            JSON.stringify(module.workflowForm.header_policies),
+            JSON.stringify([{ ref: 'pin-beta', step: 20 }])
+        );
+    });
+}
+
 test('workflowSourceGuardrails keeps step zero but drops negative and fractional steps from previews', () => {
     const module = createWorkflowsModule();
 
@@ -2455,3 +2489,31 @@ test('fetchWorkflowVersion aborts hung requests, clears the timeout, and cleans
         false
     );
 });
+
+test('buildWorkflowRequest emits outbound header policies independently of guardrails', () => {
+    const module = createWorkflowsModule();
+    module.workflowForm.features.guardrails = false;
+    module.workflowForm.header_policies = [{ ref: 'pin-beta', step: 10 }];
+
+    const payload = module.buildWorkflowRequest();
+
+    assert.equal(payload.workflow_payload.features.guardrails, false);
+    assert.deepEqual(
+        JSON.parse(JSON.stringify(payload.workflow_payload.header_policies)),
+        [{ ref: 'pin-beta', step: 10 }]
+    );
+});
+
+test('validateWorkflowRequest rejects duplicate outbound header policy refs', () => {
+    const module = createWorkflowsModule();
+    const payload = module.buildWorkflowRequest();
+    payload.workflow_payload.header_policies = [
+        { ref: 'pin-beta', step: 10 },
+        { ref: 'pin-beta', step: 20 }
+    ];
+
+    assert.equal(
+        module.validateWorkflowRequest(payload),
+        'Each header policy ref may appear only once in a workflow.'
+    );
+});
diff --git a/internal/admin/dashboard/templates/index.html b/internal/admin/dashboard/templates/index.html
index af8716b3..a2511bdf 100644
--- a/internal/admin/dashboard/templates/index.html
+++ b/internal/admin/dashboard/templates/index.html
@@ -5,6 +5,7 @@
 {{template "dashboard-page-rate-limits" .}}
 {{template "dashboard-page-settings" .}}
 {{template "dashboard-page-guardrails" .}}
+{{template "dashboard-page-header-policies" .}}
 {{template "dashboard-page-mcp-servers" .}}
 {{template "dashboard-page-auth-keys" .}}
 {{template "dashboard-page-models" .}}
diff --git a/internal/admin/dashboard/templates/layout.html b/internal/admin/dashboard/templates/layout.html
index 820e0c83..9abcaa19 100644
--- a/internal/admin/dashboard/templates/layout.html
+++ b/internal/admin/dashboard/templates/layout.html
@@ -322,6 +322,7 @@ <h3>Failover models</h3>
     <script src="{{assetURL "js/modules/workflows.js"}}"></script>
     <script src="{{assetURL "js/modules/auth-keys.js"}}"></script>
     <script src="{{assetURL "js/modules/guardrails.js"}}"></script>
+    <script src="{{assetURL "js/modules/header-policies.js"}}"></script>
     <script src="{{assetURL "js/modules/budgets.js"}}"></script>
     <script src="{{assetURL "js/modules/rate-limits.js"}}"></script>
     <script src="{{assetURL "js/modules/mcp-servers.js"}}"></script>
diff --git a/internal/admin/dashboard/templates/page-guardrails.html b/internal/admin/dashboard/templates/page-guardrails.html
index ffa6e801..3e286595 100644
--- a/internal/admin/dashboard/templates/page-guardrails.html
+++ b/internal/admin/dashboard/templates/page-guardrails.html
@@ -123,7 +123,7 @@ <h3 x-text="guardrailFormMode === 'edit' ? 'Edit Guardrail' : 'Create Guardrail'
                                         <textarea :id="'guardrail-field-' + field.key" :placeholder="field.placeholder || ''" :value="guardrailFieldValue(field)" :aria-describedby="field.help ? 'guardrail-field-help-' + field.key : null" @input="setGuardrailFieldValue(field, $event.target.value)"></textarea>
                                     </template>
                                     <template x-if="field.input !== 'select' && field.input !== 'textarea'">
-                                        <input :id="'guardrail-field-' + field.key" :type="field.input || 'text'" :placeholder="field.placeholder || ''" :value="guardrailFieldValue(field)" :aria-describedby="field.help ? 'guardrail-field-help-' + field.key : null" @input="setGuardrailFieldValue(field, $event.target.value)">
+										<input :id="'guardrail-field-' + field.key" :type="field.input || 'text'" :placeholder="field.placeholder || ''" :value="guardrailFieldValue(field)" :aria-describedby="field.help ? 'guardrail-field-help-' + field.key : null" @input="setGuardrailFieldValue(field, $event.target.value)">
                                     </template>
                                 </div>
                             </template>
diff --git a/internal/admin/dashboard/templates/page-header-policies.html b/internal/admin/dashboard/templates/page-header-policies.html
new file mode 100644
index 00000000..5f85f95f
--- /dev/null
+++ b/internal/admin/dashboard/templates/page-header-policies.html
@@ -0,0 +1,155 @@
+{{define "dashboard-page-header-policies"}}
+<template x-if="page==='header-policies'">
+<div>
+    <div class="page-header">
+        <div>
+            <div class="inline-help-section" x-data="{ open: false, copyId: 'header-policies-help-copy', showLabel: 'Show header policies help', hideLabel: 'Hide header policies help', text: 'Reusable egress policies that inspect inbound request metadata and plan safe outbound provider-request header changes.' }">
+                <div class="inline-help-title-row">
+                    <h2>Outbound Header Policies</h2>
+                    {{template "inline-help-toggle" .}}
+                </div>
+                <p :id="copyId" class="inline-help-copy" x-show="open" x-transition.opacity.duration.200ms x-text="text"></p>
+            </div>
+        </div>
+    </div>
+
+    {{template "auth-banner" .}}
+
+    <div class="alert alert-warning" x-show="!headerPoliciesRuntimeEnabled()">
+        Runtime header modification is off because <code>HEADER_POLICIES_ENABLED</code> is disabled. You can still manage definitions here.
+    </div>
+    <div class="alert alert-warning" x-show="!authError && !headerPoliciesAvailable">Header policies are unavailable.</div>
+    <div class="alert alert-warning" x-show="!authError && headerPolicyError && !headerPolicyFormOpen" x-text="headerPolicyError"></div>
+    <div class="alert alert-success" x-show="!authError && headerPolicyNotice && !headerPolicyError" x-text="headerPolicyNotice"></div>
+
+    <div class="editor-modal-backdrop" x-cloak x-show="headerPolicyFormOpen" x-transition.opacity.duration.160ms aria-hidden="true"></div>
+    <div class="editor-modal-shell editor-modal-shell-wide" x-cloak x-show="headerPolicyFormOpen" x-transition.opacity.duration.160ms @click="closeHeaderPolicyForm()" @keydown.escape.window="headerPolicyFormOpen && !authDialogOpen && closeHeaderPolicyForm()">
+        <div class="model-editor settings-guardrails-editor" x-show="headerPolicyFormOpen" role="dialog" aria-modal="true" aria-label="Outbound header policy editor" @click.stop>
+            <form class="form" @submit.prevent="submitHeaderPolicyForm()">
+                <div class="editor-header">
+                    <div>
+                        <h3 x-text="headerPolicyFormMode === 'edit' ? 'Edit Header Policy' : 'Create Header Policy'"></h3>
+                        <p class="form-hint">Workflow references use the policy name, so existing names cannot be changed.</p>
+                    </div>
+                    <button type="button" class="dialog-close-btn" aria-label="Close header policy editor" @click="closeHeaderPolicyForm()">{{template "x-icon"}}</button>
+                </div>
+
+                <p class="form-error" x-show="headerPolicyError" x-text="headerPolicyError" role="alert" aria-live="assertive"></p>
+
+                <div class="form-grid">
+                    <div class="form-field">
+                        <label class="form-field-label" for="header-policy-name">Name</label>
+                        <input id="header-policy-name" type="text" placeholder="pin-anthropic-beta" x-model="headerPolicyForm.name" :disabled="headerPolicyFormMode === 'edit'" data-modal-autofocus>
+                    </div>
+                    <div class="form-field">
+                        <label class="form-field-label" for="header-policy-description">Description</label>
+                        <input id="header-policy-description" type="text" placeholder="Why this policy exists" x-model="headerPolicyForm.description">
+                    </div>
+
+                    <fieldset class="form-field form-field-wide form-field-fieldset">
+                        <legend class="form-field-legend">HTTP methods</legend>
+                        <div class="workflow-feature-toggles">
+                            <template x-for="method in ['GET', 'POST', 'PUT', 'PATCH', 'DELETE']" :key="method">
+                                <label class="workflow-feature-toggle">
+                                    <input type="checkbox" :checked="headerPolicyMethodSelected(method)" @change="toggleHeaderPolicyMethod(method, $event.target.checked)">
+                                    <span x-text="method"></span>
+                                </label>
+                            </template>
+                        </div>
+                        <small class="form-hint">Leave empty to match every method.</small>
+                    </fieldset>
+
+                    <div class="form-field form-field-wide">
+                        <label class="form-field-label" for="header-policy-paths">Request paths</label>
+                        <input id="header-policy-paths" type="text" placeholder="/v1/chat/completions, /p/anthropic/*" x-model="headerPolicyForm.paths">
+                        <small class="form-hint">Comma-separated GoModel request paths. A trailing <code>*</code> matches a prefix.</small>
+                    </div>
+
+                    <div class="form-field form-field-wide">
+                        <label class="form-field-label">Inbound header conditions</label>
+                        <div class="guardrail-header-rows">
+                            <template x-for="(row, index) in headerPolicyForm.when" :key="'condition-' + index">
+                                <div class="guardrail-header-row">
+                                    <input type="text" placeholder="Header (e.g. User-Agent)" x-model="row.header" :aria-label="'Condition ' + (index + 1) + ' header'">
+                                    <select class="form-select settings-select" :value="headerPolicyConditionMode(row)" :aria-label="'Condition ' + (index + 1) + ' operator'" @change="setHeaderPolicyConditionMode(index, $event.target.value)">
+                                        <option value="present">is present</option>
+                                        <option value="absent">is absent</option>
+                                        <option value="equals">equals</option>
+                                        <option value="matches">matches regex</option>
+                                    </select>
+                                    <input type="text" x-show="['equals', 'matches'].includes(headerPolicyConditionMode(row))" :placeholder="headerPolicyConditionMode(row) === 'matches' ? '^cline/' : 'expected value'" :value="row[headerPolicyConditionMode(row)] ?? ''" @input="setHeaderPolicyConditionValue(index, $event.target.value)" :aria-label="'Condition ' + (index + 1) + ' value'">
+                                    <span class="guardrail-header-row-spacer" x-show="!['equals', 'matches'].includes(headerPolicyConditionMode(row))" aria-hidden="true"></span>
+                                    <button type="button" class="table-action-btn table-action-btn-danger table-icon-btn" :aria-label="'Remove condition ' + (index + 1)" @click="removeHeaderPolicyCondition(index)">{{template "x-icon"}}</button>
+                                </div>
+                            </template>
+                            <button type="button" class="pagination-btn pagination-btn-with-icon" @click="addHeaderPolicyCondition()"><i data-lucide="plus" class="form-action-icon" aria-hidden="true"></i><span>Add Condition</span></button>
+                        </div>
+                    </div>
+
+                    <div class="form-field form-field-wide">
+                        <label class="form-field-label">Outbound header actions</label>
+                        <div class="guardrail-header-rows">
+                            <template x-for="(row, index) in headerPolicyForm.actions" :key="'action-' + index">
+                                <div class="guardrail-header-row guardrail-action-row">
+                                    <select class="form-select settings-select" :value="headerPolicyActionMode(row)" :aria-label="'Action ' + (index + 1) + ' kind'" @change="setHeaderPolicyActionMode(index, $event.target.value)">
+                                        <option value="set">Set value</option>
+                                        <option value="copy">Copy from header</option>
+                                        <option value="remove">Remove</option>
+                                    </select>
+                                    <input type="text" placeholder="Header (e.g. Anthropic-Beta)" x-model="row.header" :aria-label="'Action ' + (index + 1) + ' header'">
+                                    <input type="text" x-show="headerPolicyActionMode(row) !== 'remove'" :placeholder="headerPolicyActionMode(row) === 'copy' ? 'source header name' : 'header value'" :value="headerPolicyActionMode(row) === 'copy' ? (row.from_header || '') : (row.value ?? '')" @input="setHeaderPolicyActionValue(index, $event.target.value)" :aria-label="'Action ' + (index + 1) + ' value'">
+                                    <span class="guardrail-header-row-spacer" x-show="headerPolicyActionMode(row) === 'remove'" aria-hidden="true"></span>
+                                    <button type="button" class="table-action-btn table-action-btn-danger table-icon-btn" :aria-label="'Remove action ' + (index + 1)" @click="removeHeaderPolicyAction(index)">{{template "x-icon"}}</button>
+                                </div>
+                            </template>
+                            <button type="button" class="pagination-btn pagination-btn-with-icon" @click="addHeaderPolicyAction()"><i data-lucide="plus" class="form-action-icon" aria-hidden="true"></i><span>Add Action</span></button>
+                        </div>
+                        <small class="form-hint">Credential, transport, content-type, and content-encoding headers are rejected.</small>
+                    </div>
+                </div>
+
+                <div class="form-actions">
+                    <button type="button" class="pagination-btn" @click="closeHeaderPolicyForm()">Cancel</button>
+                    <button type="submit" class="pagination-btn pagination-btn-primary pagination-btn-with-icon" :disabled="headerPolicyFormSubmitting"><i data-lucide="save" class="form-action-icon" aria-hidden="true"></i><span>Save Header Policy</span></button>
+                </div>
+            </form>
+        </div>
+    </div>
+
+    <div class="settings-guardrails-layout">
+        <section class="settings-panel settings-guardrails-list">
+            <div class="editor-header">
+                <div><h3>Policies</h3><p class="form-hint">Policies are resolved before cache lookup and applied only to the selected primary provider attempt.</p></div>
+                <button type="button" class="pagination-btn pagination-btn-primary pagination-btn-with-icon" :disabled="headerPolicyFormSubmitting || !headerPoliciesAvailable" @click="openHeaderPolicyCreate()"><i data-lucide="plus" class="form-action-icon" aria-hidden="true"></i><span>Create Policy</span></button>
+            </div>
+            <div class="table-toolbar" x-show="headerPoliciesAvailable">
+                <div class="table-toolbar-main"><div class="filter-input-wrap"><i data-lucide="search" class="filter-input-icon" aria-hidden="true"></i><input type="text" class="filter-input" placeholder="Filter by name or summary..." aria-label="Header policy filter" x-model="headerPolicyFilter"></div></div>
+                <div class="table-toolbar-actions" x-show="headerPolicies.length > 0 || String(headerPolicyFilter || '').trim()">
+                    <span class="model-count" x-text="String(headerPolicyFilter || '').trim() ? filteredHeaderPolicies.length + ' / ' + headerPolicies.length + ' policies' : headerPolicies.length + (headerPolicies.length === 1 ? ' policy' : ' policies')"></span>
+                </div>
+            </div>
+            <div class="table-wrapper" x-show="filteredHeaderPolicies.length > 0">
+                <table class="data-table settings-guardrails-table">
+                    <thead><tr><th>Name</th><th>Methods</th><th>Paths</th><th>Summary</th><th class="col-actions">Actions</th></tr></thead>
+                    <tbody>
+                        <template x-for="policy in filteredHeaderPolicies" :key="policy.name">
+                            <tr>
+                                <td class="mono font-size-md" x-text="policy.name"></td>
+                                <td x-text="(policy.methods || []).join(', ') || 'All'"></td>
+                                <td class="mono font-size-md" x-text="(policy.paths || []).join(', ') || 'All'"></td>
+                                <td><div class="settings-guardrail-summary" x-text="policy.summary || policy.description || 'No summary yet.'"></div><div class="settings-guardrail-description" x-show="policy.description" x-text="policy.description"></div></td>
+                                <td class="col-actions"><div class="alias-actions-cell">
+                                    <button type="button" class="table-action-btn table-icon-btn" :aria-label="'Edit header policy ' + policy.name" @click="openHeaderPolicyEdit(policy)">{{template "edit-icon"}}</button>
+                                    <button type="button" class="table-action-btn table-action-btn-danger table-icon-btn" :disabled="headerPolicyDeletingName === policy.name" :aria-label="'Delete header policy ' + policy.name" @click="deleteHeaderPolicy(policy)">{{template "x-icon"}}</button>
+                                </div></td>
+                            </tr>
+                        </template>
+                    </tbody>
+                </table>
+            </div>
+            <p class="empty-state" x-show="filteredHeaderPolicies.length === 0 && !headerPoliciesLoading && headerPoliciesAvailable && !headerPolicyError && !authError">No outbound header policies defined yet.</p>
+        </section>
+    </div>
+</div>
+</template>
+{{end}}
diff --git a/internal/admin/dashboard/templates/page-workflows.html b/internal/admin/dashboard/templates/page-workflows.html
index 50e8e9d4..ebf62963 100644
--- a/internal/admin/dashboard/templates/page-workflows.html
+++ b/internal/admin/dashboard/templates/page-workflows.html
@@ -169,6 +169,21 @@ <h4>Guardrails</h4>
                             </div>
                             <p class="form-hint" x-show="workflowGuardrails(workflowPreview()).length === 0">No guardrails configured for this workflow.</p>
                         </div>
+
+                        <div class="workflow-guardrails">
+                            <div class="workflow-section-head">
+                                <h4>Outbound Header Policies</h4>
+                                <span class="provider-badge" x-text="workflowHeaderPolicies(workflowPreview()).length ? workflowHeaderPolicies(workflowPreview()).length + ' steps' : 'None'"></span>
+                            </div>
+                            <div class="workflow-guardrail-list" x-show="workflowHeaderPolicies(workflowPreview()).length > 0">
+                                <template x-for="(step, stepIndex) in workflowHeaderPolicies(workflowPreview())" :key="'draft-workflow-preview-header-policy-' + stepIndex">
+                                    <div class="workflow-guardrail-item">
+                                        <span class="mono font-size-md" x-text="step.ref"></span>
+                                        <span class="provider-badge" x-text="'step ' + step.step"></span>
+                                    </div>
+                                </template>
+                            </div>
+                        </div>
                     </article>
                 </div>
 
@@ -205,6 +220,37 @@ <h4>Guardrail Steps</h4>
                     <p class="form-hint" x-show="workflowForm.guardrails.length === 0">No guardrail steps configured yet.</p>
                 </div>
 
+                <div class="workflow-guardrail-editor">
+                    <div class="workflow-section-head">
+                        <div>
+                            <h4>Outbound Header Policies</h4>
+                            <p class="form-hint">Resolved before caching and applied to the selected primary provider attempt. They are not message guardrails.</p>
+                        </div>
+                        <button type="button" class="table-action-btn" @click="addWorkflowHeaderPolicyStep()">Add Policy</button>
+                    </div>
+
+                    <div class="alert alert-warning" x-show="headerPolicyRefs.length === 0">
+                        No named header policies are currently registered.
+                        <button type="button" class="table-action-btn" @click="navigate('header-policies')">Open Header Policies</button>
+                    </div>
+
+                    <div class="workflow-guardrail-list-editor" x-show="workflowForm.header_policies.length > 0">
+                        <template x-for="(step, index) in workflowForm.header_policies" :key="'workflow-form-header-policy-' + index">
+                            <div class="workflow-guardrail-row">
+                                <div class="form-field workflow-guardrail-field">
+                                    <label class="form-field-label" :for="'workflow-header-policy-ref-' + index">Header policy reference</label>
+                                    <input type="text" class="workflow-input" :id="'workflow-header-policy-ref-' + index" list="workflow-header-policy-options" placeholder="Policy ref" x-model="step.ref" :aria-label="'Header policy reference ' + (index + 1)">
+                                </div>
+                                <div class="form-field workflow-guardrail-step-field">
+                                    <label class="form-field-label" :for="'workflow-header-policy-step-' + index">Step</label>
+                                    <input type="number" class="workflow-step-input" :id="'workflow-header-policy-step-' + index" min="0" step="10" placeholder="Step" x-model.number="step.step" :aria-label="'Header policy step ' + (index + 1)">
+                                </div>
+                                <button type="button" class="table-action-btn table-action-btn-danger" @click="removeWorkflowHeaderPolicyStep(index)">Remove</button>
+                            </div>
+                        </template>
+                    </div>
+                </div>
+
                 <div class="form-actions">
                     <button type="button" class="pagination-btn" @click="closeWorkflowForm()">Cancel</button>
                     <button type="submit" class="pagination-btn pagination-btn-primary pagination-btn-with-icon workflow-submit-btn" :disabled="workflowSubmitting">
@@ -255,6 +301,21 @@ <h4>Guardrails</h4>
                             <p class="form-hint" x-show="workflowGuardrails(workflow).length === 0">No guardrails configured for this workflow.</p>
                         </div>
 
+                        <div class="workflow-guardrails" x-show="workflowHeaderPolicies(workflow).length > 0">
+                            <div class="workflow-section-head">
+                                <h4>Outbound Header Policies</h4>
+                                <span class="provider-badge" x-text="workflowHeaderPolicies(workflow).length + ' steps'"></span>
+                            </div>
+                            <div class="workflow-guardrail-list">
+                                <template x-for="(step, stepIndex) in workflowHeaderPolicies(workflow)" :key="workflow.id + '-header-policy-' + stepIndex">
+                                    <div class="workflow-guardrail-item">
+                                        <span class="mono font-size-md" x-text="step.ref"></span>
+                                        <span class="provider-badge" x-text="'step ' + step.step"></span>
+                                    </div>
+                                </template>
+                            </div>
+                        </div>
+
                         <div class="workflow-card-footer">
                             <div class="alias-actions-cell">
                                 <button type="button"
@@ -293,6 +354,11 @@ <h4>Guardrails</h4>
             <option :value="guardrailRef"></option>
         </template>
     </datalist>
+    <datalist id="workflow-header-policy-options">
+        <template x-for="policyRef in headerPolicyRefs" :key="policyRef">
+            <option :value="policyRef"></option>
+        </template>
+    </datalist>
 </div>
 </template>
 {{end}}
diff --git a/internal/admin/dashboard/templates/sidebar.html b/internal/admin/dashboard/templates/sidebar.html
index 18d610ea..0a36c657 100644
--- a/internal/admin/dashboard/templates/sidebar.html
+++ b/internal/admin/dashboard/templates/sidebar.html
@@ -48,6 +48,10 @@ <h1>GoModel</h1>
             <i data-lucide="shield-check" class="nav-icon" aria-hidden="true"></i>
             <span>Guardrails (experimental)</span>
         </a>
+        <a href="{{appURL "/admin/dashboard/header-policies"}}" class="nav-item" :class="{ active: page === 'header-policies' }" title="Outbound Header Policies" @click.prevent="navigate('header-policies')">
+            <i data-lucide="panel-top" class="nav-icon" aria-hidden="true"></i>
+            <span>Header Policies</span>
+        </a>
         <a href="{{appURL "/admin/dashboard/mcp-servers"}}" class="nav-item" :class="{ active: page === 'mcp-servers' }" title="MCP Servers" @click.prevent="navigate('mcp-servers')">
             <i data-lucide="plug" class="nav-icon" aria-hidden="true"></i>
             <span>MCP Servers</span>
diff --git a/internal/admin/errors.go b/internal/admin/errors.go
index 83dc7349..0e23417b 100644
--- a/internal/admin/errors.go
+++ b/internal/admin/errors.go
@@ -12,6 +12,7 @@ import (
 	"github.com/enterpilot/gomodel/internal/budget"
 	"github.com/enterpilot/gomodel/internal/core"
 	"github.com/enterpilot/gomodel/internal/guardrails"
+	"github.com/enterpilot/gomodel/internal/headerpolicy"
 	"github.com/enterpilot/gomodel/internal/pricingoverrides"
 	"github.com/enterpilot/gomodel/internal/ratelimit"
 	"github.com/enterpilot/gomodel/internal/virtualmodels"
@@ -50,9 +51,10 @@ func validationWriter(isValidation func(error) bool) func(error) error {
 }
 
 var (
-	workflowWriteError  = validationWriter(workflows.IsValidationError)
-	authKeyWriteError   = validationWriter(authkeys.IsValidationError)
-	guardrailWriteError = validationWriter(guardrails.IsValidationError)
+	workflowWriteError     = validationWriter(workflows.IsValidationError)
+	authKeyWriteError      = validationWriter(authkeys.IsValidationError)
+	guardrailWriteError    = validationWriter(guardrails.IsValidationError)
+	headerPolicyWriteError = validationWriter(headerpolicy.IsValidationError)
 )
 
 // virtualModelWriteError surfaces validation errors as 400 and other failures
diff --git a/internal/admin/handler.go b/internal/admin/handler.go
index bbb6edfb..042459ef 100644
--- a/internal/admin/handler.go
+++ b/internal/admin/handler.go
@@ -19,6 +19,7 @@ import (
 	"github.com/enterpilot/gomodel/internal/core"
 	"github.com/enterpilot/gomodel/internal/failover"
 	"github.com/enterpilot/gomodel/internal/guardrails"
+	"github.com/enterpilot/gomodel/internal/headerpolicy"
 	"github.com/enterpilot/gomodel/internal/live"
 	"github.com/enterpilot/gomodel/internal/pricingoverrides"
 	"github.com/enterpilot/gomodel/internal/providers"
@@ -48,6 +49,8 @@ type Handler struct {
 	tagging             *tagging.Service
 	guardrails          guardrails.Catalog
 	guardrailDefs       *guardrails.Service
+	headerPolicies      headerpolicy.Catalog
+	headerPolicyDefs    *headerpolicy.Service
 	liveBroker          *live.Broker
 	runtimeConfig       DashboardConfigResponse
 	runtimeRefresher    RuntimeRefresher
@@ -62,17 +65,18 @@ type Handler struct {
 type Option func(*Handler)
 
 const (
-	DashboardConfigFailoverEnabled      = "FAILOVER_ENABLED"
-	DashboardConfigLoggingEnabled       = "LOGGING_ENABLED"
-	DashboardConfigUsageEnabled         = "USAGE_ENABLED"
-	DashboardConfigBudgetsEnabled       = "BUDGETS_ENABLED"
-	DashboardConfigRateLimitsEnabled    = "RATE_LIMITS_ENABLED"
-	DashboardConfigGuardrailsEnabled    = "GUARDRAILS_ENABLED"
-	DashboardConfigCacheEnabled         = "CACHE_ENABLED"
-	DashboardConfigRedisURL             = "REDIS_URL"
-	DashboardConfigSemanticCacheEnabled = "SEMANTIC_CACHE_ENABLED"
-	DashboardConfigPricingRecalculation = "USAGE_PRICING_RECALCULATION_ENABLED"
-	DashboardConfigLiveLogsEnabled      = "DASHBOARD_LIVE_LOGS_ENABLED"
+	DashboardConfigFailoverEnabled       = "FAILOVER_ENABLED"
+	DashboardConfigLoggingEnabled        = "LOGGING_ENABLED"
+	DashboardConfigUsageEnabled          = "USAGE_ENABLED"
+	DashboardConfigBudgetsEnabled        = "BUDGETS_ENABLED"
+	DashboardConfigRateLimitsEnabled     = "RATE_LIMITS_ENABLED"
+	DashboardConfigGuardrailsEnabled     = "GUARDRAILS_ENABLED"
+	DashboardConfigHeaderPoliciesEnabled = "HEADER_POLICIES_ENABLED"
+	DashboardConfigCacheEnabled          = "CACHE_ENABLED"
+	DashboardConfigRedisURL              = "REDIS_URL"
+	DashboardConfigSemanticCacheEnabled  = "SEMANTIC_CACHE_ENABLED"
+	DashboardConfigPricingRecalculation  = "USAGE_PRICING_RECALCULATION_ENABLED"
+	DashboardConfigLiveLogsEnabled       = "DASHBOARD_LIVE_LOGS_ENABLED"
 )
 
 // statusClientClosedRequest is the de facto status used by proxies for client-aborted requests.
@@ -80,17 +84,18 @@ const statusClientClosedRequest = 499
 
 // DashboardConfigResponse is the allowlisted runtime config contract exposed to the dashboard UI.
 type DashboardConfigResponse struct {
-	FailoverEnabled      string `json:"FAILOVER_ENABLED,omitempty"`
-	LoggingEnabled       string `json:"LOGGING_ENABLED,omitempty"`
-	UsageEnabled         string `json:"USAGE_ENABLED,omitempty"`
-	BudgetsEnabled       string `json:"BUDGETS_ENABLED,omitempty"`
-	RateLimitsEnabled    string `json:"RATE_LIMITS_ENABLED,omitempty"`
-	GuardrailsEnabled    string `json:"GUARDRAILS_ENABLED,omitempty"`
-	CacheEnabled         string `json:"CACHE_ENABLED,omitempty"`
-	RedisURL             string `json:"REDIS_URL,omitempty"`
-	SemanticCacheEnabled string `json:"SEMANTIC_CACHE_ENABLED,omitempty"`
-	PricingRecalculation string `json:"USAGE_PRICING_RECALCULATION_ENABLED,omitempty"`
-	LiveLogsEnabled      string `json:"DASHBOARD_LIVE_LOGS_ENABLED,omitempty"`
+	FailoverEnabled       string `json:"FAILOVER_ENABLED,omitempty"`
+	LoggingEnabled        string `json:"LOGGING_ENABLED,omitempty"`
+	UsageEnabled          string `json:"USAGE_ENABLED,omitempty"`
+	BudgetsEnabled        string `json:"BUDGETS_ENABLED,omitempty"`
+	RateLimitsEnabled     string `json:"RATE_LIMITS_ENABLED,omitempty"`
+	GuardrailsEnabled     string `json:"GUARDRAILS_ENABLED,omitempty"`
+	HeaderPoliciesEnabled string `json:"HEADER_POLICIES_ENABLED,omitempty"`
+	CacheEnabled          string `json:"CACHE_ENABLED,omitempty"`
+	RedisURL              string `json:"REDIS_URL,omitempty"`
+	SemanticCacheEnabled  string `json:"SEMANTIC_CACHE_ENABLED,omitempty"`
+	PricingRecalculation  string `json:"USAGE_PRICING_RECALCULATION_ENABLED,omitempty"`
+	LiveLogsEnabled       string `json:"DASHBOARD_LIVE_LOGS_ENABLED,omitempty"`
 }
 
 type providerStatusSummaryResponse struct {
@@ -259,6 +264,15 @@ func WithGuardrailService(service *guardrails.Service) Option {
 	}
 }
 
+// WithHeaderPolicyService enables outbound header-policy administration and
+// workflow catalog resolution.
+func WithHeaderPolicyService(service *headerpolicy.Service) Option {
+	return func(h *Handler) {
+		h.headerPolicies = service
+		h.headerPolicyDefs = service
+	}
+}
+
 // WithLiveBroker enables realtime dashboard log previews.
 func WithLiveBroker(broker *live.Broker) Option {
 	return func(h *Handler) {
@@ -324,17 +338,18 @@ func NewHandler(reader usage.UsageReader, registry *providers.ModelRegistry, opt
 
 func normalizeDashboardRuntimeConfig(values DashboardConfigResponse) DashboardConfigResponse {
 	return DashboardConfigResponse{
-		FailoverEnabled:      strings.TrimSpace(values.FailoverEnabled),
-		LoggingEnabled:       strings.TrimSpace(values.LoggingEnabled),
-		UsageEnabled:         strings.TrimSpace(values.UsageEnabled),
-		BudgetsEnabled:       strings.TrimSpace(values.BudgetsEnabled),
-		RateLimitsEnabled:    strings.TrimSpace(values.RateLimitsEnabled),
-		GuardrailsEnabled:    strings.TrimSpace(values.GuardrailsEnabled),
-		CacheEnabled:         strings.TrimSpace(values.CacheEnabled),
-		RedisURL:             strings.TrimSpace(values.RedisURL),
-		SemanticCacheEnabled: strings.TrimSpace(values.SemanticCacheEnabled),
-		PricingRecalculation: strings.TrimSpace(values.PricingRecalculation),
-		LiveLogsEnabled:      strings.TrimSpace(values.LiveLogsEnabled),
+		FailoverEnabled:       strings.TrimSpace(values.FailoverEnabled),
+		LoggingEnabled:        strings.TrimSpace(values.LoggingEnabled),
+		UsageEnabled:          strings.TrimSpace(values.UsageEnabled),
+		BudgetsEnabled:        strings.TrimSpace(values.BudgetsEnabled),
+		RateLimitsEnabled:     strings.TrimSpace(values.RateLimitsEnabled),
+		GuardrailsEnabled:     strings.TrimSpace(values.GuardrailsEnabled),
+		HeaderPoliciesEnabled: strings.TrimSpace(values.HeaderPoliciesEnabled),
+		CacheEnabled:          strings.TrimSpace(values.CacheEnabled),
+		RedisURL:              strings.TrimSpace(values.RedisURL),
+		SemanticCacheEnabled:  strings.TrimSpace(values.SemanticCacheEnabled),
+		PricingRecalculation:  strings.TrimSpace(values.PricingRecalculation),
+		LiveLogsEnabled:       strings.TrimSpace(values.LiveLogsEnabled),
 	}
 }
 
diff --git a/internal/admin/handler_guardrails.go b/internal/admin/handler_guardrails.go
index 4061d28f..426cbfa5 100644
--- a/internal/admin/handler_guardrails.go
+++ b/internal/admin/handler_guardrails.go
@@ -1,6 +1,7 @@
 package admin
 
 import (
+	"context"
 	"errors"
 	"net/http"
 	"strings"
@@ -58,6 +59,9 @@ func (h *Handler) UpsertGuardrail(c *echo.Context) error {
 	if name == "" {
 		return handleError(c, core.NewInvalidRequestError("guardrail name is required", nil))
 	}
+	if strings.EqualFold(strings.ReplaceAll(strings.TrimSpace(req.Type), "-", "_"), "header_modification") {
+		return handleError(c, core.NewInvalidRequestError("header_modification is an outbound header policy; use /admin/header-policies", nil))
+	}
 
 	userPath, err := normalizeUserPathQueryParam("user_path", req.UserPath)
 	if err != nil {
@@ -66,6 +70,12 @@ func (h *Handler) UpsertGuardrail(c *echo.Context) error {
 
 	h.mutationMu.Lock()
 	defer h.mutationMu.Unlock()
+	if h.headerPolicyDefs != nil {
+		if _, exists := h.headerPolicyDefs.Get(name); exists {
+			return handleError(c, core.NewInvalidRequestError("name is already used by a header policy: "+name, nil))
+		}
+	}
+	previous, existed := h.guardrailDefs.Get(name)
 
 	if err := h.guardrailDefs.Upsert(c.Request().Context(), guardrails.Definition{
 		Name:        name,
@@ -76,7 +86,13 @@ func (h *Handler) UpsertGuardrail(c *echo.Context) error {
 	}); err != nil {
 		return handleError(c, guardrailWriteError(err))
 	}
-	if err := h.refreshWorkflowsAfterGuardrailChange(c.Request().Context()); err != nil {
+	rollback := func(rollbackCtx context.Context) error {
+		if existed {
+			return h.guardrailDefs.Upsert(rollbackCtx, *previous)
+		}
+		return h.guardrailDefs.Delete(rollbackCtx, name)
+	}
+	if err := h.refreshWorkflowsOrRollback(c.Request().Context(), rollback); err != nil {
 		return handleError(c, err)
 	}
 
@@ -88,6 +104,8 @@ func (h *Handler) UpsertGuardrail(c *echo.Context) error {
 }
 
 // DeleteGuardrail handles DELETE /admin/guardrails
+//
+//nolint:dupl // Keep this resource handler explicit and independent from header-policy lifecycle semantics.
 func (h *Handler) DeleteGuardrail(c *echo.Context) error {
 	if h.guardrailDefs == nil {
 		return handleError(c, featureUnavailableError("guardrails feature is unavailable"))
@@ -112,6 +130,7 @@ func (h *Handler) DeleteGuardrail(c *echo.Context) error {
 	if len(referencingWorkflows) > 0 {
 		return handleError(c, core.NewInvalidRequestError("guardrail is used by active workflows: "+strings.Join(referencingWorkflows, ", "), nil))
 	}
+	previous, existed := h.guardrailDefs.Get(name)
 
 	if err := h.guardrailDefs.Delete(c.Request().Context(), name); err != nil {
 		if errors.Is(err, guardrails.ErrNotFound) {
@@ -119,7 +138,13 @@ func (h *Handler) DeleteGuardrail(c *echo.Context) error {
 		}
 		return handleError(c, guardrailWriteError(err))
 	}
-	if err := h.refreshWorkflowsAfterGuardrailChange(c.Request().Context()); err != nil {
+	rollback := func(rollbackCtx context.Context) error {
+		if !existed {
+			return nil
+		}
+		return h.guardrailDefs.Upsert(rollbackCtx, *previous)
+	}
+	if err := h.refreshWorkflowsOrRollback(c.Request().Context(), rollback); err != nil {
 		return handleError(c, err)
 	}
 
diff --git a/internal/admin/handler_guardrails_test.go b/internal/admin/handler_guardrails_test.go
index f9affabd..ae910433 100644
--- a/internal/admin/handler_guardrails_test.go
+++ b/internal/admin/handler_guardrails_test.go
@@ -142,6 +142,9 @@ func TestListGuardrailTypes(t *testing.T) {
 	var sawSystemPrompt bool
 	var sawLLMBasedAltering bool
 	for _, typeDef := range body {
+		if typeDef.Type == "header_modification" {
+			t.Fatal("header_modification must be managed through /admin/header-policies")
+		}
 		switch typeDef.Type {
 		case "system_prompt":
 			sawSystemPrompt = true
diff --git a/internal/admin/handler_header_policies.go b/internal/admin/handler_header_policies.go
new file mode 100644
index 00000000..0d1324e5
--- /dev/null
+++ b/internal/admin/handler_header_policies.go
@@ -0,0 +1,114 @@
+package admin
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"strings"
+
+	"github.com/labstack/echo/v5"
+
+	"github.com/enterpilot/gomodel/internal/core"
+	"github.com/enterpilot/gomodel/internal/headerpolicy"
+)
+
+type deleteHeaderPolicyRequest struct {
+	Name string `json:"name"`
+}
+
+// ListHeaderPolicies handles GET /admin/header-policies.
+func (h *Handler) ListHeaderPolicies(c *echo.Context) error {
+	if h.headerPolicyDefs == nil {
+		return handleError(c, featureUnavailableError("header policies feature is unavailable"))
+	}
+	views := h.headerPolicyDefs.ListViews()
+	if views == nil {
+		views = []headerpolicy.View{}
+	}
+	return c.JSON(http.StatusOK, views)
+}
+
+// UpsertHeaderPolicy handles PUT /admin/header-policies.
+func (h *Handler) UpsertHeaderPolicy(c *echo.Context) error {
+	if h.headerPolicyDefs == nil {
+		return handleError(c, featureUnavailableError("header policies feature is unavailable"))
+	}
+	var definition headerpolicy.Definition
+	if err := c.Bind(&definition); err != nil {
+		return handleError(c, core.NewInvalidRequestError("invalid request body: "+err.Error(), err))
+	}
+	definition.Name = strings.TrimSpace(definition.Name)
+	if definition.Name == "" {
+		return handleError(c, core.NewInvalidRequestError("header policy name is required", nil))
+	}
+
+	h.mutationMu.Lock()
+	defer h.mutationMu.Unlock()
+	if h.guardrailDefs != nil {
+		if _, exists := h.guardrailDefs.Get(definition.Name); exists {
+			return handleError(c, core.NewInvalidRequestError("name is already used by a guardrail: "+definition.Name, nil))
+		}
+	}
+	previous, existed := h.headerPolicyDefs.Get(definition.Name)
+	if err := h.headerPolicyDefs.Upsert(c.Request().Context(), definition); err != nil {
+		return handleError(c, headerPolicyWriteError(err))
+	}
+	rollback := func(rollbackCtx context.Context) error {
+		if existed {
+			return h.headerPolicyDefs.Upsert(rollbackCtx, *previous)
+		}
+		return h.headerPolicyDefs.Delete(rollbackCtx, definition.Name)
+	}
+	if err := h.refreshWorkflowsOrRollback(c.Request().Context(), rollback); err != nil {
+		return handleError(c, err)
+	}
+	stored, ok := h.headerPolicyDefs.Get(definition.Name)
+	if !ok {
+		return c.NoContent(http.StatusNoContent)
+	}
+	return c.JSON(http.StatusOK, headerpolicy.ViewFromDefinition(*stored))
+}
+
+// DeleteHeaderPolicy handles DELETE /admin/header-policies.
+//
+//nolint:dupl // Keep this resource handler explicit and independent from guardrail lifecycle semantics.
+func (h *Handler) DeleteHeaderPolicy(c *echo.Context) error {
+	if h.headerPolicyDefs == nil {
+		return handleError(c, featureUnavailableError("header policies feature is unavailable"))
+	}
+	var req deleteHeaderPolicyRequest
+	if err := c.Bind(&req); err != nil {
+		return handleError(c, core.NewInvalidRequestError("invalid request body: "+err.Error(), err))
+	}
+	name := strings.TrimSpace(req.Name)
+	if name == "" {
+		return handleError(c, core.NewInvalidRequestError("header policy name is required", nil))
+	}
+
+	h.mutationMu.Lock()
+	defer h.mutationMu.Unlock()
+	references, err := h.activeWorkflowHeaderPolicyReferences(c.Request().Context(), name)
+	if err != nil {
+		return handleError(c, err)
+	}
+	if len(references) > 0 {
+		return handleError(c, core.NewInvalidRequestError("header policy is used by active workflows: "+strings.Join(references, ", "), nil))
+	}
+	previous, existed := h.headerPolicyDefs.Get(name)
+	if err := h.headerPolicyDefs.Delete(c.Request().Context(), name); err != nil {
+		if errors.Is(err, headerpolicy.ErrNotFound) {
+			return handleError(c, core.NewNotFoundError("header policy not found: "+name))
+		}
+		return handleError(c, headerPolicyWriteError(err))
+	}
+	rollback := func(rollbackCtx context.Context) error {
+		if !existed {
+			return nil
+		}
+		return h.headerPolicyDefs.Upsert(rollbackCtx, *previous)
+	}
+	if err := h.refreshWorkflowsOrRollback(c.Request().Context(), rollback); err != nil {
+		return handleError(c, err)
+	}
+	return c.NoContent(http.StatusNoContent)
+}
diff --git a/internal/admin/handler_header_policies_test.go b/internal/admin/handler_header_policies_test.go
new file mode 100644
index 00000000..b24edb2f
--- /dev/null
+++ b/internal/admin/handler_header_policies_test.go
@@ -0,0 +1,200 @@
+package admin
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/labstack/echo/v5"
+
+	"github.com/enterpilot/gomodel/internal/core"
+	"github.com/enterpilot/gomodel/internal/headerpolicy"
+	"github.com/enterpilot/gomodel/internal/workflows"
+)
+
+type headerPolicyTestStore struct {
+	definitions map[string]headerpolicy.Definition
+}
+
+func (s *headerPolicyTestStore) List(context.Context) ([]headerpolicy.Definition, error) {
+	result := make([]headerpolicy.Definition, 0, len(s.definitions))
+	for _, definition := range s.definitions {
+		result = append(result, definition)
+	}
+	return result, nil
+}
+func (s *headerPolicyTestStore) Get(_ context.Context, name string) (*headerpolicy.Definition, error) {
+	definition, ok := s.definitions[name]
+	if !ok {
+		return nil, headerpolicy.ErrNotFound
+	}
+	return &definition, nil
+}
+func (s *headerPolicyTestStore) Upsert(_ context.Context, definition headerpolicy.Definition) error {
+	s.definitions[definition.Name] = definition
+	return nil
+}
+func (s *headerPolicyTestStore) UpsertMany(_ context.Context, definitions []headerpolicy.Definition) error {
+	for _, definition := range definitions {
+		s.definitions[definition.Name] = definition
+	}
+	return nil
+}
+func (s *headerPolicyTestStore) Delete(_ context.Context, name string) error {
+	if _, ok := s.definitions[name]; !ok {
+		return headerpolicy.ErrNotFound
+	}
+	delete(s.definitions, name)
+	return nil
+}
+func (s *headerPolicyTestStore) Close() error { return nil }
+
+func newHeaderPolicyHandler(t *testing.T) *Handler {
+	t.Helper()
+	service, err := headerpolicy.NewService(&headerPolicyTestStore{definitions: map[string]headerpolicy.Definition{}})
+	if err != nil {
+		t.Fatalf("NewService() error = %v", err)
+	}
+	if err := service.Refresh(context.Background()); err != nil {
+		t.Fatalf("Refresh() error = %v", err)
+	}
+	return NewHandler(nil, nil, WithHeaderPolicyService(service))
+}
+
+func TestHeaderPolicyCRUDUsesFlattenedShape(t *testing.T) {
+	h := newHeaderPolicyHandler(t)
+	e := echo.New()
+	req := httptest.NewRequest(http.MethodPut, "/admin/header-policies", bytes.NewBufferString(`{
+		"name":"pin-beta",
+		"methods":["post"],
+		"paths":["/v1/*"],
+		"when":[{"header":"X-Empty","equals":""}],
+		"actions":[{"action":"set","header":"Anthropic-Beta","value":"context-1m"}]
+	}`))
+	req.Header.Set("Content-Type", "application/json")
+	rec := httptest.NewRecorder()
+	if err := h.UpsertHeaderPolicy(e.NewContext(req, rec)); err != nil {
+		t.Fatalf("UpsertHeaderPolicy() error = %v", err)
+	}
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, body = %s", rec.Code, rec.Body.String())
+	}
+	var saved headerpolicy.View
+	if err := json.Unmarshal(rec.Body.Bytes(), &saved); err != nil {
+		t.Fatalf("json.Unmarshal() error = %v", err)
+	}
+	if saved.Name != "pin-beta" || saved.Methods[0] != "POST" || saved.Paths[0] != "/v1/*" {
+		t.Fatalf("saved = %#v", saved)
+	}
+	if saved.When[0].Equals == nil || *saved.When[0].Equals != "" {
+		t.Fatalf("saved.When = %#v", saved.When)
+	}
+
+	listReq := httptest.NewRequest(http.MethodGet, "/admin/header-policies", nil)
+	listRec := httptest.NewRecorder()
+	if err := h.ListHeaderPolicies(e.NewContext(listReq, listRec)); err != nil {
+		t.Fatalf("ListHeaderPolicies() error = %v", err)
+	}
+	var listed []headerpolicy.View
+	if err := json.Unmarshal(listRec.Body.Bytes(), &listed); err != nil || len(listed) != 1 {
+		t.Fatalf("listed = %#v, err = %v", listed, err)
+	}
+
+	deleteReq := httptest.NewRequest(http.MethodDelete, "/admin/header-policies", bytes.NewBufferString(`{"name":"pin-beta"}`))
+	deleteReq.Header.Set("Content-Type", "application/json")
+	deleteRec := httptest.NewRecorder()
+	if err := h.DeleteHeaderPolicy(e.NewContext(deleteReq, deleteRec)); err != nil {
+		t.Fatalf("DeleteHeaderPolicy() error = %v", err)
+	}
+	if deleteRec.Code != http.StatusNoContent {
+		t.Fatalf("delete status = %d", deleteRec.Code)
+	}
+}
+
+func TestGuardrailEndpointRejectsHeaderModificationType(t *testing.T) {
+	h := NewHandler(nil, nil, WithGuardrailService(newGuardrailService(t)))
+	e := echo.New()
+	req := httptest.NewRequest(http.MethodPut, "/admin/guardrails", bytes.NewBufferString(`{
+		"name":"headers","type":"header_modification","config":{"actions":[{"action":"remove","header":"X-Debug"}]}
+	}`))
+	req.Header.Set("Content-Type", "application/json")
+	rec := httptest.NewRecorder()
+	if err := h.UpsertGuardrail(e.NewContext(req, rec)); err != nil {
+		t.Fatalf("UpsertGuardrail() error = %v", err)
+	}
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, body = %s", rec.Code, rec.Body.String())
+	}
+}
+
+func TestHeaderPolicyMutationRollsBackWhenWorkflowRefreshFails(t *testing.T) {
+	for _, operation := range []string{"upsert", "delete"} {
+		t.Run(operation, func(t *testing.T) {
+			policyStore := &headerPolicyTestStore{definitions: map[string]headerpolicy.Definition{
+				"pin-beta": {
+					Name:        "pin-beta",
+					Description: "original",
+					Actions:     []headerpolicy.Action{{Action: headerpolicy.ActionRemove, Header: "X-Debug"}},
+				},
+			}}
+			policies, err := headerpolicy.NewService(policyStore)
+			if err != nil {
+				t.Fatalf("headerpolicy.NewService() error = %v", err)
+			}
+			if err := policies.Refresh(t.Context()); err != nil {
+				t.Fatalf("policies.Refresh() error = %v", err)
+			}
+
+			workflowStore := &workflowTestStore{}
+			workflowService, err := workflows.NewService(
+				workflowStore,
+				workflows.NewCompilerWithCatalogs(nil, policies, core.DefaultWorkflowFeatures()),
+			)
+			if err != nil {
+				t.Fatalf("workflows.NewService() error = %v", err)
+			}
+			h := NewHandler(nil, nil, WithHeaderPolicyService(policies), WithWorkflows(workflowService))
+			e := echo.New()
+
+			var req *http.Request
+			var call func(*echo.Context) error
+			switch operation {
+			case "upsert":
+				workflowStore.failListActiveAt = 1
+				workflowStore.listActiveErr = errors.New("workflow store unavailable")
+				req = httptest.NewRequest(http.MethodPut, "/admin/header-policies", bytes.NewBufferString(`{
+					"name":"pin-beta","description":"replacement",
+					"actions":[{"action":"remove","header":"X-Trace"}]
+				}`))
+				call = h.UpsertHeaderPolicy
+			case "delete":
+				// Delete checks active references before refreshing the runtime snapshot.
+				workflowStore.failListActiveAt = 2
+				workflowStore.listActiveErr = errors.New("workflow store unavailable")
+				req = httptest.NewRequest(http.MethodDelete, "/admin/header-policies", bytes.NewBufferString(`{"name":"pin-beta"}`))
+				call = h.DeleteHeaderPolicy
+			}
+			req.Header.Set("Content-Type", "application/json")
+			rec := httptest.NewRecorder()
+			if err := call(e.NewContext(req, rec)); err != nil {
+				t.Fatalf("handler error = %v", err)
+			}
+			if rec.Code < http.StatusInternalServerError {
+				t.Fatalf("status = %d, body = %s", rec.Code, rec.Body.String())
+			}
+
+			stored, ok := policies.Get("pin-beta")
+			if !ok || stored.Description != "original" || len(stored.Actions) != 1 || stored.Actions[0].Header != "X-Debug" {
+				t.Fatalf("catalog was not rolled back: %#v, exists = %v", stored, ok)
+			}
+			persisted, ok := policyStore.definitions["pin-beta"]
+			if !ok || persisted.Description != "original" || len(persisted.Actions) != 1 || persisted.Actions[0].Header != "X-Debug" {
+				t.Fatalf("store was not rolled back: %#v, exists = %v", persisted, ok)
+			}
+		})
+	}
+}
diff --git a/internal/admin/handler_workflows.go b/internal/admin/handler_workflows.go
index 2339670d..f0c6fabf 100644
--- a/internal/admin/handler_workflows.go
+++ b/internal/admin/handler_workflows.go
@@ -3,10 +3,12 @@ package admin
 import (
 	"context"
 	"errors"
+	"fmt"
 	"net/http"
 	"slices"
 	"sort"
 	"strings"
+	"time"
 
 	"github.com/labstack/echo/v5"
 
@@ -70,6 +72,14 @@ func (h *Handler) ListWorkflowGuardrails(c *echo.Context) error {
 	return c.JSON(http.StatusOK, h.guardrails.Names())
 }
 
+// ListWorkflowHeaderPolicies handles GET /admin/workflows/header-policies.
+func (h *Handler) ListWorkflowHeaderPolicies(c *echo.Context) error {
+	if h.headerPolicies == nil {
+		return c.JSON(http.StatusOK, []string{})
+	}
+	return c.JSON(http.StatusOK, h.headerPolicies.Names())
+}
+
 // CreateWorkflow handles POST /admin/workflows
 func (h *Handler) CreateWorkflow(c *echo.Context) error {
 	if h.workflows == nil {
@@ -99,6 +109,9 @@ func (h *Handler) CreateWorkflow(c *echo.Context) error {
 	if err := h.validateWorkflowGuardrails(req.Payload); err != nil {
 		return handleError(c, err)
 	}
+	if err := h.validateWorkflowHeaderPolicies(req.Payload); err != nil {
+		return handleError(c, err)
+	}
 
 	h.mutationMu.Lock()
 	defer h.mutationMu.Unlock()
@@ -146,7 +159,7 @@ func (h *Handler) DeactivateWorkflow(c *echo.Context) error {
 	return c.NoContent(http.StatusNoContent)
 }
 
-func (h *Handler) refreshWorkflowsAfterGuardrailChange(ctx context.Context) error {
+func (h *Handler) refreshWorkflows(ctx context.Context) error {
 	if h.workflows == nil {
 		return nil
 	}
@@ -156,6 +169,19 @@ func (h *Handler) refreshWorkflowsAfterGuardrailChange(ctx context.Context) erro
 	return nil
 }
 
+func (h *Handler) refreshWorkflowsOrRollback(ctx context.Context, rollback func(context.Context) error) error {
+	refreshErr := h.refreshWorkflows(ctx)
+	if refreshErr == nil || rollback == nil {
+		return refreshErr
+	}
+	rollbackCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 30*time.Second)
+	defer cancel()
+	if rollbackErr := rollback(rollbackCtx); rollbackErr != nil {
+		return errors.Join(refreshErr, fmt.Errorf("roll back policy mutation: %w", rollbackErr))
+	}
+	return refreshErr
+}
+
 func (h *Handler) activeWorkflowGuardrailReferences(ctx context.Context, name string) ([]string, error) {
 	if h.workflows == nil {
 		return nil, nil
@@ -173,10 +199,11 @@ func (h *Handler) activeWorkflowGuardrailReferences(ctx context.Context, name st
 
 	references := make([]string, 0)
 	for _, view := range views {
-		if !view.Payload.Features.Guardrails {
-			continue
+		steps := make([]workflows.GuardrailStep, 0, len(view.Payload.Guardrails))
+		if view.Payload.Features.Guardrails {
+			steps = append(steps, view.Payload.Guardrails...)
 		}
-		for _, step := range view.Payload.Guardrails {
+		for _, step := range steps {
 			if strings.TrimSpace(step.Ref) != name {
 				continue
 			}
@@ -188,8 +215,80 @@ func (h *Handler) activeWorkflowGuardrailReferences(ctx context.Context, name st
 	return references, nil
 }
 
+func (h *Handler) activeWorkflowHeaderPolicyReferences(ctx context.Context, name string) ([]string, error) {
+	if h.workflows == nil {
+		return nil, nil
+	}
+	name = strings.TrimSpace(name)
+	if name == "" {
+		return nil, nil
+	}
+	views, err := h.workflows.ListViews(ctx)
+	if err != nil {
+		return nil, err
+	}
+	references := make([]string, 0)
+	for _, view := range views {
+		matched := slices.ContainsFunc(view.Payload.HeaderPolicies, func(step workflows.HeaderPolicyStep) bool {
+			return strings.TrimSpace(step.Ref) == name
+		})
+		// Historical workflow versions stored header policies in guardrails.
+		if !matched && view.Payload.Features.Guardrails {
+			matched = slices.ContainsFunc(view.Payload.Guardrails, func(step workflows.GuardrailStep) bool {
+				return strings.TrimSpace(step.Ref) == name
+			})
+		}
+		if matched {
+			references = append(references, view.ScopeDisplay)
+		}
+	}
+	sort.Strings(references)
+	return references, nil
+}
+
+func (h *Handler) validateWorkflowHeaderPolicies(payload workflows.Payload) error {
+	if len(payload.HeaderPolicies) == 0 {
+		return nil
+	}
+	if h.headerPolicies == nil {
+		return featureUnavailableError("header policy catalog is unavailable for workflow authoring")
+	}
+	known := make(map[string]struct{}, len(h.headerPolicies.Names()))
+	for _, name := range h.headerPolicies.Names() {
+		known[name] = struct{}{}
+	}
+	for _, step := range payload.HeaderPolicies {
+		ref := strings.TrimSpace(step.Ref)
+		if ref == "" {
+			continue
+		}
+		if _, ok := known[ref]; !ok {
+			return core.NewInvalidRequestError("unknown header policy ref: "+ref, nil)
+		}
+	}
+	return nil
+}
+
 func (h *Handler) validateWorkflowGuardrails(payload workflows.Payload) error {
-	if !payload.Features.Guardrails || len(payload.Guardrails) == 0 {
+	if len(payload.Guardrails) == 0 {
+		return nil
+	}
+	if h.headerPolicies != nil {
+		headerPolicyNames := make(map[string]struct{}, len(h.headerPolicies.Names()))
+		for _, name := range h.headerPolicies.Names() {
+			headerPolicyNames[name] = struct{}{}
+		}
+		for _, step := range payload.Guardrails {
+			ref := strings.TrimSpace(step.Ref)
+			if _, misplaced := headerPolicyNames[ref]; misplaced {
+				return core.NewInvalidRequestError(
+					"header policy ref "+ref+" must be placed in workflow_payload.header_policies, not guardrails",
+					nil,
+				)
+			}
+		}
+	}
+	if !payload.Features.Guardrails {
 		return nil
 	}
 	if h.guardrails == nil {
diff --git a/internal/admin/handler_workflows_test.go b/internal/admin/handler_workflows_test.go
index f3804ea1..9cc56f82 100644
--- a/internal/admin/handler_workflows_test.go
+++ b/internal/admin/handler_workflows_test.go
@@ -6,6 +6,7 @@ import (
 	"crypto/sha256"
 	"encoding/hex"
 	"encoding/json"
+	"errors"
 	"net/http"
 	"net/http/httptest"
 	"testing"
@@ -14,6 +15,7 @@ import (
 
 	"github.com/enterpilot/gomodel/internal/core"
 	"github.com/enterpilot/gomodel/internal/guardrails"
+	"github.com/enterpilot/gomodel/internal/headerpolicy"
 	"github.com/enterpilot/gomodel/internal/providers"
 	"github.com/enterpilot/gomodel/internal/workflows"
 )
@@ -28,7 +30,10 @@ func WithGuardrailsRegistry(registry guardrails.Catalog) Option {
 }
 
 type workflowTestStore struct {
-	versions []workflows.Version
+	versions         []workflows.Version
+	listActiveCalls  int
+	failListActiveAt int
+	listActiveErr    error
 }
 
 type workflowErrorEnvelope struct {
@@ -41,6 +46,13 @@ type workflowErrorEnvelope struct {
 }
 
 func (s *workflowTestStore) ListActive(context.Context) ([]workflows.Version, error) {
+	s.listActiveCalls++
+	if s.failListActiveAt > 0 && s.listActiveCalls == s.failListActiveAt {
+		if s.listActiveErr != nil {
+			return nil, s.listActiveErr
+		}
+		return nil, errors.New("list active workflows failed")
+	}
 	result := make([]workflows.Version, 0, len(s.versions))
 	for _, version := range s.versions {
 		if version.Active {
@@ -865,6 +877,49 @@ func TestCreateWorkflowRejectsUnknownGuardrail(t *testing.T) {
 	}
 }
 
+func TestCreateWorkflowRejectsHeaderPolicyInGuardrailsWhenGuardrailsDisabled(t *testing.T) {
+	store := &workflowTestStore{versions: []workflows.Version{{
+		ID: "global", ScopeKey: "global", Active: true, Version: 1,
+		Payload: workflows.Payload{SchemaVersion: 1, Features: workflows.FeatureFlags{Cache: true, Audit: true, Usage: true}},
+	}}}
+	h := newWorkflowHandler(t, store, nil)
+	headerPolicies, err := headerpolicy.NewService(&headerPolicyTestStore{definitions: map[string]headerpolicy.Definition{
+		"pin-beta": {
+			Name:    "pin-beta",
+			Actions: []headerpolicy.Action{{Action: headerpolicy.ActionSet, Header: "Anthropic-Beta", Value: new("context-1m")}},
+		},
+	}})
+	if err != nil {
+		t.Fatalf("headerpolicy.NewService() error = %v", err)
+	}
+	if err := headerPolicies.Refresh(t.Context()); err != nil {
+		t.Fatalf("headerPolicies.Refresh() error = %v", err)
+	}
+	h.headerPolicies = headerPolicies
+
+	e := echo.New()
+	req := httptest.NewRequest(http.MethodPost, "/admin/workflows", bytes.NewBufferString(`{
+		"name":"misplaced header policy",
+		"workflow_payload":{
+			"schema_version":1,
+			"features":{"cache":true,"audit":true,"usage":true,"guardrails":false},
+			"guardrails":[{"ref":"pin-beta","step":10}]
+		}
+	}`))
+	req.Header.Set("Content-Type", "application/json")
+	rec := httptest.NewRecorder()
+	if err := h.CreateWorkflow(e.NewContext(req, rec)); err != nil {
+		t.Fatalf("CreateWorkflow() error = %v", err)
+	}
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, body = %s", rec.Code, rec.Body.String())
+	}
+	body := decodeWorkflowErrorEnvelope(t, rec.Body.Bytes())
+	if body.Error.Message != "header policy ref pin-beta must be placed in workflow_payload.header_policies, not guardrails" {
+		t.Fatalf("error message = %q", body.Error.Message)
+	}
+}
+
 func TestCreateWorkflowReturnsValidationErrors(t *testing.T) {
 	store := &workflowTestStore{
 		versions: []workflows.Version{
diff --git a/internal/admin/routes.go b/internal/admin/routes.go
index c82c7f6e..22da642b 100644
--- a/internal/admin/routes.go
+++ b/internal/admin/routes.go
@@ -86,9 +86,13 @@ func (h *Handler) RegisterRoutes(g RouteRegistrar) {
 	g.GET("/guardrails", h.ListGuardrails)
 	g.PUT("/guardrails", h.UpsertGuardrail)
 	g.DELETE("/guardrails", h.DeleteGuardrail)
+	g.GET("/header-policies", h.ListHeaderPolicies)
+	g.PUT("/header-policies", h.UpsertHeaderPolicy)
+	g.DELETE("/header-policies", h.DeleteHeaderPolicy)
 
 	g.GET("/workflows", h.ListWorkflows)
 	g.GET("/workflows/guardrails", h.ListWorkflowGuardrails)
+	g.GET("/workflows/header-policies", h.ListWorkflowHeaderPolicies)
 	g.GET("/workflows/:id", h.GetWorkflow)
 	g.POST("/workflows", h.CreateWorkflow)
 	g.POST("/workflows/:id/deactivate", h.DeactivateWorkflow)
diff --git a/internal/admin/routes_test.go b/internal/admin/routes_test.go
index 4400a3cd..64341e38 100644
--- a/internal/admin/routes_test.go
+++ b/internal/admin/routes_test.go
@@ -101,9 +101,13 @@ func TestRegisterRoutes_RegistersExpectedPaths(t *testing.T) {
 		"GET /admin/guardrails",
 		"PUT /admin/guardrails",
 		"DELETE /admin/guardrails",
+		"GET /admin/header-policies",
+		"PUT /admin/header-policies",
+		"DELETE /admin/header-policies",
 
 		"GET /admin/workflows",
 		"GET /admin/workflows/guardrails",
+		"GET /admin/workflows/header-policies",
 		"GET /admin/workflows/:id",
 		"POST /admin/workflows",
 		"POST /admin/workflows/:id/deactivate",
diff --git a/internal/app/app.go b/internal/app/app.go
index f622f680..c784a22b 100644
--- a/internal/app/app.go
+++ b/internal/app/app.go
@@ -28,6 +28,7 @@ import (
 	"github.com/enterpilot/gomodel/internal/failover"
 	"github.com/enterpilot/gomodel/internal/filestore"
 	"github.com/enterpilot/gomodel/internal/guardrails"
+	"github.com/enterpilot/gomodel/internal/headerpolicy"
 	"github.com/enterpilot/gomodel/internal/httpclient"
 	"github.com/enterpilot/gomodel/internal/live"
 	"github.com/enterpilot/gomodel/internal/mcpgateway"
@@ -65,6 +66,7 @@ type App struct {
 	pricingOverrides *pricingoverrides.Result
 	authKeys         *authkeys.Result
 	guardrails       *guardrails.Result
+	headerPolicies   *headerpolicy.Service
 	workflows        *workflows.Result
 	live             *live.Broker
 	server           *server.Server
@@ -428,19 +430,55 @@ func New(ctx context.Context, cfg Config) (*App, error) {
 	if err != nil {
 		return fail("failed to prepare guardrail definitions", err)
 	}
+	seedHeaderPolicies, _, err := configHeaderPolicyDefinitions(appCfg)
+	if err != nil {
+		return fail("failed to prepare header policy definitions", err)
+	}
+
+	var headerPolicyResult *headerpolicy.Result
+	if sharedStorage != nil {
+		headerPolicyResult, err = headerpolicy.NewWithSharedStorage(ctx, sharedStorage, refreshInterval)
+	} else {
+		headerPolicyResult, err = headerpolicy.New(ctx, appCfg, refreshInterval)
+	}
+	if err != nil {
+		return fail("failed to initialize header policies", err)
+	}
+	closers = append(closers, headerPolicyResult.Close)
+	claimSharedStorage(headerPolicyResult.Storage)
+	if migrated, err := migrateLegacyHeaderPolicies(ctx, guardrailResult.Store, headerPolicyResult.Store); err != nil {
+		return fail("failed to migrate legacy header policies", err)
+	} else if migrated > 0 {
+		slog.Info("migrated legacy header policies to dedicated storage", "count", migrated)
+	}
+	if err := headerPolicyResult.Service.Refresh(ctx); err != nil {
+		return fail("failed to load migrated header policies", err)
+	}
+
+	guardrailDefinitions := append(guardrailResult.Service.List(), seedGuardrails...)
+	headerPolicyDefinitions := append(headerPolicyResult.Service.List(), seedHeaderPolicies...)
+	if err := rejectPolicyNameCollisions(guardrailDefinitions, headerPolicyDefinitions); err != nil {
+		return fail("failed to prepare policy definitions", err)
+	}
 	if err := guardrailResult.Service.UpsertDefinitions(ctx, seedGuardrails); err != nil {
 		return fail("failed to upsert guardrails", err)
 	}
+	headerPolicyService := headerPolicyResult.Service
+	if err := headerPolicyService.UpsertDefinitions(ctx, seedHeaderPolicies); err != nil {
+		return fail("failed to upsert header policies", err)
+	}
+	app.headerPolicies = headerPolicyService
 
 	// Build runtime execution dependencies. Policy is passed explicitly into the
 	// server; the live provider dependency remains the bare router.
 	var provider core.RoutableProvider = app.providers.Router
 	var translatedRequestPatcher server.TranslatedRequestPatcher
+	var headerPolicyResolver server.HeaderPolicyResolver
 	var batchRequestPreparers []server.BatchRequestPreparer
 	featureCaps := runtimeWorkflowFeatureCaps(appCfg)
 
 	var workflowResult *workflows.Result
-	workflowCompiler := workflows.NewCompilerWithFeatureCaps(guardrailResult.Service, featureCaps)
+	workflowCompiler := workflows.NewCompilerWithCatalogs(guardrailResult.Service, headerPolicyService, featureCaps)
 	if sharedStorage != nil {
 		workflowResult, err = workflows.NewWithSharedStorage(ctx, sharedStorage, workflowCompiler, refreshInterval)
 	} else {
@@ -476,6 +514,10 @@ func New(ctx context.Context, cfg Config) (*App, error) {
 	// message reflects both bootstrap and managed auth modes.
 	app.logStartupInfo()
 
+	if appCfg.HeaderPolicies.Enabled {
+		headerPolicyResolver = workflowResult.Service
+		slog.Info("outbound header policies enabled", "count", len(headerPolicyService.Names()))
+	}
 	if featureCaps.Guardrails {
 		if app.guardrails != nil && app.guardrails.Service != nil {
 			translatedRequestPatcher = guardrails.NewWorkflowRequestPatcher(workflowResult.Service)
@@ -571,6 +613,7 @@ func New(ctx context.Context, cfg Config) (*App, error) {
 		FailoverResolver:                failover.NewResolverWithRuleProvider(appCfg.Failover, providerResult.Registry, failoverResult.Service),
 		WorkflowPolicyResolver:          workflowResult.Service,
 		TranslatedRequestPatcher:        translatedRequestPatcher,
+		HeaderPolicyResolver:            headerPolicyResolver,
 		BatchRequestPreparer:            batchRequestPreparer,
 		ExposedModelLister:              vm,
 		KeepOnlyAliasesAtModelsEndpoint: appCfg.Models.KeepOnlyAliasesAtModelsEndpoint,
@@ -632,6 +675,7 @@ func New(ctx context.Context, cfg Config) (*App, error) {
 			app.pricingOverrides.Service,
 			workflowResult.Service,
 			app.guardrails.Service,
+			app.headerPolicies,
 			budgetResult.Service,
 			rateLimitResult.Service,
 			taggingResult.Service,
@@ -1089,6 +1133,7 @@ func initAdmin(
 	pricingOverrideService *pricingoverrides.Service,
 	workflowService *workflows.Service,
 	guardrailService *guardrails.Service,
+	headerPolicyService *headerpolicy.Service,
 	budgetService *budget.Service,
 	rateLimitService *ratelimit.Service,
 	taggingService *tagging.Service,
@@ -1145,6 +1190,7 @@ func initAdmin(
 		admin.WithPricingOverrides(pricingOverrideService),
 		admin.WithWorkflows(workflowService),
 		admin.WithGuardrailService(guardrailService),
+		admin.WithHeaderPolicyService(headerPolicyService),
 		admin.WithBudgets(budgetService),
 		admin.WithRateLimits(rateLimitService),
 		admin.WithTagging(taggingService),
@@ -1179,6 +1225,11 @@ func configGuardrailDefinitions(cfg config.GuardrailsConfig) ([]guardrails.Defin
 		switch ruleType {
 		case "llm-based-altering":
 			ruleType = "llm_based_altering"
+		case "header-modification":
+			ruleType = "header_modification"
+		}
+		if ruleType == "header_modification" {
+			continue
 		}
 		if name == "" {
 			return nil, fmt.Errorf("guardrail rule #%d: name is required", i)
@@ -1220,6 +1271,47 @@ func configGuardrailDefinitions(cfg config.GuardrailsConfig) ([]guardrails.Defin
 	return definitions, nil
 }
 
+// headerModificationSeedConfig converts YAML header_modification settings into
+// the definition-config JSON shape validated by the guardrails service.
+func headerModificationSeedConfig(settings config.HeaderModificationSettings) map[string]any {
+	conditions := make([]map[string]any, 0, len(settings.When))
+	for _, condition := range settings.When {
+		entry := map[string]any{"header": condition.Header}
+		if condition.Equals != nil {
+			entry["equals"] = *condition.Equals
+		}
+		if condition.Matches != nil {
+			entry["matches"] = *condition.Matches
+		}
+		if condition.Present != nil {
+			entry["present"] = *condition.Present
+		}
+		conditions = append(conditions, entry)
+	}
+	actions := make([]map[string]any, 0, len(settings.Actions))
+	for _, action := range settings.Actions {
+		entry := map[string]any{"action": action.Action, "header": action.Header}
+		if action.Value != nil {
+			entry["value"] = *action.Value
+		}
+		if action.FromHeader != "" {
+			entry["from_header"] = action.FromHeader
+		}
+		actions = append(actions, entry)
+	}
+	seed := map[string]any{"actions": actions}
+	if len(settings.Methods) > 0 {
+		seed["methods"] = settings.Methods
+	}
+	if len(settings.Endpoints) > 0 {
+		seed["endpoints"] = settings.Endpoints
+	}
+	if len(conditions) > 0 {
+		seed["when"] = conditions
+	}
+	return seed
+}
+
 func defaultWorkflowInput(cfg *config.Config, availableGuardrails []string, configuredGuardrails []guardrails.Definition) workflows.CreateInput {
 	failoverEnabled := failoverFeatureEnabledGlobally(cfg)
 	budgetEnabled := cfg.Budgets.Enabled
@@ -1256,10 +1348,27 @@ func defaultWorkflowInput(cfg *config.Config, availableGuardrails []string, conf
 					continue
 				}
 			}
-			payload.Guardrails = append(payload.Guardrails, workflows.GuardrailStep{
-				Ref:  name,
-				Step: rule.Order,
-			})
+			if normalizeLegacyHeaderPolicyType(rule.Type) == "header_modification" {
+				continue
+			}
+			payload.Guardrails = append(payload.Guardrails, workflows.GuardrailStep{Ref: name, Step: rule.Order})
+		}
+	}
+	// Keep declarative bindings in the managed workflow even while the runtime
+	// kill switch is off, so re-enabling does not require recreating workflows.
+	for _, policy := range cfg.HeaderPolicies.Policies {
+		name := strings.TrimSpace(policy.Name)
+		if name != "" {
+			payload.HeaderPolicies = append(payload.HeaderPolicies, workflows.HeaderPolicyStep{Ref: name, Step: policy.Step})
+		}
+	}
+	// Historical header_modification rules keep their former GUARDRAILS_ENABLED
+	// activation behavior until operators migrate them to header_policies.
+	if cfg.Guardrails.Enabled {
+		for _, rule := range cfg.Guardrails.Rules {
+			if normalizeLegacyHeaderPolicyType(rule.Type) == "header_modification" {
+				payload.HeaderPolicies = append(payload.HeaderPolicies, workflows.HeaderPolicyStep{Ref: strings.TrimSpace(rule.Name), Step: rule.Order})
+			}
 		}
 	}
 	payload.Features.Guardrails = len(payload.Guardrails) > 0
@@ -1275,16 +1384,17 @@ func defaultWorkflowInput(cfg *config.Config, availableGuardrails []string, conf
 
 func dashboardRuntimeConfig(cfg *config.Config, usageEnabled bool) admin.DashboardConfigResponse {
 	return admin.DashboardConfigResponse{
-		FailoverEnabled:      dashboardEnabledValue(failoverFeatureEnabledGlobally(cfg)),
-		LoggingEnabled:       dashboardEnabledValue(cfg != nil && cfg.Logging.Enabled),
-		UsageEnabled:         dashboardEnabledValue(cfg != nil && cfg.Usage.Enabled),
-		BudgetsEnabled:       dashboardEnabledValue(cfg != nil && cfg.Budgets.Enabled),
-		RateLimitsEnabled:    dashboardEnabledValue(cfg != nil && cfg.RateLimits.Enabled),
-		GuardrailsEnabled:    dashboardEnabledValue(cfg != nil && cfg.Guardrails.Enabled),
-		CacheEnabled:         dashboardEnabledValue(cacheAnalyticsConfigured(cfg, usageEnabled)),
-		RedisURL:             dashboardEnabledValue(simpleResponseCacheConfigured(cfg)),
-		SemanticCacheEnabled: dashboardEnabledValue(semanticResponseCacheConfigured(cfg)),
-		LiveLogsEnabled:      dashboardEnabledValue(cfg != nil && cfg.Admin.LiveLogsEnabled),
+		FailoverEnabled:       dashboardEnabledValue(failoverFeatureEnabledGlobally(cfg)),
+		LoggingEnabled:        dashboardEnabledValue(cfg != nil && cfg.Logging.Enabled),
+		UsageEnabled:          dashboardEnabledValue(cfg != nil && cfg.Usage.Enabled),
+		BudgetsEnabled:        dashboardEnabledValue(cfg != nil && cfg.Budgets.Enabled),
+		RateLimitsEnabled:     dashboardEnabledValue(cfg != nil && cfg.RateLimits.Enabled),
+		GuardrailsEnabled:     dashboardEnabledValue(cfg != nil && cfg.Guardrails.Enabled),
+		HeaderPoliciesEnabled: dashboardEnabledValue(cfg != nil && cfg.HeaderPolicies.Enabled),
+		CacheEnabled:          dashboardEnabledValue(cacheAnalyticsConfigured(cfg, usageEnabled)),
+		RedisURL:              dashboardEnabledValue(simpleResponseCacheConfigured(cfg)),
+		SemanticCacheEnabled:  dashboardEnabledValue(semanticResponseCacheConfigured(cfg)),
+		LiveLogsEnabled:       dashboardEnabledValue(cfg != nil && cfg.Admin.LiveLogsEnabled),
 	}
 }
 
diff --git a/internal/app/app_test.go b/internal/app/app_test.go
index 177ee134..8069a362 100644
--- a/internal/app/app_test.go
+++ b/internal/app/app_test.go
@@ -16,6 +16,7 @@ import (
 	"github.com/enterpilot/gomodel/internal/admin"
 	"github.com/enterpilot/gomodel/internal/core"
 	"github.com/enterpilot/gomodel/internal/guardrails"
+	"github.com/enterpilot/gomodel/internal/headerpolicy"
 	"github.com/enterpilot/gomodel/internal/live"
 	"github.com/enterpilot/gomodel/internal/providers"
 	"github.com/enterpilot/gomodel/internal/server"
@@ -343,6 +344,38 @@ func TestDefaultWorkflowInput_TrimsConfiguredGuardrailRefs(t *testing.T) {
 	}
 }
 
+func TestDefaultWorkflowInput_CompilesHeaderRulesIntoEgressPolicies(t *testing.T) {
+	cfg := &config.Config{HeaderPolicies: config.HeaderPoliciesConfig{Enabled: true}, Guardrails: config.GuardrailsConfig{
+		Enabled: true,
+		Rules:   []config.GuardrailRuleConfig{{Name: "pin-beta", Type: "header_modification", Order: 20}},
+	}}
+	input := defaultWorkflowInput(cfg, []string{"pin-beta"}, []guardrails.Definition{{Name: "pin-beta", Type: "header_modification"}})
+	if input.Payload.Features.Guardrails {
+		t.Fatal("header-only workflow enabled the message guardrail feature")
+	}
+	if len(input.Payload.Guardrails) != 0 || len(input.Payload.HeaderPolicies) != 1 {
+		t.Fatalf("payload stages = guardrails:%v header_policies:%v", input.Payload.Guardrails, input.Payload.HeaderPolicies)
+	}
+	if input.Payload.HeaderPolicies[0].Ref != "pin-beta" {
+		t.Fatalf("header policy ref = %q, want pin-beta", input.Payload.HeaderPolicies[0].Ref)
+	}
+}
+
+func TestDefaultWorkflowInput_KeepsHeaderPolicyBindingsWhenRuntimeDisabled(t *testing.T) {
+	cfg := &config.Config{HeaderPolicies: config.HeaderPoliciesConfig{
+		Enabled:  false,
+		Policies: []config.HeaderPolicyConfig{{Name: " pin-beta ", Step: 20}},
+	}}
+
+	input := defaultWorkflowInput(cfg, nil, nil)
+	if len(input.Payload.HeaderPolicies) != 1 {
+		t.Fatalf("header policies = %v, want configured binding", input.Payload.HeaderPolicies)
+	}
+	if got := input.Payload.HeaderPolicies[0]; got.Ref != "pin-beta" || got.Step != 20 {
+		t.Fatalf("header policy binding = %+v, want pin-beta at step 20", got)
+	}
+}
+
 func TestConfigGuardrailDefinitions_DisabledIgnoresInvalidRules(t *testing.T) {
 	definitions, err := configGuardrailDefinitions(config.GuardrailsConfig{
 		Enabled: false,
@@ -407,6 +440,67 @@ func TestConfigGuardrailDefinitions_TrimAndCanonicalizeRuleIdentity(t *testing.T
 	}
 }
 
+func TestConfigHeaderPolicyDefinitions_LegacyHeaderModification(t *testing.T) {
+	present := false
+	matches := "^cline/"
+	equalsEmpty := ""
+	value := "context-1m"
+	definitions, _, err := configHeaderPolicyDefinitions(&config.Config{
+		HeaderPolicies: config.HeaderPoliciesConfig{Enabled: true},
+		Guardrails: config.GuardrailsConfig{Enabled: true, Rules: []config.GuardrailRuleConfig{
+			{
+				Name: "pin-beta",
+				Type: "header-modification",
+				HeaderModification: config.HeaderModificationSettings{
+					Methods:   []string{"POST"},
+					Endpoints: []string{"/v1/*"},
+					When: []config.HeaderConditionConfig{
+						{Header: "User-Agent", Matches: &matches},
+						{Header: "X-Empty", Equals: &equalsEmpty},
+						{Header: "X-Skip", Present: &present},
+					},
+					Actions: []config.HeaderActionConfig{
+						{Action: "set", Header: "anthropic-beta", Value: &value},
+						{Action: "remove", Header: "X-Debug"},
+						{Action: "set", Header: "X-Team", FromHeader: "X-Client-Team"},
+					},
+				},
+			},
+		}},
+	})
+	if err != nil {
+		t.Fatalf("configHeaderPolicyDefinitions() error = %v", err)
+	}
+	if len(definitions) != 1 {
+		t.Fatalf("len(configHeaderPolicyDefinitions()) = %d, want 1", len(definitions))
+	}
+	if definitions[0].Name != "pin-beta" || len(definitions[0].Paths) != 1 || definitions[0].Paths[0] != "/v1/*" {
+		t.Fatalf("definition = %#v", definitions[0])
+	}
+	if len(definitions[0].When) != 3 || definitions[0].When[1].Equals == nil || *definitions[0].When[1].Equals != "" {
+		t.Fatalf("conditions = %#v", definitions[0].When)
+	}
+	if len(definitions[0].Actions) != 3 || definitions[0].Actions[2].FromHeader != "X-Client-Team" {
+		t.Fatalf("actions = %#v", definitions[0].Actions)
+	}
+}
+
+func TestRejectPolicyNameCollisions(t *testing.T) {
+	err := rejectPolicyNameCollisions(
+		[]guardrails.Definition{{Name: " shared "}},
+		[]headerpolicy.Definition{{Name: "shared"}},
+	)
+	if err == nil {
+		t.Fatal("rejectPolicyNameCollisions() error = nil, want collision error")
+	}
+	if err := rejectPolicyNameCollisions(
+		[]guardrails.Definition{{Name: "messages"}},
+		[]headerpolicy.Definition{{Name: "headers"}},
+	); err != nil {
+		t.Fatalf("rejectPolicyNameCollisions() unexpected error = %v", err)
+	}
+}
+
 func TestConfigGuardrailDefinitions_RejectsBlankNameOrType(t *testing.T) {
 	_, err := configGuardrailDefinitions(config.GuardrailsConfig{
 		Enabled: true,
diff --git a/internal/app/header_policies.go b/internal/app/header_policies.go
new file mode 100644
index 00000000..07ab3990
--- /dev/null
+++ b/internal/app/header_policies.go
@@ -0,0 +1,130 @@
+package app
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"strings"
+
+	"github.com/goccy/go-json"
+
+	"github.com/enterpilot/gomodel/config"
+	"github.com/enterpilot/gomodel/internal/guardrails"
+	"github.com/enterpilot/gomodel/internal/headerpolicy"
+)
+
+// migrateLegacyHeaderPolicies moves preview-era header_modification rows into
+// the dedicated header-policy store. Existing dedicated rows win by name, so
+// the migration is idempotent after a partial shutdown or multi-instance race.
+func migrateLegacyHeaderPolicies(ctx context.Context, legacy guardrails.Store, target headerpolicy.Store) (int, error) {
+	definitions, err := legacy.List(ctx)
+	if err != nil {
+		return 0, fmt.Errorf("list legacy header policies: %w", err)
+	}
+	toMigrate := make([]headerpolicy.Definition, 0)
+	legacyNames := make([]string, 0)
+	for _, definition := range definitions {
+		if normalizeLegacyHeaderPolicyType(definition.Type) != "header_modification" {
+			continue
+		}
+		legacyNames = append(legacyNames, definition.Name)
+		if _, err := target.Get(ctx, definition.Name); err == nil {
+			continue
+		} else if !errors.Is(err, headerpolicy.ErrNotFound) {
+			return 0, fmt.Errorf("check migrated header policy %q: %w", definition.Name, err)
+		}
+		policy, err := headerpolicy.DefinitionFromLegacy(definition.Name, definition.Description, definition.Config)
+		if err != nil {
+			return 0, fmt.Errorf("convert legacy header policy %q: %w", definition.Name, err)
+		}
+		policy.CreatedAt = definition.CreatedAt
+		policy.UpdatedAt = definition.UpdatedAt
+		toMigrate = append(toMigrate, policy)
+	}
+	if err := target.UpsertMany(ctx, toMigrate); err != nil {
+		return 0, fmt.Errorf("persist migrated header policies: %w", err)
+	}
+	for _, name := range legacyNames {
+		if err := legacy.Delete(ctx, name); err != nil && !errors.Is(err, guardrails.ErrNotFound) {
+			return len(toMigrate), fmt.Errorf("remove migrated legacy header policy %q: %w", name, err)
+		}
+	}
+	return len(toMigrate), nil
+}
+
+func configHeaderPolicyDefinitions(cfg *config.Config) ([]headerpolicy.Definition, map[string]int, error) {
+	if cfg == nil {
+		return nil, nil, nil
+	}
+	definitions := make([]headerpolicy.Definition, 0, len(cfg.HeaderPolicies.Policies))
+	steps := make(map[string]int, len(cfg.HeaderPolicies.Policies))
+	seen := make(map[string]string)
+	appendPolicy := func(def headerpolicy.Definition, step int, source string) error {
+		name := strings.TrimSpace(def.Name)
+		if previous, duplicate := seen[name]; duplicate {
+			return fmt.Errorf("duplicate header policy %q in %s and %s", name, previous, source)
+		}
+		seen[name] = source
+		definitions = append(definitions, def)
+		steps[name] = step
+		return nil
+	}
+	for i, policy := range cfg.HeaderPolicies.Policies {
+		actions := make([]headerpolicy.Action, 0, len(policy.Actions))
+		for _, action := range policy.Actions {
+			actions = append(actions, headerpolicy.Action{Action: action.Action, Header: action.Header, Value: action.Value, FromHeader: action.FromHeader})
+		}
+		conditions := make([]headerpolicy.Condition, 0, len(policy.When))
+		for _, condition := range policy.When {
+			conditions = append(conditions, headerpolicy.Condition{Header: condition.Header, Equals: condition.Equals, Matches: condition.Matches, Present: condition.Present})
+		}
+		if err := appendPolicy(headerpolicy.Definition{
+			Name: policy.Name, Description: policy.Description, Methods: policy.Methods,
+			Paths: policy.Paths, When: conditions, Actions: actions,
+		}, policy.Step, fmt.Sprintf("header_policies.policies[%d]", i)); err != nil {
+			return nil, nil, err
+		}
+	}
+	for i, rule := range cfg.Guardrails.Rules {
+		if normalizeLegacyHeaderPolicyType(rule.Type) != "header_modification" {
+			continue
+		}
+		raw, err := json.Marshal(headerModificationSeedConfig(rule.HeaderModification))
+		if err != nil {
+			return nil, nil, fmt.Errorf("marshal legacy header policy %q: %w", rule.Name, err)
+		}
+		def, err := headerpolicy.DefinitionFromLegacy(rule.Name, "", raw)
+		if err != nil {
+			return nil, nil, err
+		}
+		if err := appendPolicy(def, rule.Order, fmt.Sprintf("guardrails.rules[%d]", i)); err != nil {
+			return nil, nil, err
+		}
+		slog.Warn("guardrails header_modification config is deprecated; move it to header_policies.policies", "name", def.Name)
+	}
+	return definitions, steps, nil
+}
+
+func normalizeLegacyHeaderPolicyType(value string) string {
+	switch strings.ToLower(strings.TrimSpace(value)) {
+	case "header-modification":
+		return "header_modification"
+	default:
+		return strings.ToLower(strings.TrimSpace(value))
+	}
+}
+
+func rejectPolicyNameCollisions(guardrailDefinitions []guardrails.Definition, headerPolicyDefinitions []headerpolicy.Definition) error {
+	headerPolicyNames := make(map[string]struct{}, len(headerPolicyDefinitions))
+	for _, definition := range headerPolicyDefinitions {
+		headerPolicyNames[strings.TrimSpace(definition.Name)] = struct{}{}
+	}
+	for _, definition := range guardrailDefinitions {
+		name := strings.TrimSpace(definition.Name)
+		if _, exists := headerPolicyNames[name]; exists {
+			return fmt.Errorf("name %q is used by both a guardrail and a header policy", name)
+		}
+	}
+	return nil
+}
diff --git a/internal/app/header_policies_test.go b/internal/app/header_policies_test.go
new file mode 100644
index 00000000..9b088e67
--- /dev/null
+++ b/internal/app/header_policies_test.go
@@ -0,0 +1,89 @@
+package app
+
+import (
+	"database/sql"
+	"errors"
+	"testing"
+
+	"github.com/enterpilot/gomodel/internal/guardrails"
+	"github.com/enterpilot/gomodel/internal/headerpolicy"
+
+	_ "modernc.org/sqlite"
+)
+
+func TestMigrateLegacyHeaderPoliciesMovesAndDeletesRows(t *testing.T) {
+	db, err := sql.Open("sqlite", ":memory:")
+	if err != nil {
+		t.Fatalf("sql.Open() error = %v", err)
+	}
+	db.SetMaxOpenConns(1)
+	defer db.Close()
+	legacy, err := guardrails.NewSQLiteStore(t.Context(), db)
+	if err != nil {
+		t.Fatalf("guardrails.NewSQLiteStore() error = %v", err)
+	}
+	target, err := headerpolicy.NewSQLiteStore(t.Context(), db)
+	if err != nil {
+		t.Fatalf("headerpolicy.NewSQLiteStore() error = %v", err)
+	}
+	if err := legacy.Upsert(t.Context(), guardrails.Definition{
+		Name: "pin-beta", Type: "header_modification", Description: "legacy",
+		Config: []byte(`{"endpoints":["/v1/*"],"actions":[{"action":"set","header":"Anthropic-Beta","value":"context-1m"}]}`),
+	}); err != nil {
+		t.Fatalf("legacy.Upsert() error = %v", err)
+	}
+	count, err := migrateLegacyHeaderPolicies(t.Context(), legacy, target)
+	if err != nil {
+		t.Fatalf("migrateLegacyHeaderPolicies() error = %v", err)
+	}
+	if count != 1 {
+		t.Fatalf("migrated count = %d, want 1", count)
+	}
+	got, err := target.Get(t.Context(), "pin-beta")
+	if err != nil {
+		t.Fatalf("target.Get() error = %v", err)
+	}
+	if got.Description != "legacy" || got.Paths[0] != "/v1/*" {
+		t.Fatalf("migrated definition = %#v", got)
+	}
+	if _, err := legacy.Get(t.Context(), "pin-beta"); !errors.Is(err, guardrails.ErrNotFound) {
+		t.Fatalf("legacy.Get() error = %v, want ErrNotFound", err)
+	}
+}
+
+func TestMigrateLegacyHeaderPoliciesPreservesDedicatedRow(t *testing.T) {
+	db, err := sql.Open("sqlite", ":memory:")
+	if err != nil {
+		t.Fatalf("sql.Open() error = %v", err)
+	}
+	db.SetMaxOpenConns(1)
+	defer db.Close()
+	legacy, err := guardrails.NewSQLiteStore(t.Context(), db)
+	if err != nil {
+		t.Fatalf("guardrails.NewSQLiteStore() error = %v", err)
+	}
+	target, err := headerpolicy.NewSQLiteStore(t.Context(), db)
+	if err != nil {
+		t.Fatalf("headerpolicy.NewSQLiteStore() error = %v", err)
+	}
+	if err := target.Upsert(t.Context(), headerpolicy.Definition{
+		Name: "headers", Description: "dedicated",
+		Actions: []headerpolicy.Action{{Action: headerpolicy.ActionRemove, Header: "X-Debug"}},
+	}); err != nil {
+		t.Fatalf("target.Upsert() error = %v", err)
+	}
+	if err := legacy.Upsert(t.Context(), guardrails.Definition{
+		Name: "headers", Type: "header_modification", Description: "stale",
+		Config: []byte(`{"actions":[{"action":"remove","header":"X-Legacy"}]}`),
+	}); err != nil {
+		t.Fatalf("legacy.Upsert() error = %v", err)
+	}
+	count, err := migrateLegacyHeaderPolicies(t.Context(), legacy, target)
+	if err != nil || count != 0 {
+		t.Fatalf("migration = %d, %v", count, err)
+	}
+	got, err := target.Get(t.Context(), "headers")
+	if err != nil || got.Description != "dedicated" {
+		t.Fatalf("dedicated row = %#v, %v", got, err)
+	}
+}
diff --git a/internal/auditlog/auditlog.go b/internal/auditlog/auditlog.go
index 7a407d69..80fb8bcc 100644
--- a/internal/auditlog/auditlog.go
+++ b/internal/auditlog/auditlog.go
@@ -136,10 +136,11 @@ type LogData struct {
 	// stores split this into audit_log_attempts; Mongo stores it embedded.
 	Attempts []AttemptSnapshot `json:"attempts,omitempty" bson:"attempts,omitempty"`
 
-	// RequestRevisions captures the ingress request-rewrite chain: one entry
-	// per registered rewriter that changed the body, in application order.
-	// RequestBody always remains the original client request; the last
-	// revision is what was forwarded downstream.
+	// RequestRevisions captures intended request-processing changes in
+	// application order: body rewrites and outbound header modifications.
+	// RequestBody always remains the original client request. A revision records
+	// what would be applied if execution reaches provider egress; it is not proof
+	// of egress.
 	RequestRevisions []RequestRevisionSnapshot `json:"request_revisions,omitempty" bson:"request_revisions,omitempty"`
 
 	// Request parameters
@@ -185,8 +186,11 @@ type FailoverSnapshot struct {
 	TargetModel string `json:"target_model,omitempty" bson:"target_model,omitempty"`
 }
 
-// RequestRevisionSnapshot records one ingress rewrite of the request body,
-// so operators can trace how a request changed on its way to the provider.
+// RequestRevisionSnapshot records one ingress change to the request — a body
+// rewrite or an outbound header modification — so operators can trace how a
+// request changed on its way to the provider. Only changed values are stored:
+// an absent Body means this revision did not change the body, and an absent
+// Headers means it did not change the outbound headers.
 type RequestRevisionSnapshot struct {
 	Seq         int    `json:"seq" bson:"seq"`
 	Rewriter    string `json:"rewriter" bson:"rewriter"`
@@ -206,6 +210,23 @@ type RequestRevisionSnapshot struct {
 	// Detail is an optional rewriter-provided structured summary of what
 	// changed (for example a compression block report).
 	Detail any `json:"detail,omitempty" bson:"detail,omitempty"`
+
+	// Headers records the outbound provider-request header changes made by
+	// this revision. Only the delta is stored; absent means unchanged.
+	Headers *HeaderRevisionSnapshot `json:"headers,omitempty" bson:"headers,omitempty"`
+}
+
+// HeaderRevisionSnapshot is the outbound header delta of one request revision.
+// Set is either a map of final values when LOGGING_LOG_HEADERS=true (with
+// credential values redacted), or a list of header names when value logging is
+// disabled. Removed always contains names only.
+type HeaderRevisionSnapshot struct {
+	// Set contains either map[string]string values or a []string of names,
+	// according to the LOGGING_LOG_HEADERS policy described above.
+	Set any `json:"set,omitempty" bson:"set,omitempty"`
+
+	// Removed contains the names of headers the revision removes.
+	Removed []string `json:"removed,omitempty" bson:"removed,omitempty"`
 }
 
 // AttemptSnapshot stores one external provider attempt made for a logical
@@ -333,9 +354,11 @@ func displayAuditProviderName(providerName, provider string) string {
 	return strings.TrimSpace(provider)
 }
 
-// RedactHeaders redacts credential headers (core.IsCredentialHeader) from a
+// RedactHeaders redacts known and likely credential headers from a
 // header map. Values are replaced with "[REDACTED]" to prevent leaking
 // secrets. The original map is not modified; a new map is returned.
+const RedactedHeaderValue = "[REDACTED]"
+
 func RedactHeaders(headers map[string]string) map[string]string {
 	if headers == nil {
 		return nil
@@ -343,8 +366,8 @@ func RedactHeaders(headers map[string]string) map[string]string {
 
 	result := make(map[string]string, len(headers))
 	for key, value := range headers {
-		if core.IsCredentialHeader(key) {
-			result[key] = "[REDACTED]"
+		if core.ShouldRedactHeader(key) {
+			result[key] = RedactedHeaderValue
 		} else {
 			result[key] = value
 		}
diff --git a/internal/auditlog/auditlog_test.go b/internal/auditlog/auditlog_test.go
index 4caed68f..edb56af5 100644
--- a/internal/auditlog/auditlog_test.go
+++ b/internal/auditlog/auditlog_test.go
@@ -111,6 +111,19 @@ func TestRedactHeaders(t *testing.T) {
 				"Proxy-Authorization": "[REDACTED]",
 			},
 		},
+		{
+			name: "redact custom credential-like headers",
+			input: map[string]string{
+				"X-Session-Token": "session-secret",
+				"X-Custom-Auth":   "custom-secret",
+				"Anthropic-Beta":  "context-1m",
+			},
+			expected: map[string]string{
+				"X-Session-Token": "[REDACTED]",
+				"X-Custom-Auth":   "[REDACTED]",
+				"Anthropic-Beta":  "context-1m",
+			},
+		},
 		{
 			name: "case insensitive redaction",
 			input: map[string]string{
diff --git a/internal/core/credential_headers.go b/internal/core/credential_headers.go
index 51b2fa70..df2e035d 100644
--- a/internal/core/credential_headers.go
+++ b/internal/core/credential_headers.go
@@ -24,3 +24,40 @@ func IsCredentialHeader(name string) bool {
 	_, ok := credentialHeaders[strings.ToLower(strings.TrimSpace(name))]
 	return ok
 }
+
+// ShouldRedactHeader reports whether an audit log should hide a header value.
+// It deliberately uses a broader heuristic than IsCredentialHeader: custom
+// upstreams commonly use names such as X-Session-Token or X-Custom-Auth, but
+// those names must remain authorable as outbound policy targets.
+func ShouldRedactHeader(name string) bool {
+	if IsCredentialHeader(name) {
+		return true
+	}
+	parts := strings.FieldsFunc(strings.ToLower(strings.TrimSpace(name)), func(r rune) bool {
+		return r == '-' || r == '_' || r == '.'
+	})
+	for _, part := range parts {
+		switch part {
+		case "auth", "credential", "credentials", "key", "secret", "session", "token":
+			return true
+		}
+		if compactCredentialPart(part) {
+			return true
+		}
+	}
+	return false
+}
+
+func compactCredentialPart(part string) bool {
+	for _, marker := range []string{"auth", "credential", "credentials", "secret", "session", "token"} {
+		if strings.HasPrefix(part, marker) || strings.HasSuffix(part, marker) {
+			return true
+		}
+	}
+	for _, suffix := range []string{"apikey", "accesskey", "clientkey", "consumerkey", "encryptionkey", "privatekey", "secretkey", "signingkey"} {
+		if strings.HasSuffix(part, suffix) {
+			return true
+		}
+	}
+	return false
+}
diff --git a/internal/core/header_mutation.go b/internal/core/header_mutation.go
new file mode 100644
index 00000000..25c4f433
--- /dev/null
+++ b/internal/core/header_mutation.go
@@ -0,0 +1,196 @@
+package core
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"net/http"
+	"slices"
+	"sort"
+	"strings"
+)
+
+// HeaderPlan is the immutable, fully resolved set of outbound provider-request
+// header changes for one request. Conditions and from-header copies have
+// already been evaluated, so applying a plan is a pure egress operation.
+// Names are canonical MIME header keys.
+type HeaderPlan struct {
+	Set          map[string]string
+	Remove       []string
+	SensitiveSet []string
+}
+
+// IsZero reports whether the mutation changes nothing.
+func (m *HeaderPlan) IsZero() bool {
+	return m == nil || (len(m.Set) == 0 && len(m.Remove) == 0)
+}
+
+// Merge folds a later mutation into m: later sets win per header, and a later
+// set clears an earlier remove of the same header (and vice versa).
+func (m *HeaderPlan) Merge(next *HeaderPlan) {
+	if m == nil || next.IsZero() {
+		return
+	}
+	for _, name := range next.Remove {
+		delete(m.Set, name)
+		m.SensitiveSet = removeHeaderName(m.SensitiveSet, name)
+		m.Remove = appendHeaderNameOnce(m.Remove, name)
+	}
+	for name, value := range next.Set {
+		if m.Set == nil {
+			m.Set = make(map[string]string, len(next.Set))
+		}
+		m.Set[name] = value
+		m.Remove = removeHeaderName(m.Remove, name)
+		if slices.Contains(next.SensitiveSet, name) {
+			m.SensitiveSet = appendHeaderNameOnce(m.SensitiveSet, name)
+		} else {
+			m.SensitiveSet = removeHeaderName(m.SensitiveSet, name)
+		}
+	}
+}
+
+// Apply rewrites h in place. Protected headers (credentials, hop-by-hop,
+// framing, and payload metadata) are never touched regardless of what the
+// mutation asks for; validation rejects them at authoring time and this guards
+// the runtime path.
+func (m *HeaderPlan) Apply(h http.Header) {
+	if m.IsZero() || h == nil {
+		return
+	}
+	for _, name := range m.Remove {
+		if IsProtectedHeader(name) {
+			continue
+		}
+		h.Del(name)
+	}
+	for name, value := range m.Set {
+		if IsProtectedHeader(name) {
+			continue
+		}
+		h.Set(name, value)
+	}
+}
+
+// CacheFingerprint returns a stable, non-reversible identity for the effective
+// plan. Cache keys vary on resolved values (including from-header values)
+// without persisting those values in plaintext.
+func (m *HeaderPlan) CacheFingerprint() string {
+	if m.IsZero() {
+		return ""
+	}
+	h := sha256.New()
+	setNames := make([]string, 0, len(m.Set))
+	for name := range m.Set {
+		setNames = append(setNames, name)
+	}
+	sort.Strings(setNames)
+	for _, name := range setNames {
+		h.Write([]byte("set\x00"))
+		h.Write([]byte(strings.ToLower(name)))
+		h.Write([]byte{0})
+		h.Write([]byte(m.Set[name]))
+		h.Write([]byte{0})
+	}
+	removed := append([]string(nil), m.Remove...)
+	sort.Slice(removed, func(i, j int) bool {
+		return strings.ToLower(removed[i]) < strings.ToLower(removed[j])
+	})
+	for _, name := range removed {
+		h.Write([]byte("remove\x00"))
+		h.Write([]byte(strings.ToLower(name)))
+		h.Write([]byte{0})
+	}
+	return hex.EncodeToString(h.Sum(nil))
+}
+
+// protectedTransportHeaders are headers a header-modification rule may never
+// set or remove: message framing, hop-by-hop, and payload metadata headers
+// whose values the gateway and Go's HTTP transport own.
+var protectedTransportHeaders = map[string]struct{}{
+	"host":              {},
+	"content-length":    {},
+	"content-type":      {},
+	"content-encoding":  {},
+	"accept-encoding":   {},
+	"transfer-encoding": {},
+	"connection":        {},
+	"keep-alive":        {},
+	"te":                {},
+	"trailer":           {},
+	"upgrade":           {},
+}
+
+// IsProtectedHeader reports whether a header may never be read or written by
+// header-modification rules: credentials plus transport, framing, and payload
+// metadata headers.
+func IsProtectedHeader(name string) bool {
+	if IsCredentialHeader(name) {
+		return true
+	}
+	_, ok := protectedTransportHeaders[strings.ToLower(strings.TrimSpace(name))]
+	return ok
+}
+
+func appendHeaderNameOnce(names []string, name string) []string {
+	if slices.Contains(names, name) {
+		return names
+	}
+	return append(names, name)
+}
+
+func removeHeaderName(names []string, name string) []string {
+	for i, existing := range names {
+		if existing == name {
+			return append(names[:i], names[i+1:]...)
+		}
+	}
+	return names
+}
+
+// HeaderPolicy is one workflow egress-policy step. Evaluation is pure:
+// conditions are checked against the inbound client headers and the returned
+// plan carries fully resolved values. A nil result means the policy did not
+// match.
+type HeaderPolicy interface {
+	Name() string
+	ResolveHeaderPlan(input HeaderPolicyInput) *HeaderPlan
+}
+
+// HeaderPolicyInput is the immutable request metadata visible to egress-policy
+// planning. Policies never receive the mutable inbound *http.Request.
+type HeaderPolicyInput struct {
+	Headers http.Header
+	Method  string
+	Path    string
+}
+
+type headerPlanKey struct{}
+
+// WithHeaderPlan returns a new context carrying the resolved primary-attempt
+// header plan. The context seam is intentionally private to gateway execution;
+// auxiliary calls and failover attempts strip it explicitly.
+func WithHeaderPlan(ctx context.Context, plan *HeaderPlan) context.Context {
+	if plan.IsZero() {
+		return ctx
+	}
+	return context.WithValue(ctx, headerPlanKey{}, plan)
+}
+
+// WithoutHeaderPlan prevents a request's primary-attempt plan from leaking
+// into an auxiliary call or a failover route.
+func WithoutHeaderPlan(ctx context.Context) context.Context {
+	if ctx == nil || HeaderPlanFromContext(ctx) == nil {
+		return ctx
+	}
+	return context.WithValue(ctx, headerPlanKey{}, (*HeaderPlan)(nil))
+}
+
+// HeaderPlanFromContext retrieves the resolved primary-attempt plan.
+func HeaderPlanFromContext(ctx context.Context) *HeaderPlan {
+	if ctx == nil {
+		return nil
+	}
+	plan, _ := ctx.Value(headerPlanKey{}).(*HeaderPlan)
+	return plan
+}
diff --git a/internal/core/header_mutation_test.go b/internal/core/header_mutation_test.go
new file mode 100644
index 00000000..cae2edcd
--- /dev/null
+++ b/internal/core/header_mutation_test.go
@@ -0,0 +1,144 @@
+package core
+
+import (
+	"context"
+	"net/http"
+	"slices"
+	"testing"
+)
+
+func TestHeaderPlanApply(t *testing.T) {
+	h := http.Header{
+		"X-Debug":  []string{"1"},
+		"X-Keep":   []string{"yes"},
+		"X-Multi":  []string{"a", "b"},
+		"X-Rewrit": []string{"old"},
+	}
+	mutation := &HeaderPlan{
+		Set:    map[string]string{"X-Rewrit": "new", "X-Added": "v", "Authorization": "Bearer evil", "Content-Length": "0"},
+		Remove: []string{"X-Debug", "Host"},
+	}
+	mutation.Apply(h)
+
+	if h.Get("X-Rewrit") != "new" || h.Get("X-Added") != "v" {
+		t.Fatalf("set not applied: %v", h)
+	}
+	if _, exists := h["X-Debug"]; exists {
+		t.Fatal("remove not applied")
+	}
+	if h.Get("X-Keep") != "yes" || len(h["X-Multi"]) != 2 {
+		t.Fatal("unrelated headers changed")
+	}
+	if h.Get("Authorization") != "" || h.Get("Content-Length") != "" {
+		t.Fatal("protected headers must never be set by mutations")
+	}
+}
+
+func TestHeaderPlanMerge(t *testing.T) {
+	first := &HeaderPlan{
+		Set:    map[string]string{"X-A": "1", "X-B": "1", "X-Secret": "copied"},
+		Remove: []string{"X-C"}, SensitiveSet: []string{"X-Secret"},
+	}
+	second := &HeaderPlan{
+		Set:    map[string]string{"X-B": "2", "X-C": "3", "X-Secret": "literal"},
+		Remove: []string{"X-A"},
+	}
+	first.Merge(second)
+
+	if _, ok := first.Set["X-A"]; ok {
+		t.Fatal("later remove must clear earlier set")
+	}
+	if first.Set["X-B"] != "2" {
+		t.Fatal("later set must win")
+	}
+	if first.Set["X-C"] != "3" {
+		t.Fatal("later set must clear earlier remove")
+	}
+	if slices.Contains(first.SensitiveSet, "X-Secret") {
+		t.Fatal("later non-sensitive set must clear earlier source sensitivity")
+	}
+	for _, name := range first.Remove {
+		if name == "X-C" {
+			t.Fatal("X-C should no longer be removed")
+		}
+	}
+}
+
+func TestHeaderPlanMergeRemovesSensitivityWithHeader(t *testing.T) {
+	plan := &HeaderPlan{Set: map[string]string{"X-Team": "secret"}, SensitiveSet: []string{"X-Team"}}
+	plan.Merge(&HeaderPlan{Remove: []string{"X-Team"}})
+
+	if len(plan.SensitiveSet) != 0 {
+		t.Fatalf("removed header retained audit sensitivity metadata: %v", plan.SensitiveSet)
+	}
+}
+
+func TestHeaderPlanContextRoundTrip(t *testing.T) {
+	ctx := context.WithValue(t.Context(), headerMutationContextMarker{}, "kept")
+	if HeaderPlanFromContext(ctx) != nil {
+		t.Fatal("expected nil mutation on fresh context")
+	}
+	if got := WithHeaderPlan(ctx, nil); got != ctx {
+		t.Fatal("empty mutation must not modify context")
+	}
+	mutation := &HeaderPlan{Set: map[string]string{"X-A": "1"}}
+	got := HeaderPlanFromContext(WithHeaderPlan(ctx, mutation))
+	if got == nil || got.Set["X-A"] != "1" {
+		t.Fatalf("mutation not carried: %+v", got)
+	}
+	without := WithoutHeaderPlan(WithHeaderPlan(ctx, mutation))
+	if HeaderPlanFromContext(without) != nil {
+		t.Fatal("WithoutHeaderPlan must hide the request-scoped mutation")
+	}
+	if got := without.Value(headerMutationContextMarker{}); got != "kept" {
+		t.Fatalf("WithoutHeaderPlan lost unrelated context value: %v", got)
+	}
+}
+
+type headerMutationContextMarker struct{}
+
+func TestIsProtectedHeader(t *testing.T) {
+	for _, name := range []string{"Authorization", "cookie", "X-Api-Key", "Host", "content-length", "Content-Type", "Content-Encoding", "Accept-Encoding", "Transfer-Encoding", "Connection"} {
+		if !IsProtectedHeader(name) {
+			t.Fatalf("%s should be protected", name)
+		}
+	}
+	for _, name := range []string{"Anthropic-Beta", "X-Debug", "User-Agent", "Accept"} {
+		if IsProtectedHeader(name) {
+			t.Fatalf("%s should not be protected", name)
+		}
+	}
+}
+
+func TestHeaderPlanCacheFingerprintIsStableAndValueSensitive(t *testing.T) {
+	first := &HeaderPlan{Set: map[string]string{"X-B": "2", "X-A": "1"}, Remove: []string{"X-Z"}}
+	reordered := &HeaderPlan{Set: map[string]string{"X-A": "1", "X-B": "2"}, Remove: []string{"X-Z"}}
+	changed := &HeaderPlan{Set: map[string]string{"X-A": "different", "X-B": "2"}, Remove: []string{"X-Z"}}
+
+	if first.CacheFingerprint() != reordered.CacheFingerprint() {
+		t.Fatal("equivalent plans produced different cache fingerprints")
+	}
+	if first.CacheFingerprint() == changed.CacheFingerprint() {
+		t.Fatal("different resolved values produced the same cache fingerprint")
+	}
+}
+
+func TestShouldRedactHeaderRecognizesCustomCredentialNames(t *testing.T) {
+	for _, name := range []string{
+		"X-Session-Token", "X-Api-Token", "X-Custom-Auth", "X-Upstream-Secret", "X-ApiKey",
+		"X-Authentication", "X-ClientSecret", "X-GitHubToken", "X-SessionId",
+	} {
+		if !ShouldRedactHeader(name) {
+			t.Fatalf("%s should be redacted from audit logs", name)
+		}
+		if IsProtectedHeader(name) {
+			t.Fatalf("%s should remain authorable as an outbound policy target", name)
+		}
+	}
+	if ShouldRedactHeader("Anthropic-Beta") {
+		t.Fatal("Anthropic-Beta should remain visible when header logging is enabled")
+	}
+	if ShouldRedactHeader("X-Monkey") {
+		t.Fatal("X-Monkey must not be mistaken for a compact key header")
+	}
+}
diff --git a/internal/core/workflow.go b/internal/core/workflow.go
index 2951e19e..b74460c4 100644
--- a/internal/core/workflow.go
+++ b/internal/core/workflow.go
@@ -10,6 +10,8 @@ const (
 	ExecutionModePassthrough ExecutionMode = "passthrough"
 	ExecutionModeNativeBatch ExecutionMode = "native_batch"
 	ExecutionModeNativeFile  ExecutionMode = "native_file"
+	ExecutionModeRealtime    ExecutionMode = "realtime"
+	ExecutionModeMCP         ExecutionMode = "mcp"
 )
 
 // CapabilitySet advertises the gateway behaviors that are valid for a request.
diff --git a/internal/gateway/failover.go b/internal/gateway/failover.go
index c25e5311..a8cc2fb7 100644
--- a/internal/gateway/failover.go
+++ b/internal/gateway/failover.go
@@ -153,7 +153,9 @@ func executeTranslatedWithFailover[Req any, Resp any](
 			return resp, ResponseProviderType(ProviderTypeFromWorkflow(workflow), responseProvider), ProviderNameFromWorkflow(workflow), nil
 		},
 		func(selector core.ModelSelector, providerType, providerName string) (Resp, string, error) {
-			resp, responseProvider, err := call(ctx, cloneForSelector(req, selector))
+			// Header policies are scoped to the selected primary route. A
+			// different failover provider must not inherit its egress contract.
+			resp, responseProvider, err := call(core.WithoutHeaderPlan(ctx), cloneForSelector(req, selector))
 			if err != nil {
 				var zero Resp
 				return zero, "", err
diff --git a/internal/gateway/failover_test.go b/internal/gateway/failover_test.go
index e17e5395..5d24b084 100644
--- a/internal/gateway/failover_test.go
+++ b/internal/gateway/failover_test.go
@@ -238,6 +238,33 @@ func TestExecuteTranslatedSkipsSaturatedPrimaryAndFailsOver(t *testing.T) {
 	}
 }
 
+func TestExecuteTranslatedFailoverDoesNotInheritPrimaryHeaderPlan(t *testing.T) {
+	o, workflow := failoverTestFixture()
+	ctx := core.WithHeaderPlan(context.Background(), &core.HeaderPlan{Set: map[string]string{"Anthropic-Beta": "primary-only"}})
+
+	callCount := 0
+	_, _, _, _, didFailover, err := executeTranslatedWithFailover(
+		ctx, o, workflow, "req", "openai/gpt-4o", "openai",
+		func(req string, selector core.ModelSelector) string { return selector.QualifiedModel() },
+		func(callCtx context.Context, _ string) (string, string, error) {
+			callCount++
+			if callCount == 1 {
+				if core.HeaderPlanFromContext(callCtx) == nil {
+					t.Fatal("primary attempt lost its header plan")
+				}
+				return "", "", core.NewProviderError("openai", http.StatusBadGateway, "primary failed", nil)
+			}
+			if core.HeaderPlanFromContext(callCtx) != nil {
+				t.Fatal("failover attempt inherited the primary route's header plan")
+			}
+			return "ok", "openai", nil
+		},
+	)
+	if err != nil || !didFailover || callCount != 2 {
+		t.Fatalf("failover result = (calls:%d used:%v err:%v), want two calls and success", callCount, didFailover, err)
+	}
+}
+
 // When every failover target is also unavailable, the client receives the
 // original rate-limit rejection, not a provider error.
 func TestExecuteTranslatedSaturatedPrimarySurfaces429WhenNoTargetRemains(t *testing.T) {
diff --git a/internal/gateway/inference_execute.go b/internal/gateway/inference_execute.go
index f15431d4..2a32f961 100644
--- a/internal/gateway/inference_execute.go
+++ b/internal/gateway/inference_execute.go
@@ -414,7 +414,7 @@ func streamTranslatedProviderRequest[Req any](
 
 	stream, resolvedProviderType, resolvedProviderName, resolvedUsageModel, failoverModel, err := tryFailoverStream(ctx, o, workflow, model, provider, err,
 		func(selector core.ModelSelector, providerType, providerName string) (io.ReadCloser, string, string, error) {
-			stream, err := call(ctx, cloneForSelector(req, selector))
+			stream, err := call(core.WithoutHeaderPlan(ctx), cloneForSelector(req, selector))
 			if err != nil {
 				return nil, "", "", err
 			}
diff --git a/internal/guardrails/definitions.go b/internal/guardrails/definitions.go
index 2772a55e..93343e75 100644
--- a/internal/guardrails/definitions.go
+++ b/internal/guardrails/definitions.go
@@ -11,6 +11,7 @@ import (
 	"github.com/goccy/go-json"
 
 	"github.com/enterpilot/gomodel/internal/core"
+	"github.com/enterpilot/gomodel/internal/headerpolicy"
 )
 
 // Definition is one persisted reusable guardrail instance.
@@ -119,6 +120,12 @@ func normalizeDefinition(def Definition) (Definition, error) {
 			return Definition{}, newValidationError("marshal guardrail config", err)
 		}
 		def.Config = raw
+	case "header_modification":
+		raw, err := headerpolicy.NormalizeLegacyConfig(def.Config)
+		if err != nil {
+			return Definition{}, err
+		}
+		def.Config = raw
 	default:
 		return Definition{}, newValidationError(`unknown guardrail type: "`+def.Type+`"`, nil)
 	}
@@ -132,6 +139,8 @@ func normalizeDefinitionType(raw string) string {
 		return "system_prompt"
 	case "llm-based-altering":
 		return "llm_based_altering"
+	case "header-modification":
+		return "header_modification"
 	default:
 		return strings.ToLower(strings.TrimSpace(raw))
 	}
@@ -337,6 +346,12 @@ func summarizeDefinition(def Definition) string {
 			}
 		}
 		return fmt.Sprintf("%s • %s • %s", target, strings.Join(runtimeCfg.Roles, ","), promptSummary)
+	case "header_modification":
+		policy, err := headerpolicy.DefinitionFromLegacy(def.Name, def.Description, def.Config)
+		if err != nil {
+			return ""
+		}
+		return headerpolicy.ViewFromDefinition(policy).Summary
 	default:
 		return ""
 	}
diff --git a/internal/guardrails/registry.go b/internal/guardrails/registry.go
index a71cd105..9ecca1fc 100644
--- a/internal/guardrails/registry.go
+++ b/internal/guardrails/registry.go
@@ -6,7 +6,7 @@ import (
 	"strings"
 )
 
-// StepReference points to one named guardrail and the step it should run at.
+// StepReference points to one named guardrail and its execution step.
 type StepReference struct {
 	Ref  string
 	Step int
@@ -17,7 +17,7 @@ type registryEntry struct {
 	descriptor RuleDescriptor
 }
 
-// Registry stores named guardrails so workflows can reference them by id.
+// Registry stores named message guardrails for workflow compilation.
 type Registry struct {
 	entries map[string]registryEntry
 }
@@ -27,7 +27,7 @@ func NewRegistry() *Registry {
 	return &Registry{entries: make(map[string]registryEntry)}
 }
 
-// Len returns the number of registered named guardrails.
+// Len returns the number of registered guardrails.
 func (r *Registry) Len() int {
 	if r == nil {
 		return 0
@@ -35,12 +35,11 @@ func (r *Registry) Len() int {
 	return len(r.entries)
 }
 
-// Names returns the registered guardrail names in sorted order.
+// Names returns registered names in sorted order.
 func (r *Registry) Names() []string {
-	if r == nil || len(r.entries) == 0 {
+	if r == nil {
 		return []string{}
 	}
-
 	names := make([]string, 0, len(r.entries))
 	for name := range r.entries {
 		names = append(names, name)
@@ -49,7 +48,7 @@ func (r *Registry) Names() []string {
 	return names
 }
 
-// Register adds one named guardrail and its hashing descriptor.
+// Register adds one named message guardrail and hashing descriptor.
 func (r *Registry) Register(g Guardrail, descriptor RuleDescriptor) error {
 	if r == nil {
 		return fmt.Errorf("registry is required")
@@ -65,14 +64,11 @@ func (r *Registry) Register(g Guardrail, descriptor RuleDescriptor) error {
 		return fmt.Errorf("duplicate guardrail registration: %q", name)
 	}
 	descriptor.Name = name
-	r.entries[name] = registryEntry{
-		guardrail:  g,
-		descriptor: descriptor,
-	}
+	r.entries[name] = registryEntry{guardrail: g, descriptor: descriptor}
 	return nil
 }
 
-// BuildPipeline resolves named guardrail references into an executable pipeline and hash.
+// BuildPipeline resolves named references into an executable pipeline and hash.
 func (r *Registry) BuildPipeline(steps []StepReference) (*Pipeline, string, error) {
 	if len(steps) == 0 {
 		return nil, "", nil
@@ -80,7 +76,6 @@ func (r *Registry) BuildPipeline(steps []StepReference) (*Pipeline, string, erro
 	if r == nil {
 		return nil, "", fmt.Errorf("guardrail registry is required")
 	}
-
 	pipeline := NewPipeline()
 	descriptors := make([]RuleDescriptor, 0, len(steps))
 	for _, step := range steps {
diff --git a/internal/guardrails/service.go b/internal/guardrails/service.go
index cd31a3bd..cebdcac4 100644
--- a/internal/guardrails/service.go
+++ b/internal/guardrails/service.go
@@ -108,6 +108,9 @@ func (s *Service) UpsertDefinitions(ctx context.Context, definitions []Definitio
 
 	normalized := make([]Definition, 0, len(definitions))
 	for _, definition := range definitions {
+		if err := rejectLegacyHeaderPolicyWrite(definition); err != nil {
+			return err
+		}
 		normalizedDefinition, err := normalizeDefinition(definition)
 		if err != nil {
 			return err
@@ -180,6 +183,9 @@ func (s *Service) Get(name string) (*Definition, bool) {
 
 // Upsert validates and stores a guardrail definition, then swaps the snapshot on success.
 func (s *Service) Upsert(ctx context.Context, definition Definition) error {
+	if err := rejectLegacyHeaderPolicyWrite(definition); err != nil {
+		return err
+	}
 	normalized, err := normalizeDefinition(definition)
 	if err != nil {
 		return err
@@ -207,6 +213,13 @@ func (s *Service) Upsert(ctx context.Context, definition Definition) error {
 	return nil
 }
 
+func rejectLegacyHeaderPolicyWrite(definition Definition) error {
+	if normalizeDefinitionType(definition.Type) != "header_modification" {
+		return nil
+	}
+	return newValidationError("header_modification is an outbound header policy; use the header policy service", nil)
+}
+
 // Delete removes a guardrail definition from storage and swaps the snapshot on success.
 func (s *Service) Delete(ctx context.Context, name string) error {
 	name = normalizeDefinitionName(name)
@@ -277,6 +290,11 @@ func buildSnapshot(definitions []Definition, executor ChatCompletionExecutor) (s
 		registry:    NewRegistry(),
 	}
 	for _, definition := range definitions {
+		if normalizeDefinitionType(definition.Type) == "header_modification" {
+			// Startup migrates preview rows into dedicated header-policy storage.
+			// Ignore them here so the guardrail service can initialize first.
+			continue
+		}
 		normalized, err := normalizeDefinition(definition)
 		if err != nil {
 			return serviceSnapshot{}, fmt.Errorf("load guardrail %q: %w", definition.Name, err)
diff --git a/internal/guardrails/service_test.go b/internal/guardrails/service_test.go
index 5a455c48..536d054e 100644
--- a/internal/guardrails/service_test.go
+++ b/internal/guardrails/service_test.go
@@ -141,6 +141,36 @@ func TestNewServiceRejectsMultipleExecutors(t *testing.T) {
 	}
 }
 
+func TestServiceRejectsRuntimeLegacyHeaderPolicyWrites(t *testing.T) {
+	definition := Definition{
+		Name: "headers", Type: "header_modification",
+		Config: rawConfig(t, map[string]any{"actions": []map[string]any{{"action": "remove", "header": "X-Debug"}}}),
+	}
+	for _, test := range []struct {
+		name  string
+		write func(*Service) error
+	}{
+		{name: "upsert", write: func(service *Service) error { return service.Upsert(t.Context(), definition) }},
+		{name: "upsert many", write: func(service *Service) error {
+			return service.UpsertDefinitions(t.Context(), []Definition{definition})
+		}},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			store := newTestStore()
+			service, err := NewService(store)
+			if err != nil {
+				t.Fatalf("NewService() error = %v", err)
+			}
+			if err := test.write(service); err == nil {
+				t.Fatal("legacy header policy write error = nil")
+			}
+			if len(store.definitions) != 0 {
+				t.Fatalf("legacy write reached storage: %#v", store.definitions)
+			}
+		})
+	}
+}
+
 func TestServiceRefreshBuildsLLMBasedAlteringPipelineFromDefinitions(t *testing.T) {
 	store := newTestStore(
 		Definition{
diff --git a/internal/headerpolicy/factory.go b/internal/headerpolicy/factory.go
new file mode 100644
index 00000000..76934039
--- /dev/null
+++ b/internal/headerpolicy/factory.go
@@ -0,0 +1,103 @@
+package headerpolicy
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"sync"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+	"go.mongodb.org/mongo-driver/v2/mongo"
+
+	"github.com/enterpilot/gomodel/config"
+	"github.com/enterpilot/gomodel/internal/storage"
+)
+
+// Result owns a header-policy service, its store, and optional storage connection.
+type Result struct {
+	Service *Service
+	Store   Store
+	Storage storage.Storage
+
+	stopRefresh func()
+	closeOnce   sync.Once
+	closeErr    error
+}
+
+func (r *Result) Close() error {
+	if r == nil {
+		return nil
+	}
+	r.closeOnce.Do(func() {
+		if r.stopRefresh != nil {
+			r.stopRefresh()
+		}
+		var errs []error
+		if r.Store != nil {
+			if err := r.Store.Close(); err != nil {
+				errs = append(errs, fmt.Errorf("store close: %w", err))
+			}
+		}
+		if r.Storage != nil {
+			if err := r.Storage.Close(); err != nil {
+				errs = append(errs, fmt.Errorf("storage close: %w", err))
+			}
+		}
+		if len(errs) > 0 {
+			r.closeErr = errors.Join(errs...)
+		}
+	})
+	return r.closeErr
+}
+
+// New creates the header-policy subsystem with an owned storage connection.
+func New(ctx context.Context, cfg *config.Config, refreshInterval time.Duration) (*Result, error) {
+	if cfg == nil {
+		return nil, fmt.Errorf("config is required")
+	}
+	storageConn, err := storage.New(ctx, cfg.Storage.BackendConfig())
+	if err != nil {
+		return nil, fmt.Errorf("create header policy storage: %w", err)
+	}
+	result, err := newResult(ctx, storageConn, refreshInterval)
+	if err != nil {
+		_ = storageConn.Close()
+		return nil, err
+	}
+	result.Storage = storageConn
+	return result, nil
+}
+
+// NewWithSharedStorage creates the subsystem on an existing storage connection.
+func NewWithSharedStorage(ctx context.Context, shared storage.Storage, refreshInterval time.Duration) (*Result, error) {
+	if shared == nil {
+		return nil, fmt.Errorf("shared storage is required")
+	}
+	return newResult(ctx, shared, refreshInterval)
+}
+
+func newResult(ctx context.Context, storageConn storage.Storage, refreshInterval time.Duration) (*Result, error) {
+	store, err := createStore(ctx, storageConn)
+	if err != nil {
+		return nil, err
+	}
+	service, err := NewService(store)
+	if err != nil {
+		return nil, err
+	}
+	if err := service.Refresh(ctx); err != nil {
+		return nil, err
+	}
+	return &Result{Service: service, Store: store, stopRefresh: service.StartBackgroundRefresh(ctx, refreshInterval)}, nil
+}
+
+func createStore(ctx context.Context, store storage.Storage) (Store, error) {
+	return storage.ResolveBackend[Store](
+		store,
+		func(db *sql.DB) (Store, error) { return NewSQLiteStore(ctx, db) },
+		func(pool *pgxpool.Pool) (Store, error) { return NewPostgreSQLStore(ctx, pool) },
+		func(db *mongo.Database) (Store, error) { return NewMongoDBStore(ctx, db) },
+	)
+}
diff --git a/internal/headerpolicy/policy.go b/internal/headerpolicy/policy.go
new file mode 100644
index 00000000..15618fdd
--- /dev/null
+++ b/internal/headerpolicy/policy.go
@@ -0,0 +1,151 @@
+package headerpolicy
+
+import (
+	"fmt"
+	"net/http"
+	"regexp"
+	"slices"
+	"strings"
+
+	"github.com/enterpilot/gomodel/internal/core"
+)
+
+type compiledCondition struct {
+	header  string
+	equals  *string
+	matches *regexp.Regexp
+	present bool
+}
+
+// Policy is an executable outbound request-header policy.
+type Policy struct {
+	name       string
+	methods    []string
+	paths      []string
+	conditions []compiledCondition
+	actions    []Action
+}
+
+// NewPolicy compiles one validated definition.
+func NewPolicy(def Definition) (*Policy, error) {
+	def, err := normalizeDefinition(def)
+	if err != nil {
+		return nil, err
+	}
+	conditions := make([]compiledCondition, 0, len(def.When))
+	for _, condition := range def.When {
+		compiled := compiledCondition{
+			header: condition.Header, equals: condition.Equals,
+			present: condition.Present == nil || *condition.Present,
+		}
+		if condition.Matches != nil {
+			compiled.matches, err = regexp.Compile(*condition.Matches)
+			if err != nil {
+				return nil, fmt.Errorf("compile matches regex for %s: %w", condition.Header, err)
+			}
+		}
+		conditions = append(conditions, compiled)
+	}
+	return &Policy{
+		name: def.Name, methods: append([]string(nil), def.Methods...),
+		paths: append([]string(nil), def.Paths...), conditions: conditions,
+		actions: append([]Action(nil), def.Actions...),
+	}, nil
+}
+
+// Name returns the reusable policy name.
+func (p *Policy) Name() string {
+	if p == nil {
+		return ""
+	}
+	return p.name
+}
+
+// ResolveHeaderPlan evaluates the policy against immutable request metadata.
+func (p *Policy) ResolveHeaderPlan(input core.HeaderPolicyInput) *core.HeaderPlan {
+	if p == nil {
+		return nil
+	}
+	if len(p.methods) > 0 && !slices.Contains(p.methods, strings.ToUpper(strings.TrimSpace(input.Method))) {
+		return nil
+	}
+	if len(p.paths) > 0 && !slices.ContainsFunc(p.paths, func(selector string) bool {
+		if prefix, ok := strings.CutSuffix(selector, "*"); ok {
+			return strings.HasPrefix(input.Path, prefix)
+		}
+		return input.Path == selector
+	}) {
+		return nil
+	}
+	for _, condition := range p.conditions {
+		if !condition.holds(input.Headers) {
+			return nil
+		}
+	}
+	plan := &core.HeaderPlan{}
+	for _, action := range p.actions {
+		switch action.Action {
+		case ActionSet:
+			value := ""
+			sensitive := core.ShouldRedactHeader(action.Header)
+			if action.Value != nil {
+				value = *action.Value
+			} else {
+				values := input.Headers.Values(action.FromHeader)
+				if len(values) == 0 {
+					continue
+				}
+				value = values[0]
+				sensitive = sensitive || core.ShouldRedactHeader(action.FromHeader)
+			}
+			if plan.Set == nil {
+				plan.Set = make(map[string]string)
+			}
+			plan.Set[action.Header] = value
+			plan.Remove = removeOnce(plan.Remove, action.Header)
+			if sensitive {
+				plan.SensitiveSet = appendOnce(plan.SensitiveSet, action.Header)
+			} else {
+				plan.SensitiveSet = removeOnce(plan.SensitiveSet, action.Header)
+			}
+		case ActionRemove:
+			delete(plan.Set, action.Header)
+			plan.SensitiveSet = removeOnce(plan.SensitiveSet, action.Header)
+			plan.Remove = appendOnce(plan.Remove, action.Header)
+		}
+	}
+	if plan.IsZero() {
+		return nil
+	}
+	return plan
+}
+
+func (c compiledCondition) holds(headers http.Header) bool {
+	values := headers.Values(c.header)
+	switch {
+	case c.matches != nil:
+		return slices.ContainsFunc(values, c.matches.MatchString)
+	case c.equals != nil:
+		return slices.Contains(values, *c.equals)
+	case c.present:
+		return len(values) > 0
+	default:
+		return len(values) == 0
+	}
+}
+
+func appendOnce(values []string, value string) []string {
+	if slices.Contains(values, value) {
+		return values
+	}
+	return append(values, value)
+}
+
+func removeOnce(values []string, value string) []string {
+	for i, existing := range values {
+		if existing == value {
+			return append(values[:i], values[i+1:]...)
+		}
+	}
+	return values
+}
diff --git a/internal/headerpolicy/policy_test.go b/internal/headerpolicy/policy_test.go
new file mode 100644
index 00000000..c8c2491d
--- /dev/null
+++ b/internal/headerpolicy/policy_test.go
@@ -0,0 +1,254 @@
+package headerpolicy
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"testing"
+
+	"github.com/enterpilot/gomodel/internal/core"
+)
+
+func TestPolicyResolveHeaderPlan(t *testing.T) {
+	policy, err := NewPolicy(Definition{
+		Name: "pin-beta", Methods: []string{"post"}, Paths: []string{"/v1/*"},
+		When: []Condition{{Header: "X-Client", Equals: new("")}},
+		Actions: []Action{
+			{Action: ActionSet, Header: "anthropic-beta", Value: new("context-1m")},
+			{Action: ActionSet, Header: "X-Team", FromHeader: "X-Client-Team"},
+			{Action: ActionRemove, Header: "X-Debug"},
+		},
+	})
+	if err != nil {
+		t.Fatalf("NewPolicy() error = %v", err)
+	}
+	plan := policy.ResolveHeaderPlan(core.HeaderPolicyInput{
+		Method: "POST", Path: "/v1/chat/completions",
+		Headers: http.Header{"X-Client": {""}, "X-Client-Team": {"platform"}},
+	})
+	if plan == nil {
+		t.Fatal("ResolveHeaderPlan() = nil")
+	}
+	if plan.Set["Anthropic-Beta"] != "context-1m" || plan.Set["X-Team"] != "platform" {
+		t.Fatalf("plan.Set = %#v", plan.Set)
+	}
+	if len(plan.Remove) != 1 || plan.Remove[0] != "X-Debug" {
+		t.Fatalf("plan.Remove = %#v", plan.Remove)
+	}
+}
+
+func TestPolicyCopiesPresentEmptyHeaderValue(t *testing.T) {
+	policy, err := NewPolicy(Definition{
+		Name:    "copy-empty",
+		Actions: []Action{{Action: ActionSet, Header: "X-Upstream-Value", FromHeader: "X-Client-Value"}},
+	})
+	if err != nil {
+		t.Fatalf("NewPolicy() error = %v", err)
+	}
+	plan := policy.ResolveHeaderPlan(core.HeaderPolicyInput{Headers: http.Header{"X-Client-Value": {""}}})
+	if plan == nil {
+		t.Fatal("ResolveHeaderPlan() = nil, want an explicit empty set value")
+	}
+	value, exists := plan.Set["X-Upstream-Value"]
+	if !exists || value != "" {
+		t.Fatalf("plan.Set = %#v, want X-Upstream-Value with empty value", plan.Set)
+	}
+}
+
+func TestPolicyMarksCopiedCredentialLikeSourceSensitive(t *testing.T) {
+	for _, source := range []string{"X-Session-Token", "X-ApiKey", "X-ClientSecret"} {
+		t.Run(source, func(t *testing.T) {
+			policy, err := NewPolicy(Definition{
+				Name:    "copy-token",
+				Actions: []Action{{Action: ActionSet, Header: "X-Team", FromHeader: source}},
+			})
+			if err != nil {
+				t.Fatalf("NewPolicy() error = %v", err)
+			}
+			headers := make(http.Header)
+			headers.Set(source, "secret")
+			plan := policy.ResolveHeaderPlan(core.HeaderPolicyInput{Headers: headers})
+			if plan == nil || plan.Set["X-Team"] != "secret" {
+				t.Fatalf("plan = %#v", plan)
+			}
+			if len(plan.SensitiveSet) != 1 || plan.SensitiveSet[0] != "X-Team" {
+				t.Fatalf("plan.SensitiveSet = %v", plan.SensitiveSet)
+			}
+		})
+	}
+}
+
+func TestPolicyMarksCredentialLikeDestinationSensitive(t *testing.T) {
+	for _, action := range []Action{
+		{Action: ActionSet, Header: "X-Session-Token", Value: new("literal-secret")},
+		{Action: ActionSet, Header: "X-Session-Token", FromHeader: "X-Team"},
+	} {
+		policy, err := NewPolicy(Definition{Name: "credential-destination", Actions: []Action{action}})
+		if err != nil {
+			t.Fatalf("NewPolicy() error = %v", err)
+		}
+		plan := policy.ResolveHeaderPlan(core.HeaderPolicyInput{Headers: http.Header{"X-Team": {"platform"}}})
+		if plan == nil {
+			t.Fatal("ResolveHeaderPlan() = nil")
+		}
+		if len(plan.SensitiveSet) != 1 || plan.SensitiveSet[0] != "X-Session-Token" {
+			t.Fatalf("plan.SensitiveSet = %v", plan.SensitiveSet)
+		}
+	}
+}
+
+func TestPolicyValidationRejectsProtectedAndPayloadHeaders(t *testing.T) {
+	for _, header := range []string{"Authorization", "Content-Type", "Accept-Encoding"} {
+		t.Run(header, func(t *testing.T) {
+			_, err := NewPolicy(Definition{Name: "unsafe", Actions: []Action{{Action: ActionRemove, Header: header}}})
+			if err == nil {
+				t.Fatalf("NewPolicy() accepted %s", header)
+			}
+		})
+	}
+}
+
+func TestDefinitionFromLegacyMapsEndpointsToPaths(t *testing.T) {
+	definition, err := DefinitionFromLegacy("legacy", "", []byte(`{
+		"methods":["post"],
+		"endpoints":["/v1/*"],
+		"actions":[{"action":"set","header":"X-Test","value":""}]
+	}`))
+	if err != nil {
+		t.Fatalf("DefinitionFromLegacy() error = %v", err)
+	}
+	if len(definition.Paths) != 1 || definition.Paths[0] != "/v1/*" {
+		t.Fatalf("Paths = %#v", definition.Paths)
+	}
+	if definition.Actions[0].Value == nil || *definition.Actions[0].Value != "" {
+		t.Fatalf("empty literal value was not preserved: %#v", definition.Actions[0])
+	}
+}
+
+func TestDefinitionFromLegacyRejectsTrailingJSON(t *testing.T) {
+	_, err := DefinitionFromLegacy("legacy", "", []byte(`{"actions":[{"action":"remove","header":"X-Test"}]} {}`))
+	if err == nil {
+		t.Fatal("DefinitionFromLegacy() error = nil, want trailing JSON error")
+	}
+}
+
+type memoryStore struct {
+	definitions           map[string]Definition
+	failList              bool
+	failListAfterMutation bool
+}
+
+func (s *memoryStore) List(context.Context) ([]Definition, error) {
+	if s.failList {
+		return nil, errors.New("list failed")
+	}
+	result := make([]Definition, 0, len(s.definitions))
+	for _, definition := range s.definitions {
+		result = append(result, definition)
+	}
+	return result, nil
+}
+func (s *memoryStore) Get(_ context.Context, name string) (*Definition, error) {
+	definition, ok := s.definitions[name]
+	if !ok {
+		return nil, ErrNotFound
+	}
+	return &definition, nil
+}
+func (s *memoryStore) Upsert(_ context.Context, definition Definition) error {
+	s.definitions[definition.Name] = definition
+	if s.failListAfterMutation {
+		s.failList = true
+	}
+	return nil
+}
+func (s *memoryStore) UpsertMany(_ context.Context, definitions []Definition) error {
+	for _, definition := range definitions {
+		s.definitions[definition.Name] = definition
+	}
+	if s.failListAfterMutation {
+		s.failList = true
+	}
+	return nil
+}
+func (s *memoryStore) Delete(_ context.Context, name string) error {
+	if _, ok := s.definitions[name]; !ok {
+		return ErrNotFound
+	}
+	delete(s.definitions, name)
+	if s.failListAfterMutation {
+		s.failList = true
+	}
+	return nil
+}
+func (s *memoryStore) Close() error { return nil }
+
+func TestServiceBuildHeaderPolicies(t *testing.T) {
+	store := &memoryStore{definitions: map[string]Definition{}}
+	service, err := NewService(store)
+	if err != nil {
+		t.Fatalf("NewService() error = %v", err)
+	}
+	if err := service.Upsert(context.Background(), Definition{
+		Name: "headers", Actions: []Action{{Action: ActionSet, Header: "X-Test", Value: new("1")}},
+	}); err != nil {
+		t.Fatalf("Upsert() error = %v", err)
+	}
+	policies, err := service.BuildHeaderPolicies([]Reference{{Ref: "headers", Step: 10}})
+	if err != nil {
+		t.Fatalf("BuildHeaderPolicies() error = %v", err)
+	}
+	if len(policies) != 1 {
+		t.Fatalf("policies = %#v", policies)
+	}
+}
+
+func TestServicePublishesCommittedMutationsWithoutPostWriteRefresh(t *testing.T) {
+	definition := Definition{Name: "headers", Actions: []Action{{Action: ActionRemove, Header: "X-Debug"}}}
+	tests := []struct {
+		name   string
+		seed   map[string]Definition
+		mutate func(context.Context, *Service) error
+		want   bool
+	}{
+		{
+			name: "upsert", seed: map[string]Definition{}, want: true,
+			mutate: func(ctx context.Context, service *Service) error { return service.Upsert(ctx, definition) },
+		},
+		{
+			name: "upsert many", seed: map[string]Definition{}, want: true,
+			mutate: func(ctx context.Context, service *Service) error {
+				return service.UpsertDefinitions(ctx, []Definition{definition})
+			},
+		},
+		{
+			name: "delete", seed: map[string]Definition{"headers": definition}, want: false,
+			mutate: func(ctx context.Context, service *Service) error { return service.Delete(ctx, "headers") },
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			store := &memoryStore{definitions: tt.seed}
+			service, err := NewService(store)
+			if err != nil {
+				t.Fatalf("NewService() error = %v", err)
+			}
+			if err := service.Refresh(t.Context()); err != nil {
+				t.Fatalf("initial Refresh() error = %v", err)
+			}
+			store.failListAfterMutation = true
+			if err := tt.mutate(t.Context(), service); err != nil {
+				t.Fatalf("mutation error = %v", err)
+			}
+			if _, ok := service.Get("headers"); ok != tt.want {
+				t.Fatalf("catalog contains headers = %v, want %v", ok, tt.want)
+			}
+			if err := service.Refresh(t.Context()); err == nil {
+				t.Fatal("Refresh() error = nil, want simulated list failure")
+			}
+			if _, ok := service.Get("headers"); ok != tt.want {
+				t.Fatalf("failed refresh changed catalog: contains headers = %v, want %v", ok, tt.want)
+			}
+		})
+	}
+}
diff --git a/internal/headerpolicy/registry.go b/internal/headerpolicy/registry.go
new file mode 100644
index 00000000..0be2c4af
--- /dev/null
+++ b/internal/headerpolicy/registry.go
@@ -0,0 +1,72 @@
+package headerpolicy
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+
+	"github.com/enterpilot/gomodel/internal/core"
+)
+
+type registryEntry struct {
+	policy core.HeaderPolicy
+}
+
+// Registry stores executable policies by reusable name.
+type Registry struct {
+	entries map[string]registryEntry
+}
+
+func newRegistry() *Registry {
+	return &Registry{entries: make(map[string]registryEntry)}
+}
+
+func (r *Registry) register(def Definition) error {
+	policy, err := NewPolicy(def)
+	if err != nil {
+		return err
+	}
+	if _, exists := r.entries[def.Name]; exists {
+		return fmt.Errorf("duplicate header policy registration: %q", def.Name)
+	}
+	r.entries[def.Name] = registryEntry{policy: policy}
+	return nil
+}
+
+// Names returns sorted policy names.
+func (r *Registry) Names() []string {
+	if r == nil {
+		return []string{}
+	}
+	names := make([]string, 0, len(r.entries))
+	for name := range r.entries {
+		names = append(names, name)
+	}
+	sort.Strings(names)
+	return names
+}
+
+// BuildHeaderPolicies resolves and orders workflow references.
+func (r *Registry) BuildHeaderPolicies(steps []Reference) ([]core.HeaderPolicy, error) {
+	if len(steps) == 0 {
+		return nil, nil
+	}
+	if r == nil {
+		return nil, fmt.Errorf("header policy registry is required")
+	}
+	ordered := append([]Reference(nil), steps...)
+	sort.SliceStable(ordered, func(i, j int) bool { return ordered[i].Step < ordered[j].Step })
+	policies := make([]core.HeaderPolicy, 0, len(ordered))
+	for _, step := range ordered {
+		name := strings.TrimSpace(step.Ref)
+		if name == "" {
+			return nil, fmt.Errorf("header policy ref is required")
+		}
+		entry, ok := r.entries[name]
+		if !ok {
+			return nil, fmt.Errorf("unknown header policy ref: %q", name)
+		}
+		policies = append(policies, entry.policy)
+	}
+	return policies, nil
+}
diff --git a/internal/headerpolicy/service.go b/internal/headerpolicy/service.go
new file mode 100644
index 00000000..84683d57
--- /dev/null
+++ b/internal/headerpolicy/service.go
@@ -0,0 +1,303 @@
+package headerpolicy
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/enterpilot/gomodel/internal/core"
+)
+
+type snapshot struct {
+	definitions map[string]Definition
+	order       []string
+	registry    *Registry
+}
+
+// Service owns persisted definitions and their compiled in-memory catalog.
+type Service struct {
+	store Store
+
+	refreshMu sync.Mutex
+	mu        sync.RWMutex
+	snapshot  snapshot
+}
+
+// NewService creates an empty service over store. Call Refresh before use.
+func NewService(store Store) (*Service, error) {
+	if store == nil {
+		return nil, fmt.Errorf("store is required")
+	}
+	return &Service{store: store, snapshot: snapshot{
+		definitions: map[string]Definition{}, order: []string{}, registry: newRegistry(),
+	}}, nil
+}
+
+// Refresh atomically reloads definitions from persistence.
+func (s *Service) Refresh(ctx context.Context) error {
+	s.refreshMu.Lock()
+	defer s.refreshMu.Unlock()
+	definitions, err := s.store.List(ctx)
+	if err != nil {
+		return serviceError("list header policies", err)
+	}
+	next, err := buildSnapshot(definitions)
+	if err != nil {
+		return serviceError("load header policies", err)
+	}
+	s.mu.Lock()
+	s.snapshot = next
+	s.mu.Unlock()
+	return nil
+}
+
+// StartBackgroundRefresh keeps the in-memory catalog synchronized across instances.
+func (s *Service) StartBackgroundRefresh(parent context.Context, interval time.Duration) func() {
+	if parent == nil || s == nil {
+		return func() {}
+	}
+	if interval <= 0 {
+		interval = time.Minute
+	}
+	ctx, cancel := context.WithCancel(parent)
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		ticker := time.NewTicker(interval)
+		defer ticker.Stop()
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-ticker.C:
+				refreshCtx, refreshCancel := context.WithTimeout(ctx, 30*time.Second)
+				_ = s.Refresh(refreshCtx)
+				refreshCancel()
+			}
+		}
+	}()
+	var once sync.Once
+	return func() { once.Do(func() { cancel(); <-done }) }
+}
+
+// UpsertDefinitions validates and persists definitions, then publishes the
+// already-compiled prospective snapshot. A successful write is never followed
+// by a second fallible store read.
+func (s *Service) UpsertDefinitions(ctx context.Context, definitions []Definition) error {
+	if s == nil || len(definitions) == 0 {
+		return nil
+	}
+	normalized := make([]Definition, 0, len(definitions))
+	seen := make(map[string]struct{}, len(definitions))
+	for _, definition := range definitions {
+		def, err := normalizeDefinition(definition)
+		if err != nil {
+			return err
+		}
+		if _, duplicate := seen[def.Name]; duplicate {
+			return newValidationError("duplicate header policy name: "+def.Name, nil)
+		}
+		seen[def.Name] = struct{}{}
+		normalized = append(normalized, def)
+	}
+	s.refreshMu.Lock()
+	defer s.refreshMu.Unlock()
+
+	current, err := s.store.List(ctx)
+	if err != nil {
+		return serviceError("list header policies", err)
+	}
+	nextDefinitions := definitionsByName(current)
+	normalized = prepareUpserts(nextDefinitions, normalized, time.Now().UTC())
+	for _, definition := range normalized {
+		nextDefinitions[definition.Name] = definition
+	}
+	next, err := buildSnapshot(definitionsFromMap(nextDefinitions))
+	if err != nil {
+		return serviceError("load header policies", err)
+	}
+	if err := s.store.UpsertMany(ctx, normalized); err != nil {
+		return serviceError("upsert header policies", err)
+	}
+	s.publish(next)
+	return nil
+}
+
+// Upsert validates and stores one definition.
+func (s *Service) Upsert(ctx context.Context, definition Definition) error {
+	def, err := normalizeDefinition(definition)
+	if err != nil {
+		return err
+	}
+	s.refreshMu.Lock()
+	defer s.refreshMu.Unlock()
+
+	current, err := s.store.List(ctx)
+	if err != nil {
+		return serviceError("list header policies", err)
+	}
+	nextDefinitions := definitionsByName(current)
+	def = prepareUpserts(nextDefinitions, []Definition{def}, time.Now().UTC())[0]
+	nextDefinitions[def.Name] = def
+	next, err := buildSnapshot(definitionsFromMap(nextDefinitions))
+	if err != nil {
+		return serviceError("load header policies", err)
+	}
+	if err := s.store.Upsert(ctx, def); err != nil {
+		return serviceError("upsert header policy", err)
+	}
+	s.publish(next)
+	return nil
+}
+
+// Delete removes one definition.
+func (s *Service) Delete(ctx context.Context, name string) error {
+	name = strings.TrimSpace(name)
+	if name == "" {
+		return newValidationError("header policy name is required", nil)
+	}
+	s.refreshMu.Lock()
+	defer s.refreshMu.Unlock()
+
+	current, err := s.store.List(ctx)
+	if err != nil {
+		return serviceError("list header policies", err)
+	}
+	nextDefinitions := definitionsByName(current)
+	delete(nextDefinitions, name)
+	next, err := buildSnapshot(definitionsFromMap(nextDefinitions))
+	if err != nil {
+		return serviceError("load header policies", err)
+	}
+	if err := s.store.Delete(ctx, name); err != nil {
+		if errors.Is(err, ErrNotFound) {
+			return ErrNotFound
+		}
+		return serviceError("delete header policy", err)
+	}
+	s.publish(next)
+	return nil
+}
+
+// List returns cloned definitions sorted by name.
+func (s *Service) List() []Definition {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	result := make([]Definition, 0, len(s.snapshot.order))
+	for _, name := range s.snapshot.order {
+		result = append(result, cloneDefinition(s.snapshot.definitions[name]))
+	}
+	return result
+}
+
+// ListViews returns admin projections sorted by name.
+func (s *Service) ListViews() []View {
+	definitions := s.List()
+	views := make([]View, 0, len(definitions))
+	for _, definition := range definitions {
+		views = append(views, ViewFromDefinition(definition))
+	}
+	return views
+}
+
+// Get returns a cloned definition.
+func (s *Service) Get(name string) (*Definition, bool) {
+	name = strings.TrimSpace(name)
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	definition, ok := s.snapshot.definitions[name]
+	if !ok {
+		return nil, false
+	}
+	copy := cloneDefinition(definition)
+	return &copy, true
+}
+
+// Names implements Catalog.
+func (s *Service) Names() []string {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	return append([]string(nil), s.snapshot.order...)
+}
+
+// BuildHeaderPolicies implements Catalog.
+func (s *Service) BuildHeaderPolicies(steps []Reference) ([]core.HeaderPolicy, error) {
+	if len(steps) == 0 {
+		return nil, nil
+	}
+	s.mu.RLock()
+	registry := s.snapshot.registry
+	s.mu.RUnlock()
+	return registry.BuildHeaderPolicies(steps)
+}
+
+func buildSnapshot(definitions []Definition) (snapshot, error) {
+	next := snapshot{definitions: make(map[string]Definition, len(definitions)), order: make([]string, 0, len(definitions)), registry: newRegistry()}
+	for _, definition := range definitions {
+		def, err := normalizeDefinition(definition)
+		if err != nil {
+			return snapshot{}, fmt.Errorf("load header policy %q: %w", definition.Name, err)
+		}
+		if err := next.registry.register(def); err != nil {
+			return snapshot{}, err
+		}
+		next.definitions[def.Name] = def
+		next.order = append(next.order, def.Name)
+	}
+	sort.Strings(next.order)
+	return next, nil
+}
+
+func (s *Service) publish(next snapshot) {
+	s.mu.Lock()
+	s.snapshot = next
+	s.mu.Unlock()
+}
+
+func definitionsByName(definitions []Definition) map[string]Definition {
+	result := make(map[string]Definition, len(definitions))
+	for _, definition := range definitions {
+		result[definition.Name] = cloneDefinition(definition)
+	}
+	return result
+}
+
+func definitionsFromMap(definitions map[string]Definition) []Definition {
+	result := make([]Definition, 0, len(definitions))
+	for _, definition := range definitions {
+		result = append(result, definition)
+	}
+	return result
+}
+
+func prepareUpserts(current map[string]Definition, definitions []Definition, now time.Time) []Definition {
+	result := make([]Definition, 0, len(definitions))
+	for _, definition := range definitions {
+		if existing, ok := current[definition.Name]; ok && !existing.CreatedAt.IsZero() {
+			definition.CreatedAt = existing.CreatedAt
+		} else {
+			definition.CreatedAt = now
+		}
+		definition.UpdatedAt = now
+		result = append(result, definition)
+	}
+	return result
+}
+
+func serviceError(message string, err error) error {
+	if err == nil {
+		return nil
+	}
+	if gatewayErr, ok := errors.AsType[*core.GatewayError](err); ok {
+		return gatewayErr
+	}
+	if IsValidationError(err) {
+		return core.NewInvalidRequestError(message+": "+err.Error(), err)
+	}
+	return core.NewProviderError("", http.StatusBadGateway, message+": "+err.Error(), err)
+}
diff --git a/internal/headerpolicy/store.go b/internal/headerpolicy/store.go
new file mode 100644
index 00000000..0f5bc0f0
--- /dev/null
+++ b/internal/headerpolicy/store.go
@@ -0,0 +1,60 @@
+package headerpolicy
+
+import (
+	"errors"
+	"strings"
+)
+
+type definitionScanner interface {
+	Scan(dest ...any) error
+}
+
+type definitionRows interface {
+	definitionScanner
+	Next() bool
+	Err() error
+}
+
+func normalizeDefinitionName(name string) string {
+	return strings.TrimSpace(name)
+}
+
+func collectDefinitions(rows definitionRows, scan func(definitionScanner) (Definition, error)) ([]Definition, error) {
+	result := make([]Definition, 0)
+	for rows.Next() {
+		definition, err := scan(rows)
+		if err != nil {
+			return nil, err
+		}
+		result = append(result, definition)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return result, nil
+}
+
+func storeNotFound(err, backendNotFound error) error {
+	if errors.Is(err, backendNotFound) {
+		return ErrNotFound
+	}
+	return err
+}
+
+type persistedDefinition struct {
+	Methods []string    `json:"methods,omitempty" bson:"methods,omitempty"`
+	Paths   []string    `json:"paths,omitempty" bson:"paths,omitempty"`
+	When    []Condition `json:"when,omitempty" bson:"when,omitempty"`
+	Actions []Action    `json:"actions" bson:"actions"`
+}
+
+func persistedFromDefinition(def Definition) persistedDefinition {
+	return persistedDefinition{Methods: def.Methods, Paths: def.Paths, When: def.When, Actions: def.Actions}
+}
+
+func definitionFromPersisted(name, description string, persisted persistedDefinition) (Definition, error) {
+	return normalizeDefinition(Definition{
+		Name: name, Description: description, Methods: persisted.Methods,
+		Paths: persisted.Paths, When: persisted.When, Actions: persisted.Actions,
+	})
+}
diff --git a/internal/headerpolicy/store_mongodb.go b/internal/headerpolicy/store_mongodb.go
new file mode 100644
index 00000000..b196ead1
--- /dev/null
+++ b/internal/headerpolicy/store_mongodb.go
@@ -0,0 +1,169 @@
+package headerpolicy
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"go.mongodb.org/mongo-driver/v2/bson"
+	"go.mongodb.org/mongo-driver/v2/mongo"
+	"go.mongodb.org/mongo-driver/v2/mongo/options"
+)
+
+type mongoDefinitionDocument struct {
+	Name        string              `bson:"_id"`
+	Description string              `bson:"description,omitempty"`
+	Config      persistedDefinition `bson:"config"`
+	CreatedAt   time.Time           `bson:"created_at"`
+	UpdatedAt   time.Time           `bson:"updated_at"`
+}
+
+type mongoDefinitionIDFilter struct {
+	ID string `bson:"_id"`
+}
+
+// MongoDBStore persists header policies independently from guardrails.
+type MongoDBStore struct{ collection *mongo.Collection }
+
+func NewMongoDBStore(ctx context.Context, database *mongo.Database) (*MongoDBStore, error) {
+	if ctx == nil {
+		return nil, fmt.Errorf("context is required")
+	}
+	if database == nil {
+		return nil, fmt.Errorf("database is required")
+	}
+	collection := database.Collection("header_policy_definitions")
+	indexCtx, cancel := context.WithTimeout(ctx, 30*time.Second)
+	defer cancel()
+	if _, err := collection.Indexes().CreateOne(indexCtx, mongo.IndexModel{Keys: bson.D{{Key: "updated_at", Value: -1}}}); err != nil {
+		return nil, fmt.Errorf("create header policy indexes: %w", err)
+	}
+	return &MongoDBStore{collection: collection}, nil
+}
+
+func (s *MongoDBStore) List(ctx context.Context) ([]Definition, error) {
+	cursor, err := s.collection.Find(ctx, bson.M{}, options.Find().SetSort(bson.D{{Key: "_id", Value: 1}}))
+	if err != nil {
+		return nil, fmt.Errorf("list header policies: %w", err)
+	}
+	defer cursor.Close(ctx)
+	result := make([]Definition, 0)
+	for cursor.Next(ctx) {
+		var doc mongoDefinitionDocument
+		if err := cursor.Decode(&doc); err != nil {
+			return nil, fmt.Errorf("decode header policy: %w", err)
+		}
+		definition, err := definitionFromMongo(doc)
+		if err != nil {
+			return nil, err
+		}
+		result = append(result, definition)
+	}
+	if err := cursor.Err(); err != nil {
+		return nil, fmt.Errorf("iterate header policies: %w", err)
+	}
+	return result, nil
+}
+
+func (s *MongoDBStore) Get(ctx context.Context, name string) (*Definition, error) {
+	var doc mongoDefinitionDocument
+	if err := s.collection.FindOne(ctx, mongoDefinitionIDFilter{ID: normalizeDefinitionName(name)}).Decode(&doc); err != nil {
+		return nil, storeNotFound(err, mongo.ErrNoDocuments)
+	}
+	definition, err := definitionFromMongo(doc)
+	if err != nil {
+		return nil, err
+	}
+	return &definition, nil
+}
+
+func (s *MongoDBStore) Upsert(ctx context.Context, definition Definition) error {
+	definition, err := normalizeDefinition(definition)
+	if err != nil {
+		return err
+	}
+	now := time.Now().UTC()
+	if definition.CreatedAt.IsZero() {
+		definition.CreatedAt = now
+	}
+	if definition.UpdatedAt.IsZero() {
+		definition.UpdatedAt = now
+	}
+	update := bson.M{
+		"$set": bson.M{
+			"description": definition.Description,
+			"config":      persistedFromDefinition(definition),
+			"updated_at":  definition.UpdatedAt,
+		},
+		"$setOnInsert": bson.M{"created_at": definition.CreatedAt},
+	}
+	if _, err := s.collection.UpdateOne(ctx, mongoDefinitionIDFilter{ID: definition.Name}, update, options.UpdateOne().SetUpsert(true)); err != nil {
+		return fmt.Errorf("upsert header policy: %w", err)
+	}
+	return nil
+}
+
+func (s *MongoDBStore) UpsertMany(ctx context.Context, definitions []Definition) error {
+	if len(definitions) == 0 {
+		return nil
+	}
+	now := time.Now().UTC()
+	models := make([]mongo.WriteModel, 0, len(definitions))
+	for _, definition := range definitions {
+		definition, err := normalizeDefinition(definition)
+		if err != nil {
+			return err
+		}
+		if definition.CreatedAt.IsZero() {
+			definition.CreatedAt = now
+		}
+		if definition.UpdatedAt.IsZero() {
+			definition.UpdatedAt = now
+		}
+		models = append(models, mongo.NewUpdateOneModel().
+			SetFilter(mongoDefinitionIDFilter{ID: definition.Name}).
+			SetUpdate(bson.M{
+				"$set":         bson.M{"description": definition.Description, "config": persistedFromDefinition(definition), "updated_at": definition.UpdatedAt},
+				"$setOnInsert": bson.M{"created_at": definition.CreatedAt},
+			}).
+			SetUpsert(true))
+	}
+	session, err := s.collection.Database().Client().StartSession()
+	if err != nil {
+		return fmt.Errorf("start header policy upsert session: %w", err)
+	}
+	defer session.EndSession(ctx)
+	_, err = session.WithTransaction(ctx, func(sessionCtx context.Context) (any, error) {
+		if _, err := s.collection.BulkWrite(sessionCtx, models, options.BulkWrite().SetOrdered(true)); err != nil {
+			return nil, fmt.Errorf("bulk upsert header policies: %w", err)
+		}
+		return nil, nil
+	})
+	if err != nil {
+		return fmt.Errorf("upsert header policies: %w", err)
+	}
+	return nil
+}
+
+func (s *MongoDBStore) Delete(ctx context.Context, name string) error {
+	result, err := s.collection.DeleteOne(ctx, mongoDefinitionIDFilter{ID: normalizeDefinitionName(name)})
+	if err != nil {
+		return fmt.Errorf("delete header policy: %w", err)
+	}
+	if result.DeletedCount == 0 {
+		return ErrNotFound
+	}
+	return nil
+}
+
+func (s *MongoDBStore) Close() error { return nil }
+
+func definitionFromMongo(doc mongoDefinitionDocument) (Definition, error) {
+	definition, err := definitionFromPersisted(doc.Name, doc.Description, doc.Config)
+	if err != nil {
+		return Definition{}, err
+	}
+	definition.CreatedAt = doc.CreatedAt.UTC()
+	definition.UpdatedAt = doc.UpdatedAt.UTC()
+	return definition, nil
+}
diff --git a/internal/headerpolicy/store_postgresql.go b/internal/headerpolicy/store_postgresql.go
new file mode 100644
index 00000000..aad01a33
--- /dev/null
+++ b/internal/headerpolicy/store_postgresql.go
@@ -0,0 +1,158 @@
+package headerpolicy
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/goccy/go-json"
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+// PostgreSQLStore persists header policies independently from guardrails.
+type PostgreSQLStore struct{ pool *pgxpool.Pool }
+
+func NewPostgreSQLStore(ctx context.Context, pool *pgxpool.Pool) (*PostgreSQLStore, error) {
+	if ctx == nil {
+		return nil, fmt.Errorf("context is required")
+	}
+	if pool == nil {
+		return nil, fmt.Errorf("connection pool is required")
+	}
+	statements := []string{
+		`CREATE TABLE IF NOT EXISTS header_policy_definitions (
+			name TEXT PRIMARY KEY,
+			description TEXT NOT NULL DEFAULT '',
+			config JSONB NOT NULL,
+			created_at BIGINT NOT NULL,
+			updated_at BIGINT NOT NULL
+		)`,
+		`CREATE INDEX IF NOT EXISTS idx_header_policy_definitions_updated_at ON header_policy_definitions(updated_at DESC)`,
+	}
+	for _, statement := range statements {
+		if _, err := pool.Exec(ctx, statement); err != nil {
+			return nil, fmt.Errorf("initialize header policy definitions table: %w", err)
+		}
+	}
+	return &PostgreSQLStore{pool: pool}, nil
+}
+
+func (s *PostgreSQLStore) List(ctx context.Context) ([]Definition, error) {
+	rows, err := s.pool.Query(ctx, `SELECT name, description, config, created_at, updated_at FROM header_policy_definitions ORDER BY name ASC`)
+	if err != nil {
+		return nil, fmt.Errorf("list header policies: %w", err)
+	}
+	defer rows.Close()
+	return collectDefinitions(rows, scanPostgreSQLDefinition)
+}
+
+func (s *PostgreSQLStore) Get(ctx context.Context, name string) (*Definition, error) {
+	definition, err := scanPostgreSQLDefinition(s.pool.QueryRow(ctx,
+		`SELECT name, description, config, created_at, updated_at FROM header_policy_definitions WHERE name = $1`,
+		normalizeDefinitionName(name),
+	))
+	if err != nil {
+		return nil, storeNotFound(err, pgx.ErrNoRows)
+	}
+	return &definition, nil
+}
+
+func (s *PostgreSQLStore) Upsert(ctx context.Context, definition Definition) error {
+	definition, err := normalizeDefinition(definition)
+	if err != nil {
+		return err
+	}
+	config, err := json.Marshal(persistedFromDefinition(definition))
+	if err != nil {
+		return fmt.Errorf("marshal header policy %q: %w", definition.Name, err)
+	}
+	now := time.Now().UTC()
+	if definition.CreatedAt.IsZero() {
+		definition.CreatedAt = now
+	}
+	if definition.UpdatedAt.IsZero() {
+		definition.UpdatedAt = now
+	}
+	_, err = s.pool.Exec(ctx, `
+		INSERT INTO header_policy_definitions (name, description, config, created_at, updated_at)
+		VALUES ($1, $2, $3, $4, $5)
+		ON CONFLICT(name) DO UPDATE SET description = excluded.description, config = excluded.config, updated_at = excluded.updated_at
+	`, definition.Name, definition.Description, config, definition.CreatedAt.Unix(), definition.UpdatedAt.Unix())
+	if err != nil {
+		return fmt.Errorf("upsert header policy: %w", err)
+	}
+	return nil
+}
+
+func (s *PostgreSQLStore) UpsertMany(ctx context.Context, definitions []Definition) error {
+	if len(definitions) == 0 {
+		return nil
+	}
+	tx, err := s.pool.Begin(ctx)
+	if err != nil {
+		return fmt.Errorf("begin header policy upsert transaction: %w", err)
+	}
+	defer func() { _ = tx.Rollback(ctx) }()
+	now := time.Now().UTC()
+	for _, definition := range definitions {
+		definition, err = normalizeDefinition(definition)
+		if err != nil {
+			return err
+		}
+		config, err := json.Marshal(persistedFromDefinition(definition))
+		if err != nil {
+			return fmt.Errorf("marshal header policy %q: %w", definition.Name, err)
+		}
+		if definition.CreatedAt.IsZero() {
+			definition.CreatedAt = now
+		}
+		if definition.UpdatedAt.IsZero() {
+			definition.UpdatedAt = now
+		}
+		if _, err := tx.Exec(ctx, `
+			INSERT INTO header_policy_definitions (name, description, config, created_at, updated_at)
+			VALUES ($1, $2, $3, $4, $5)
+			ON CONFLICT(name) DO UPDATE SET description = excluded.description, config = excluded.config, updated_at = excluded.updated_at
+		`, definition.Name, definition.Description, config, definition.CreatedAt.Unix(), definition.UpdatedAt.Unix()); err != nil {
+			return fmt.Errorf("upsert header policy %q: %w", definition.Name, err)
+		}
+	}
+	if err := tx.Commit(ctx); err != nil {
+		return fmt.Errorf("commit header policy upsert transaction: %w", err)
+	}
+	return nil
+}
+
+func (s *PostgreSQLStore) Delete(ctx context.Context, name string) error {
+	tag, err := s.pool.Exec(ctx, `DELETE FROM header_policy_definitions WHERE name = $1`, normalizeDefinitionName(name))
+	if err != nil {
+		return fmt.Errorf("delete header policy: %w", err)
+	}
+	if tag.RowsAffected() == 0 {
+		return ErrNotFound
+	}
+	return nil
+}
+
+func (s *PostgreSQLStore) Close() error { return nil }
+
+func scanPostgreSQLDefinition(scanner definitionScanner) (Definition, error) {
+	var definition Definition
+	var configJSON []byte
+	var createdAt, updatedAt int64
+	if err := scanner.Scan(&definition.Name, &definition.Description, &configJSON, &createdAt, &updatedAt); err != nil {
+		return Definition{}, err
+	}
+	var persisted persistedDefinition
+	if err := json.Unmarshal(configJSON, &persisted); err != nil {
+		return Definition{}, fmt.Errorf("decode stored header policy %q: %w", definition.Name, err)
+	}
+	definition, err := definitionFromPersisted(definition.Name, definition.Description, persisted)
+	if err != nil {
+		return Definition{}, err
+	}
+	definition.CreatedAt = time.Unix(createdAt, 0).UTC()
+	definition.UpdatedAt = time.Unix(updatedAt, 0).UTC()
+	return definition, nil
+}
diff --git a/internal/headerpolicy/store_sqlite.go b/internal/headerpolicy/store_sqlite.go
new file mode 100644
index 00000000..26e78f8f
--- /dev/null
+++ b/internal/headerpolicy/store_sqlite.go
@@ -0,0 +1,161 @@
+package headerpolicy
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+	"time"
+
+	"github.com/goccy/go-json"
+)
+
+// SQLiteStore persists header policies independently from guardrails.
+type SQLiteStore struct{ db *sql.DB }
+
+func NewSQLiteStore(ctx context.Context, db *sql.DB) (*SQLiteStore, error) {
+	if ctx == nil {
+		return nil, fmt.Errorf("context is required")
+	}
+	if db == nil {
+		return nil, fmt.Errorf("database connection is required")
+	}
+	statements := []string{
+		`CREATE TABLE IF NOT EXISTS header_policy_definitions (
+			name TEXT PRIMARY KEY,
+			description TEXT NOT NULL DEFAULT '',
+			config JSON NOT NULL,
+			created_at INTEGER NOT NULL,
+			updated_at INTEGER NOT NULL
+		)`,
+		`CREATE INDEX IF NOT EXISTS idx_header_policy_definitions_updated_at ON header_policy_definitions(updated_at DESC)`,
+	}
+	for _, statement := range statements {
+		if _, err := db.ExecContext(ctx, statement); err != nil {
+			return nil, fmt.Errorf("initialize header policy definitions table: %w", err)
+		}
+	}
+	return &SQLiteStore{db: db}, nil
+}
+
+func (s *SQLiteStore) List(ctx context.Context) ([]Definition, error) {
+	rows, err := s.db.QueryContext(ctx, `SELECT name, description, config, created_at, updated_at FROM header_policy_definitions ORDER BY name ASC`)
+	if err != nil {
+		return nil, fmt.Errorf("list header policies: %w", err)
+	}
+	defer rows.Close()
+	return collectDefinitions(rows, scanSQLiteDefinition)
+}
+
+func (s *SQLiteStore) Get(ctx context.Context, name string) (*Definition, error) {
+	definition, err := scanSQLiteDefinition(s.db.QueryRowContext(ctx,
+		`SELECT name, description, config, created_at, updated_at FROM header_policy_definitions WHERE name = ?`,
+		normalizeDefinitionName(name),
+	))
+	if err != nil {
+		return nil, storeNotFound(err, sql.ErrNoRows)
+	}
+	return &definition, nil
+}
+
+func (s *SQLiteStore) Upsert(ctx context.Context, definition Definition) error {
+	definition, err := normalizeDefinition(definition)
+	if err != nil {
+		return err
+	}
+	config, err := json.Marshal(persistedFromDefinition(definition))
+	if err != nil {
+		return fmt.Errorf("marshal header policy %q: %w", definition.Name, err)
+	}
+	now := time.Now().UTC()
+	if definition.CreatedAt.IsZero() {
+		definition.CreatedAt = now
+	}
+	if definition.UpdatedAt.IsZero() {
+		definition.UpdatedAt = now
+	}
+	_, err = s.db.ExecContext(ctx, `
+		INSERT INTO header_policy_definitions (name, description, config, created_at, updated_at)
+		VALUES (?, ?, ?, ?, ?)
+		ON CONFLICT(name) DO UPDATE SET description = excluded.description, config = excluded.config, updated_at = excluded.updated_at
+	`, definition.Name, definition.Description, string(config), definition.CreatedAt.Unix(), definition.UpdatedAt.Unix())
+	if err != nil {
+		return fmt.Errorf("upsert header policy: %w", err)
+	}
+	return nil
+}
+
+func (s *SQLiteStore) UpsertMany(ctx context.Context, definitions []Definition) error {
+	if len(definitions) == 0 {
+		return nil
+	}
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return fmt.Errorf("begin header policy upsert transaction: %w", err)
+	}
+	defer func() { _ = tx.Rollback() }()
+	now := time.Now().UTC()
+	for _, definition := range definitions {
+		definition, err = normalizeDefinition(definition)
+		if err != nil {
+			return err
+		}
+		config, err := json.Marshal(persistedFromDefinition(definition))
+		if err != nil {
+			return fmt.Errorf("marshal header policy %q: %w", definition.Name, err)
+		}
+		if definition.CreatedAt.IsZero() {
+			definition.CreatedAt = now
+		}
+		if definition.UpdatedAt.IsZero() {
+			definition.UpdatedAt = now
+		}
+		if _, err := tx.ExecContext(ctx, `
+			INSERT INTO header_policy_definitions (name, description, config, created_at, updated_at)
+			VALUES (?, ?, ?, ?, ?)
+			ON CONFLICT(name) DO UPDATE SET description = excluded.description, config = excluded.config, updated_at = excluded.updated_at
+		`, definition.Name, definition.Description, string(config), definition.CreatedAt.Unix(), definition.UpdatedAt.Unix()); err != nil {
+			return fmt.Errorf("upsert header policy %q: %w", definition.Name, err)
+		}
+	}
+	if err := tx.Commit(); err != nil {
+		return fmt.Errorf("commit header policy upsert transaction: %w", err)
+	}
+	return nil
+}
+
+func (s *SQLiteStore) Delete(ctx context.Context, name string) error {
+	result, err := s.db.ExecContext(ctx, `DELETE FROM header_policy_definitions WHERE name = ?`, normalizeDefinitionName(name))
+	if err != nil {
+		return fmt.Errorf("delete header policy: %w", err)
+	}
+	count, err := result.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("delete header policy rows affected: %w", err)
+	}
+	if count == 0 {
+		return ErrNotFound
+	}
+	return nil
+}
+
+func (s *SQLiteStore) Close() error { return nil }
+
+func scanSQLiteDefinition(scanner definitionScanner) (Definition, error) {
+	var definition Definition
+	var configJSON string
+	var createdAt, updatedAt int64
+	if err := scanner.Scan(&definition.Name, &definition.Description, &configJSON, &createdAt, &updatedAt); err != nil {
+		return Definition{}, err
+	}
+	var persisted persistedDefinition
+	if err := json.Unmarshal([]byte(configJSON), &persisted); err != nil {
+		return Definition{}, fmt.Errorf("decode stored header policy %q: %w", definition.Name, err)
+	}
+	definition, err := definitionFromPersisted(definition.Name, definition.Description, persisted)
+	if err != nil {
+		return Definition{}, err
+	}
+	definition.CreatedAt = time.Unix(createdAt, 0).UTC()
+	definition.UpdatedAt = time.Unix(updatedAt, 0).UTC()
+	return definition, nil
+}
diff --git a/internal/headerpolicy/store_sqlite_test.go b/internal/headerpolicy/store_sqlite_test.go
new file mode 100644
index 00000000..6776afde
--- /dev/null
+++ b/internal/headerpolicy/store_sqlite_test.go
@@ -0,0 +1,66 @@
+package headerpolicy
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"testing"
+
+	_ "modernc.org/sqlite"
+)
+
+func TestSQLiteStoreCRUDRoundTrip(t *testing.T) {
+	db, err := sql.Open("sqlite", ":memory:")
+	if err != nil {
+		t.Fatalf("sql.Open() error = %v", err)
+	}
+	db.SetMaxOpenConns(1)
+	defer db.Close()
+	store, err := NewSQLiteStore(t.Context(), db)
+	if err != nil {
+		t.Fatalf("NewSQLiteStore() error = %v", err)
+	}
+	definition := Definition{
+		Name: "pin-beta", Description: "test", Methods: []string{"post"}, Paths: []string{"/v1/*"},
+		When:    []Condition{{Header: "X-Empty", Equals: new("")}},
+		Actions: []Action{{Action: ActionSet, Header: "Anthropic-Beta", Value: new("context-1m")}},
+	}
+	if err := store.Upsert(t.Context(), definition); err != nil {
+		t.Fatalf("Upsert() error = %v", err)
+	}
+	got, err := store.Get(t.Context(), " pin-beta ")
+	if err != nil {
+		t.Fatalf("Get() error = %v", err)
+	}
+	if got.Methods[0] != "POST" || got.Paths[0] != "/v1/*" || got.When[0].Equals == nil || *got.When[0].Equals != "" {
+		t.Fatalf("Get() = %#v", got)
+	}
+	listed, err := store.List(context.Background())
+	if err != nil || len(listed) != 1 {
+		t.Fatalf("List() = %#v, %v", listed, err)
+	}
+	if err := store.Delete(t.Context(), "pin-beta"); err != nil {
+		t.Fatalf("Delete() error = %v", err)
+	}
+	if _, err := store.Get(t.Context(), "pin-beta"); !errors.Is(err, ErrNotFound) {
+		t.Fatalf("Get() after delete error = %v, want ErrNotFound", err)
+	}
+}
+
+func TestSQLiteStoreUsesDedicatedTable(t *testing.T) {
+	db, err := sql.Open("sqlite", ":memory:")
+	if err != nil {
+		t.Fatalf("sql.Open() error = %v", err)
+	}
+	defer db.Close()
+	if _, err := NewSQLiteStore(t.Context(), db); err != nil {
+		t.Fatalf("NewSQLiteStore() error = %v", err)
+	}
+	var name string
+	if err := db.QueryRow(`SELECT name FROM sqlite_master WHERE type='table' AND name='header_policy_definitions'`).Scan(&name); err != nil {
+		t.Fatalf("dedicated table lookup error = %v", err)
+	}
+	if name != "header_policy_definitions" {
+		t.Fatalf("table = %q", name)
+	}
+}
diff --git a/internal/headerpolicy/types.go b/internal/headerpolicy/types.go
new file mode 100644
index 00000000..e93838a2
--- /dev/null
+++ b/internal/headerpolicy/types.go
@@ -0,0 +1,338 @@
+// Package headerpolicy owns reusable outbound request-header policies.
+package headerpolicy
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"regexp"
+	"slices"
+	"strings"
+	"time"
+
+	"github.com/goccy/go-json"
+
+	"github.com/enterpilot/gomodel/internal/core"
+	"github.com/enterpilot/gomodel/internal/validation"
+)
+
+const (
+	ActionSet    = "set"
+	ActionRemove = "remove"
+)
+
+// ErrNotFound indicates that a requested policy definition does not exist.
+var ErrNotFound = errors.New("header policy not found")
+
+// Condition is one predicate over an inbound request header.
+type Condition struct {
+	Header  string  `json:"header" bson:"header"`
+	Equals  *string `json:"equals,omitempty" bson:"equals,omitempty"`
+	Matches *string `json:"matches,omitempty" bson:"matches,omitempty"`
+	Present *bool   `json:"present,omitempty" bson:"present,omitempty"`
+}
+
+// Action is one outbound request-header mutation.
+type Action struct {
+	Action     string  `json:"action" bson:"action"`
+	Header     string  `json:"header" bson:"header"`
+	Value      *string `json:"value,omitempty" bson:"value,omitempty"`
+	FromHeader string  `json:"from_header,omitempty" bson:"from_header,omitempty"`
+}
+
+// Definition is one persisted, reusable outbound header policy. The policy
+// fields are intentionally top-level in the API instead of hiding behind a
+// guardrail type/config union.
+type Definition struct {
+	Name        string      `json:"name" bson:"name"`
+	Description string      `json:"description,omitempty" bson:"description,omitempty"`
+	Methods     []string    `json:"methods,omitempty" bson:"methods,omitempty"`
+	Paths       []string    `json:"paths,omitempty" bson:"paths,omitempty"`
+	When        []Condition `json:"when,omitempty" bson:"when,omitempty"`
+	Actions     []Action    `json:"actions" bson:"actions"`
+	CreatedAt   time.Time   `json:"created_at" bson:"created_at"`
+	UpdatedAt   time.Time   `json:"updated_at" bson:"updated_at"`
+}
+
+// View is the admin-facing representation of a policy.
+type View struct {
+	Definition
+	Summary string `json:"summary,omitempty"`
+}
+
+// Reference binds a named policy to an ordered workflow step.
+type Reference struct {
+	Ref  string
+	Step int
+}
+
+// Store persists header-policy definitions.
+type Store interface {
+	List(ctx context.Context) ([]Definition, error)
+	Get(ctx context.Context, name string) (*Definition, error)
+	Upsert(ctx context.Context, definition Definition) error
+	UpsertMany(ctx context.Context, definitions []Definition) error
+	Delete(ctx context.Context, name string) error
+	Close() error
+}
+
+// Catalog resolves workflow references into executable policies.
+type Catalog interface {
+	Names() []string
+	BuildHeaderPolicies(steps []Reference) ([]core.HeaderPolicy, error)
+}
+
+// ValidationError identifies invalid policy authoring input.
+type ValidationError = validation.Error
+
+func newValidationError(message string, err error) error {
+	return validation.NewError(message, err)
+}
+
+// IsValidationError reports whether err is an authoring validation error.
+func IsValidationError(err error) bool {
+	return validation.IsError(err)
+}
+
+var headerFieldNameRE = regexp.MustCompile("^[A-Za-z0-9!#$%&'*+.^_`|~-]+$")
+
+func normalizeDefinition(def Definition) (Definition, error) {
+	def.Name = strings.TrimSpace(def.Name)
+	def.Description = strings.TrimSpace(def.Description)
+	if def.Name == "" {
+		return Definition{}, newValidationError("header policy name is required", nil)
+	}
+	if strings.Contains(def.Name, "/") {
+		return Definition{}, newValidationError("header policy name cannot contain '/'", nil)
+	}
+	var err error
+	def.Methods, err = normalizeMethods(def.Methods)
+	if err != nil {
+		return Definition{}, err
+	}
+	def.Paths, err = normalizePaths(def.Paths)
+	if err != nil {
+		return Definition{}, err
+	}
+	for i := range def.When {
+		def.When[i], err = normalizeCondition(def.When[i], i)
+		if err != nil {
+			return Definition{}, err
+		}
+	}
+	if len(def.Actions) == 0 {
+		return Definition{}, newValidationError("header policy requires at least one action", nil)
+	}
+	for i := range def.Actions {
+		def.Actions[i], err = normalizeAction(def.Actions[i], i)
+		if err != nil {
+			return Definition{}, err
+		}
+	}
+	return def, nil
+}
+
+func normalizeMethods(methods []string) ([]string, error) {
+	result := make([]string, 0, len(methods))
+	for _, method := range methods {
+		method = strings.ToUpper(strings.TrimSpace(method))
+		if method != "" && !headerFieldNameRE.MatchString(method) {
+			return nil, newValidationError("invalid header policy HTTP method: "+method, nil)
+		}
+		if method != "" && !slices.Contains(result, method) {
+			result = append(result, method)
+		}
+	}
+	return result, nil
+}
+
+func normalizePaths(paths []string) ([]string, error) {
+	result := make([]string, 0, len(paths))
+	for _, path := range paths {
+		path = strings.TrimSpace(path)
+		if path == "" {
+			continue
+		}
+		if !strings.HasPrefix(path, "/") {
+			return nil, newValidationError("header policy path must start with '/': "+path, nil)
+		}
+		if strings.Count(path, "*") > 1 || (strings.Contains(path, "*") && !strings.HasSuffix(path, "*")) {
+			return nil, newValidationError("header policy path wildcard is only allowed as a trailing '*': "+path, nil)
+		}
+		if !slices.Contains(result, path) {
+			result = append(result, path)
+		}
+	}
+	return result, nil
+}
+
+func normalizeCondition(condition Condition, index int) (Condition, error) {
+	header, err := normalizeRuleHeaderName(condition.Header)
+	if err != nil {
+		return Condition{}, newValidationError(fmt.Sprintf("header policy condition #%d: %s", index+1, err.Error()), nil)
+	}
+	condition.Header = header
+	if condition.Equals != nil && condition.Matches != nil {
+		return Condition{}, newValidationError(fmt.Sprintf("header policy condition #%d (%s): equals and matches are mutually exclusive", index+1, header), nil)
+	}
+	if (condition.Equals != nil || condition.Matches != nil) && condition.Present != nil && !*condition.Present {
+		return Condition{}, newValidationError(fmt.Sprintf("header policy condition #%d (%s): present=false cannot be combined with equals or matches", index+1, header), nil)
+	}
+	if condition.Matches != nil {
+		if _, err := regexp.Compile(*condition.Matches); err != nil {
+			return Condition{}, newValidationError(fmt.Sprintf("header policy condition #%d (%s): invalid matches regex: %s", index+1, header, err.Error()), err)
+		}
+	}
+	return condition, nil
+}
+
+func normalizeAction(action Action, index int) (Action, error) {
+	action.Action = strings.ToLower(strings.TrimSpace(action.Action))
+	header, err := normalizeRuleHeaderName(action.Header)
+	if err != nil {
+		return Action{}, newValidationError(fmt.Sprintf("header policy action #%d: %s", index+1, err.Error()), nil)
+	}
+	action.Header = header
+	action.FromHeader = strings.TrimSpace(action.FromHeader)
+	switch action.Action {
+	case ActionSet:
+		if action.Value != nil && action.FromHeader != "" {
+			return Action{}, newValidationError(fmt.Sprintf("header policy action #%d (%s): value and from_header are mutually exclusive", index+1, header), nil)
+		}
+		if action.Value == nil && action.FromHeader == "" {
+			return Action{}, newValidationError(fmt.Sprintf("header policy action #%d (%s): set requires value or from_header", index+1, header), nil)
+		}
+		if action.FromHeader != "" {
+			action.FromHeader, err = normalizeRuleHeaderName(action.FromHeader)
+			if err != nil {
+				return Action{}, newValidationError(fmt.Sprintf("header policy action #%d (%s): from_header: %s", index+1, header, err.Error()), nil)
+			}
+		}
+	case ActionRemove:
+		if action.Value != nil || action.FromHeader != "" {
+			return Action{}, newValidationError(fmt.Sprintf("header policy action #%d (%s): remove takes no value", index+1, header), nil)
+		}
+	case "":
+		return Action{}, newValidationError(fmt.Sprintf("header policy action #%d (%s): action is required (set or remove)", index+1, header), nil)
+	default:
+		return Action{}, newValidationError(fmt.Sprintf("header policy action #%d (%s): unknown action %q (want set or remove)", index+1, header, action.Action), nil)
+	}
+	return action, nil
+}
+
+func normalizeRuleHeaderName(name string) (string, error) {
+	name = strings.TrimSpace(name)
+	if name == "" {
+		return "", fmt.Errorf("header name is required")
+	}
+	if !headerFieldNameRE.MatchString(name) {
+		return "", fmt.Errorf("invalid header name %q", name)
+	}
+	// These names are covered by IsProtectedHeader too, but get a specific
+	// authoring error because overriding them breaks body parsing or transport
+	// decompression rather than exposing credentials.
+	switch strings.ToLower(name) {
+	case "accept-encoding", "content-encoding", "content-type":
+		return "", fmt.Errorf("header %q controls payload encoding or media type and cannot be used in header policies", name)
+	}
+	if core.IsProtectedHeader(name) {
+		return "", fmt.Errorf("header %q carries credentials or transport state and cannot be used in header policies", name)
+	}
+	return http.CanonicalHeaderKey(name), nil
+}
+
+// ViewFromDefinition projects a definition with a compact action summary.
+func ViewFromDefinition(def Definition) View {
+	return View{Definition: cloneDefinition(def), Summary: summarize(def)}
+}
+
+func summarize(def Definition) string {
+	parts := make([]string, 0, len(def.Actions))
+	for _, action := range def.Actions {
+		parts = append(parts, action.Action+" "+action.Header)
+	}
+	summary := strings.Join(parts, ", ")
+	const maxLen = 72
+	if len(summary) > maxLen {
+		summary = summary[:maxLen-3] + "..."
+	}
+	switch len(def.When) {
+	case 0:
+		return "always • " + summary
+	case 1:
+		return "1 condition • " + summary
+	default:
+		return fmt.Sprintf("%d conditions • %s", len(def.When), summary)
+	}
+}
+
+func cloneDefinition(def Definition) Definition {
+	copy := def
+	copy.Methods = append([]string(nil), def.Methods...)
+	copy.Paths = append([]string(nil), def.Paths...)
+	copy.When = append([]Condition(nil), def.When...)
+	copy.Actions = append([]Action(nil), def.Actions...)
+	for i := range copy.When {
+		if copy.When[i].Equals != nil {
+			value := *copy.When[i].Equals
+			copy.When[i].Equals = &value
+		}
+		if copy.When[i].Matches != nil {
+			value := *copy.When[i].Matches
+			copy.When[i].Matches = &value
+		}
+		if copy.When[i].Present != nil {
+			value := *copy.When[i].Present
+			copy.When[i].Present = &value
+		}
+	}
+	for i := range copy.Actions {
+		if copy.Actions[i].Value != nil {
+			value := *copy.Actions[i].Value
+			copy.Actions[i].Value = &value
+		}
+	}
+	return copy
+}
+
+type legacyConfig struct {
+	Methods   []string    `json:"methods,omitempty"`
+	Endpoints []string    `json:"endpoints,omitempty"`
+	When      []Condition `json:"when,omitempty"`
+	Actions   []Action    `json:"actions"`
+}
+
+// DefinitionFromLegacy converts a historical guardrail header_modification
+// payload into the dedicated header-policy definition shape.
+func DefinitionFromLegacy(name, description string, raw json.RawMessage) (Definition, error) {
+	if len(bytes.TrimSpace(raw)) == 0 {
+		raw = []byte(`{}`)
+	}
+	var legacy legacyConfig
+	decoder := json.NewDecoder(bytes.NewReader(raw))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(&legacy); err != nil {
+		return Definition{}, newValidationError("invalid legacy header_modification config: "+err.Error(), err)
+	}
+	if err := decoder.Decode(&struct{}{}); !errors.Is(err, io.EOF) {
+		return Definition{}, newValidationError("invalid legacy header_modification config: trailing data", nil)
+	}
+	return normalizeDefinition(Definition{
+		Name: name, Description: description, Methods: legacy.Methods,
+		Paths: legacy.Endpoints, When: legacy.When, Actions: legacy.Actions,
+	})
+}
+
+// NormalizeLegacyConfig validates and canonicalizes a historical config while
+// it remains readable from the guardrail definition store.
+func NormalizeLegacyConfig(raw json.RawMessage) (json.RawMessage, error) {
+	def, err := DefinitionFromLegacy("legacy", "", raw)
+	if err != nil {
+		return nil, err
+	}
+	legacy := legacyConfig{Methods: def.Methods, Endpoints: def.Paths, When: def.When, Actions: def.Actions}
+	return json.Marshal(legacy)
+}
diff --git a/internal/llmclient/client.go b/internal/llmclient/client.go
index 8895aa96..a02b20e2 100644
--- a/internal/llmclient/client.go
+++ b/internal/llmclient/client.go
@@ -770,6 +770,10 @@ func (c *Client) buildRequest(ctx context.Context, req Request) (*http.Request,
 		}
 	}
 
+	// Apply the resolved egress plan after provider defaults. Protected
+	// credentials, framing, and payload metadata remain provider-owned.
+	core.HeaderPlanFromContext(ctx).Apply(httpReq.Header)
+
 	return httpReq, nil
 }
 
diff --git a/internal/llmclient/client_test.go b/internal/llmclient/client_test.go
index 03b1d421..761eb6cb 100644
--- a/internal/llmclient/client_test.go
+++ b/internal/llmclient/client_test.go
@@ -116,6 +116,45 @@ func TestClient_Do_Headers(t *testing.T) {
 	}
 }
 
+func TestBuildRequestAppliesHeaderPlanLastWithoutTouchingCredentials(t *testing.T) {
+	client := New(
+		DefaultConfig("test", "http://localhost"),
+		func(req *http.Request) {
+			req.Header.Set("Authorization", "Bearer provider-key")
+			req.Header.Set("X-Order", "provider-default")
+		},
+	)
+	ctx := core.WithHeaderPlan(t.Context(), &core.HeaderPlan{
+		Set: map[string]string{
+			"X-Order":       "operator-rule",
+			"X-Added":       "applied",
+			"Authorization": "Bearer attacker",
+		},
+	})
+
+	req, err := client.buildRequest(ctx, Request{
+		Method:   http.MethodPost,
+		Endpoint: "/test",
+		Body:     map[string]string{"input": "hi"},
+		Headers:  http.Header{"X-Order": []string{"request-specific"}},
+	})
+	if err != nil {
+		t.Fatalf("buildRequest() error = %v", err)
+	}
+	if got := req.Header.Get("X-Order"); got != "operator-rule" {
+		t.Fatalf("X-Order = %q, want mutation to apply after provider and request headers", got)
+	}
+	if got := req.Header.Get("X-Added"); got != "applied" {
+		t.Fatalf("X-Added = %q, want applied", got)
+	}
+	if got := req.Header.Get("Authorization"); got != "Bearer provider-key" {
+		t.Fatalf("Authorization = %q, want provider credential preserved", got)
+	}
+	if got := req.Header.Get("Content-Type"); got != "application/json" {
+		t.Fatalf("Content-Type = %q, want builder-owned media type preserved", got)
+	}
+}
+
 func TestClient_Do_ErrorParsing(t *testing.T) {
 	tests := []struct {
 		name       string
diff --git a/internal/mcpgateway/service_test.go b/internal/mcpgateway/service_test.go
index f8355e96..81b4da32 100644
--- a/internal/mcpgateway/service_test.go
+++ b/internal/mcpgateway/service_test.go
@@ -531,19 +531,23 @@ func TestDownstreamCapabilitiesDoNotPromiseListChanged(t *testing.T) {
 
 func TestUpstreamHeadersStayOnConfiguredOrigin(t *testing.T) {
 	var redirectedHeader string
+	var redirectedPolicyHeader string
 	redirectTarget := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		redirectedHeader = r.Header.Get("Authorization")
+		redirectedPolicyHeader = r.Header.Get("X-Workflow-Policy")
 		w.WriteHeader(http.StatusNoContent)
 	}))
 	defer redirectTarget.Close()
 
 	var sameOriginHeader string
+	var sameOriginPolicyHeader string
 	origin := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path == "/redirect" {
 			http.Redirect(w, r, redirectTarget.URL, http.StatusTemporaryRedirect)
 			return
 		}
 		sameOriginHeader = r.Header.Get("Authorization")
+		sameOriginPolicyHeader = r.Header.Get("X-Workflow-Policy")
 		w.WriteHeader(http.StatusNoContent)
 	}))
 	defer origin.Close()
@@ -553,12 +557,21 @@ func TestUpstreamHeadersStayOnConfiguredOrigin(t *testing.T) {
 		Headers: map[string]string{"Authorization": "Bearer upstream-secret"},
 	}, http.DefaultClient)
 	client := u.httpClientWithHeaders()
-	resp, err := client.Get(origin.URL + "/same-origin")
+	ctx := core.WithHeaderPlan(t.Context(), &core.HeaderPlan{Set: map[string]string{"X-Workflow-Policy": "applied"}})
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, origin.URL+"/same-origin", nil)
+	if err != nil {
+		t.Fatalf("build same-origin request: %v", err)
+	}
+	resp, err := client.Do(req)
 	if err != nil {
 		t.Fatalf("same-origin request error = %v", err)
 	}
 	_ = resp.Body.Close()
-	resp, err = client.Get(origin.URL + "/redirect")
+	req, err = http.NewRequestWithContext(ctx, http.MethodGet, origin.URL+"/redirect", nil)
+	if err != nil {
+		t.Fatalf("build redirect request: %v", err)
+	}
+	resp, err = client.Do(req)
 	if err != nil {
 		t.Fatalf("redirected request error = %v", err)
 	}
@@ -569,6 +582,12 @@ func TestUpstreamHeadersStayOnConfiguredOrigin(t *testing.T) {
 	if redirectedHeader != "" {
 		t.Fatalf("cross-origin Authorization = %q, want empty", redirectedHeader)
 	}
+	if sameOriginPolicyHeader != "applied" {
+		t.Fatalf("same-origin policy header = %q, want applied", sameOriginPolicyHeader)
+	}
+	if redirectedPolicyHeader != "" {
+		t.Fatalf("cross-origin policy header = %q, want empty", redirectedPolicyHeader)
+	}
 }
 
 func TestDegradedUpstreamKeepsCatalogAndReportsError(t *testing.T) {
diff --git a/internal/mcpgateway/upstream.go b/internal/mcpgateway/upstream.go
index 11e1b7e1..925ec102 100644
--- a/internal/mcpgateway/upstream.go
+++ b/internal/mcpgateway/upstream.go
@@ -17,6 +17,7 @@ import (
 
 	"github.com/modelcontextprotocol/go-sdk/mcp"
 
+	"github.com/enterpilot/gomodel/internal/core"
 	"github.com/enterpilot/gomodel/internal/version"
 )
 
@@ -229,9 +230,6 @@ func (u *upstream) httpClientWithHeaders() *http.Client {
 	if base == nil {
 		base = http.DefaultClient
 	}
-	if len(u.spec.Headers) == 0 {
-		return base
-	}
 	clone := *base
 	transport := base.Transport
 	if transport == nil {
@@ -254,6 +252,10 @@ type headerRoundTripper struct {
 func (t *headerRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
 	clone := req.Clone(req.Context())
 	if t.origin != "" && requestOrigin(req.URL.String()) == t.origin {
+		// The downstream workflow's resolved plan may target MCP egress too.
+		// Apply it only on the configured origin, then overlay the upstream's
+		// static credentials so redirects cannot receive either policy or auth.
+		core.HeaderPlanFromContext(req.Context()).Apply(clone.Header)
 		for key, value := range t.headers {
 			clone.Header.Set(key, value)
 		}
diff --git a/internal/responsecache/exact_cache_test.go b/internal/responsecache/exact_cache_test.go
index a934bd93..ed62b77c 100644
--- a/internal/responsecache/exact_cache_test.go
+++ b/internal/responsecache/exact_cache_test.go
@@ -26,6 +26,15 @@ type concurrentTrackingStore struct {
 	releaseCh     chan struct{}
 }
 
+func TestHashRequest_VariesOnResolvedHeaderPlan(t *testing.T) {
+	body := []byte(`{"model":"gpt-4o","messages":[{"role":"user","content":"hi"}]}`)
+	first := hashRequest("/v1/chat/completions", body, nil, &core.HeaderPlan{Set: map[string]string{"X-Tenant": "one"}})
+	second := hashRequest("/v1/chat/completions", body, nil, &core.HeaderPlan{Set: map[string]string{"X-Tenant": "two"}})
+	if first == second {
+		t.Fatal("exact cache key did not vary on the effective header plan")
+	}
+}
+
 func newConcurrentTrackingStore() *concurrentTrackingStore {
 	return &concurrentTrackingStore{
 		enterCh:   make(chan struct{}, 1024),
@@ -173,13 +182,13 @@ func TestHashRequest_ResolvedModelChangesKey(t *testing.T) {
 		Resolution: &core.RequestModelResolution{
 			ResolvedSelector: core.ModelSelector{Provider: "openai", Model: "gpt-5-nano"},
 		},
-	})
+	}, nil)
 	second := hashRequest("/v1/chat/completions", body, &core.Workflow{
 		Mode: core.ExecutionModeTranslated,
 		Resolution: &core.RequestModelResolution{
 			ResolvedSelector: core.ModelSelector{Provider: "anthropic", Model: "claude-opus-4-6"},
 		},
-	})
+	}, nil)
 
 	if first == second {
 		t.Fatal("resolved model should affect cache key")
@@ -191,10 +200,10 @@ func TestHashRequest_ModeChangesKey(t *testing.T) {
 
 	first := hashRequest("/v1/chat/completions", body, &core.Workflow{
 		Mode: core.ExecutionModeTranslated,
-	})
+	}, nil)
 	second := hashRequest("/v1/chat/completions", body, &core.Workflow{
 		Mode: core.ExecutionModePassthrough,
-	})
+	}, nil)
 
 	if first == second {
 		t.Fatal("execution mode should affect cache key")
@@ -212,8 +221,8 @@ func TestHashRequest_StreamIncludeUsageChangesKey(t *testing.T) {
 		},
 	}
 
-	first := hashRequest("/v1/chat/completions", base, plan)
-	second := hashRequest("/v1/chat/completions", withUsage, plan)
+	first := hashRequest("/v1/chat/completions", base, plan, nil)
+	second := hashRequest("/v1/chat/completions", withUsage, plan, nil)
 
 	if first == second {
 		t.Fatal("stream_options.include_usage should affect the exact cache key")
@@ -231,8 +240,8 @@ func TestHashRequest_StreamModeChangesKey(t *testing.T) {
 		},
 	}
 
-	first := hashRequest("/v1/chat/completions", base, plan)
-	second := hashRequest("/v1/chat/completions", streaming, plan)
+	first := hashRequest("/v1/chat/completions", base, plan, nil)
+	second := hashRequest("/v1/chat/completions", streaming, plan, nil)
 
 	if first == second {
 		t.Fatal("stream mode should affect the exact cache key")
diff --git a/internal/responsecache/semantic.go b/internal/responsecache/semantic.go
index 8b0bd012..b4a98548 100644
--- a/internal/responsecache/semantic.go
+++ b/internal/responsecache/semantic.go
@@ -141,10 +141,12 @@ func (m *semanticCacheMiddleware) Handle(ex exchange, body []byte, next func() e
 	if !fpOK {
 		return next()
 	}
-	baseParams := computeParamsHash(body, path, plan, core.GetGuardrailsHash(ctx), m.embedderIdentity)
+	baseParams := computeParamsHash(body, path, plan, core.GetGuardrailsHash(ctx), m.embedderIdentity, core.HeaderPlanFromContext(ctx))
 	paramsHash := sha256HexOf(baseParams + "\x00" + msgFp)
 
-	vec, err := m.embedder.Embed(ctx, embedText)
+	// Semantic embeddings are auxiliary calls and may use a provider unrelated
+	// to the user's route, so request-scoped outbound header rules do not apply.
+	vec, err := m.embedder.Embed(core.WithoutHeaderPlan(ctx), embedText)
 	if err != nil {
 		slog.Warn("semantic cache: embed failed, bypassing", "err", err)
 		return next()
@@ -433,7 +435,7 @@ func extractTextFromContent(content any) string {
 // This ensures semantically similar prompts with different parameters or guardrail
 // policies never share a cache entry. endpointPath is the raw URL path
 // (e.g. "/v1/chat/completions") and isolates entries across distinct endpoints.
-func computeParamsHash(body []byte, endpointPath string, plan *core.Workflow, guardrailsHash, embedderIdentity string) string {
+func computeParamsHash(body []byte, endpointPath string, plan *core.Workflow, guardrailsHash, embedderIdentity string, headerPlan *core.HeaderPlan) string {
 	var req struct {
 		Model           string              `json:"model"`
 		Temperature     *float64            `json:"temperature"`
@@ -524,6 +526,8 @@ func computeParamsHash(body []byte, endpointPath string, plan *core.Workflow, gu
 
 	h.Write([]byte(guardrailsHash))
 	h.Write([]byte{0})
+	h.Write([]byte(headerPlan.CacheFingerprint()))
+	h.Write([]byte{0})
 	h.Write([]byte(embedderIdentity))
 
 	return hex.EncodeToString(h.Sum(nil))
diff --git a/internal/responsecache/semantic_extract_test.go b/internal/responsecache/semantic_extract_test.go
index efd06392..073d2bb1 100644
--- a/internal/responsecache/semantic_extract_test.go
+++ b/internal/responsecache/semantic_extract_test.go
@@ -49,8 +49,8 @@ func TestConversationInvariantFingerprint_InputString(t *testing.T) {
 func TestComputeParamsHash_IncludesReasoning(t *testing.T) {
 	low := []byte(`{"model":"m","reasoning":{"effort":"low"}}`)
 	high := []byte(`{"model":"m","reasoning":{"effort":"high"}}`)
-	h1 := computeParamsHash(low, "/v1/responses", nil, "", "embed")
-	h2 := computeParamsHash(high, "/v1/responses", nil, "", "embed")
+	h1 := computeParamsHash(low, "/v1/responses", nil, "", "embed", nil)
+	h2 := computeParamsHash(high, "/v1/responses", nil, "", "embed", nil)
 	if h1 == h2 {
 		t.Fatal("expected different params hashes when reasoning differs")
 	}
diff --git a/internal/responsecache/semantic_test.go b/internal/responsecache/semantic_test.go
index b4159973..c358739e 100644
--- a/internal/responsecache/semantic_test.go
+++ b/internal/responsecache/semantic_test.go
@@ -21,10 +21,21 @@ type mockEmbedder struct {
 	vector []float32
 	err    error
 	calls  int
+	ctx    context.Context
 }
 
-func (m *mockEmbedder) Embed(_ context.Context, _ string) ([]float32, error) {
+func TestComputeParamsHash_VariesOnResolvedHeaderPlan(t *testing.T) {
+	body := []byte(`{"model":"gpt-4o","messages":[{"role":"user","content":"hi"}]}`)
+	first := computeParamsHash(body, "/v1/chat/completions", nil, "", "embedder", &core.HeaderPlan{Set: map[string]string{"X-Tenant": "one"}})
+	second := computeParamsHash(body, "/v1/chat/completions", nil, "", "embedder", &core.HeaderPlan{Set: map[string]string{"X-Tenant": "two"}})
+	if first == second {
+		t.Fatal("semantic params hash did not vary on the effective header plan")
+	}
+}
+
+func (m *mockEmbedder) Embed(ctx context.Context, _ string) ([]float32, error) {
 	m.calls++
+	m.ctx = ctx
 	return m.vector, m.err
 }
 
@@ -65,6 +76,31 @@ func serveSemanticRequest(t *testing.T, m *semanticCacheMiddleware, body []byte,
 	return rec
 }
 
+func TestSemanticCacheEmbeddingDoesNotInheritHeaderPlan(t *testing.T) {
+	m, _, emb := newTestSemanticMiddleware(0.9, 20, false)
+	defer func() { _ = m.close() }()
+	body := []byte(`{"model":"gpt-4","messages":[{"role":"user","content":"hello"}]}`)
+	e := echo.New()
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodPost, "/v1/chat/completions", bytes.NewReader(body))
+	req = req.WithContext(core.WithHeaderPlan(req.Context(), &core.HeaderPlan{
+		Set: map[string]string{"X-Outer-Rule": "must-not-leak"},
+	}))
+	c := e.NewContext(req, rec)
+
+	if err := m.Handle(&echoExchange{c: c}, body, func() error {
+		return c.JSON(http.StatusOK, map[string]string{"answer": "42"})
+	}); err != nil {
+		t.Fatalf("Handle() error = %v", err)
+	}
+	if emb.ctx == nil {
+		t.Fatal("embedder context was not captured")
+	}
+	if mutation := core.HeaderPlanFromContext(emb.ctx); mutation != nil {
+		t.Fatalf("semantic embedder inherited outer header mutation: %+v", mutation)
+	}
+}
+
 func TestSemanticCacheMiddleware_CacheHit(t *testing.T) {
 	m, store, _ := newTestSemanticMiddleware(0.90, 10, false)
 	body := []byte(`{"model":"gpt-4","messages":[{"role":"user","content":"What is 2+2?"}]}`)
@@ -218,8 +254,8 @@ func TestComputeParamsHash_StreamIncludeUsageChangesHash(t *testing.T) {
 		},
 	}
 
-	first := computeParamsHash(base, "/v1/chat/completions", plan, "", "")
-	second := computeParamsHash(withUsage, "/v1/chat/completions", plan, "", "")
+	first := computeParamsHash(base, "/v1/chat/completions", plan, "", "", nil)
+	second := computeParamsHash(withUsage, "/v1/chat/completions", plan, "", "", nil)
 
 	if first == second {
 		t.Fatal("stream_options.include_usage should affect semantic params_hash")
@@ -237,8 +273,8 @@ func TestComputeParamsHash_StreamModeChangesHash(t *testing.T) {
 		},
 	}
 
-	first := computeParamsHash(base, "/v1/chat/completions", plan, "", "")
-	second := computeParamsHash(streaming, "/v1/chat/completions", plan, "", "")
+	first := computeParamsHash(base, "/v1/chat/completions", plan, "", "", nil)
+	second := computeParamsHash(streaming, "/v1/chat/completions", plan, "", "", nil)
 
 	if first == second {
 		t.Fatal("stream mode should affect semantic params_hash")
diff --git a/internal/responsecache/simple.go b/internal/responsecache/simple.go
index e2cd176f..ca7e7ef0 100644
--- a/internal/responsecache/simple.go
+++ b/internal/responsecache/simple.go
@@ -68,7 +68,7 @@ func (m *simpleCacheMiddleware) TryHit(ex exchange, body []byte) (bool, error) {
 	}
 	path := ex.Path()
 	plan := core.GetWorkflow(ex.Context())
-	key := hashRequest(path, body, plan)
+	key := hashRequest(path, body, plan, core.HeaderPlanFromContext(ex.Context()))
 	cached, err := m.store.Get(ex.Context(), key)
 	if err != nil {
 		return false, nil
@@ -99,7 +99,7 @@ func (m *simpleCacheMiddleware) StoreAfter(ex exchange, body []byte, next func()
 	}
 	path := ex.Path()
 	plan := core.GetWorkflow(ex.Context())
-	key := hashRequest(path, body, plan)
+	key := hashRequest(path, body, plan, core.HeaderPlanFromContext(ex.Context()))
 
 	data, ok, err := ex.Capture("response cache: failed to capture cacheable response body", next)
 	if err != nil {
@@ -193,18 +193,20 @@ func isStreamingRequestGJSON(path string, body []byte) bool {
 	return result.Bool()
 }
 
-func hashRequest(path string, body []byte, plan *core.Workflow) string {
+func hashRequest(path string, body []byte, workflow *core.Workflow, headerPlan *core.HeaderPlan) string {
 	h := sha256.New()
 	h.Write([]byte(path))
 	h.Write([]byte{0})
-	if plan != nil {
-		h.Write([]byte(plan.Mode))
+	if workflow != nil {
+		h.Write([]byte(workflow.Mode))
 		h.Write([]byte{0})
-		h.Write([]byte(plan.ProviderType))
+		h.Write([]byte(workflow.ProviderType))
 		h.Write([]byte{0})
-		h.Write([]byte(plan.ResolvedQualifiedModel()))
+		h.Write([]byte(workflow.ResolvedQualifiedModel()))
 		h.Write([]byte{0})
 	}
+	h.Write([]byte(headerPlan.CacheFingerprint()))
+	h.Write([]byte{0})
 	h.Write(cacheKeyRequestBody(path, body))
 	return hex.EncodeToString(h.Sum(nil))
 }
diff --git a/internal/server/header_modification.go b/internal/server/header_modification.go
new file mode 100644
index 00000000..f7454def
--- /dev/null
+++ b/internal/server/header_modification.go
@@ -0,0 +1,96 @@
+package server
+
+import (
+	"context"
+	"sort"
+
+	"github.com/labstack/echo/v5"
+
+	"github.com/enterpilot/gomodel/internal/auditlog"
+	"github.com/enterpilot/gomodel/internal/core"
+)
+
+// HeaderPolicyResolver resolves request-scoped outbound policies in execution
+// order. Implemented by the workflows service.
+type HeaderPolicyResolver interface {
+	HeaderPoliciesForContext(ctx context.Context) []core.HeaderPolicy
+}
+
+// HeaderPolicyPlanningMiddleware evaluates outbound header policies after
+// workflow resolution and before any cache lookup. It stores one immutable,
+// fully resolved plan for the primary provider route. Each matching policy is
+// recorded as intended change; the revision is not proof of provider egress.
+func HeaderPolicyPlanningMiddleware(resolver HeaderPolicyResolver, auditLogger auditlog.LoggerInterface) echo.MiddlewareFunc {
+	return func(next echo.HandlerFunc) echo.HandlerFunc {
+		return func(c *echo.Context) error {
+			policies := resolver.HeaderPoliciesForContext(c.Request().Context())
+			if len(policies) == 0 {
+				return next(c)
+			}
+
+			inbound := c.Request().Header
+			input := core.HeaderPolicyInput{
+				Headers: inbound,
+				Method:  c.Request().Method,
+				Path:    c.Request().URL.Path,
+			}
+			merged := &core.HeaderPlan{}
+			for _, policy := range policies {
+				plan := policy.ResolveHeaderPlan(input)
+				if plan.IsZero() {
+					continue
+				}
+				recordHeaderRevision(c, auditLogger, policy.Name(), plan)
+				merged.Merge(plan)
+			}
+
+			if !merged.IsZero() {
+				req := c.Request()
+				c.SetRequest(req.WithContext(core.WithHeaderPlan(req.Context(), merged)))
+			}
+			return next(c)
+		}
+	}
+}
+
+// recordHeaderRevision appends one header-modification entry to the audit
+// trail's request-revision chain. Only the delta is stored. Set values follow
+// the same LOGGING_LOG_HEADERS gate and redaction policy as normal request
+// headers; when value logging is disabled only the set header names are kept.
+// Body fields stay empty because header steps never touch the body.
+func recordHeaderRevision(c *echo.Context, auditLogger auditlog.LoggerInterface, name string, plan *core.HeaderPlan) {
+	if auditLogger == nil {
+		return
+	}
+	cfg := auditLogger.Config()
+	if !cfg.Enabled {
+		return
+	}
+
+	delta := &auditlog.HeaderRevisionSnapshot{}
+	if len(plan.Set) > 0 {
+		if cfg.LogHeaders {
+			values := auditlog.RedactHeaders(plan.Set)
+			for _, header := range plan.SensitiveSet {
+				if _, exists := values[header]; exists {
+					values[header] = auditlog.RedactedHeaderValue
+				}
+			}
+			delta.Set = values
+		} else {
+			names := make([]string, 0, len(plan.Set))
+			for header := range plan.Set {
+				names = append(names, header)
+			}
+			sort.Strings(names)
+			delta.Set = names
+		}
+	}
+	if len(plan.Remove) > 0 {
+		delta.Removed = append([]string(nil), plan.Remove...)
+	}
+	auditlog.EnrichEntryWithRequestRevision(c, auditlog.RequestRevisionSnapshot{
+		Rewriter: name,
+		Headers:  delta,
+	})
+}
diff --git a/internal/server/header_modification_test.go b/internal/server/header_modification_test.go
new file mode 100644
index 00000000..85b242a4
--- /dev/null
+++ b/internal/server/header_modification_test.go
@@ -0,0 +1,248 @@
+package server
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/labstack/echo/v5"
+
+	"github.com/enterpilot/gomodel/internal/auditlog"
+	"github.com/enterpilot/gomodel/internal/core"
+)
+
+type stubHeaderPolicy struct {
+	name     string
+	mutation *core.HeaderPlan
+	seen     http.Header
+}
+
+func (m *stubHeaderPolicy) Name() string { return m.name }
+
+func (m *stubHeaderPolicy) ResolveHeaderPlan(input core.HeaderPolicyInput) *core.HeaderPlan {
+	m.seen = input.Headers
+	return m.mutation
+}
+
+type stubHeaderPolicyResolver struct {
+	mutators []core.HeaderPolicy
+}
+
+func (r *stubHeaderPolicyResolver) HeaderPoliciesForContext(context.Context) []core.HeaderPolicy {
+	return r.mutators
+}
+
+func runHeaderModificationMiddleware(t *testing.T, resolver HeaderPolicyResolver, auditLogger auditlog.LoggerInterface, entry *auditlog.LogEntry) (*core.HeaderPlan, *auditlog.LogEntry) {
+	t.Helper()
+
+	e := echo.New()
+	req := httptest.NewRequest(http.MethodPost, "/v1/chat/completions", nil)
+	req.Header.Set("User-Agent", "cline/3.2")
+	rec := httptest.NewRecorder()
+	c := e.NewContext(req, rec)
+	if entry != nil {
+		c.Set(string(auditlog.LogEntryKey), entry)
+	}
+
+	var carried *core.HeaderPlan
+	handler := HeaderPolicyPlanningMiddleware(resolver, auditLogger)(func(c *echo.Context) error {
+		carried = core.HeaderPlanFromContext(c.Request().Context())
+		return nil
+	})
+	if err := handler(c); err != nil {
+		t.Fatalf("middleware failed: %v", err)
+	}
+	return carried, entry
+}
+
+func TestHeaderModificationMiddlewareMergesAndRecords(t *testing.T) {
+	first := &stubHeaderPolicy{
+		name:     "pin-beta",
+		mutation: &core.HeaderPlan{Set: map[string]string{"Anthropic-Beta": "context-1m"}},
+	}
+	skipped := &stubHeaderPolicy{name: "no-match"}
+	second := &stubHeaderPolicy{
+		name:     "strip-debug",
+		mutation: &core.HeaderPlan{Remove: []string{"X-Debug"}},
+	}
+	resolver := &stubHeaderPolicyResolver{mutators: []core.HeaderPolicy{first, skipped, second}}
+	auditLogger := &capturingAuditLogger{config: auditlog.Config{Enabled: true, LogHeaders: true}}
+	entry := &auditlog.LogEntry{}
+
+	carried, entry := runHeaderModificationMiddleware(t, resolver, auditLogger, entry)
+
+	if carried == nil {
+		t.Fatal("expected merged mutation in context")
+	}
+	if carried.Set["Anthropic-Beta"] != "context-1m" || len(carried.Remove) != 1 || carried.Remove[0] != "X-Debug" {
+		t.Fatalf("unexpected merged mutation: %+v", carried)
+	}
+	if first.seen.Get("User-Agent") != "cline/3.2" {
+		t.Fatal("mutators must receive the inbound headers")
+	}
+
+	revisions := entry.Data.RequestRevisions
+	if len(revisions) != 2 {
+		t.Fatalf("expected 2 revisions (matched steps only), got %d", len(revisions))
+	}
+	if revisions[0].Rewriter != "pin-beta" || revisions[1].Rewriter != "strip-debug" {
+		t.Fatalf("unexpected revision names: %+v", revisions)
+	}
+	if revisions[0].Seq != 1 || revisions[1].Seq != 2 {
+		t.Fatalf("unexpected revision sequence: %+v", revisions)
+	}
+	if revisions[0].Headers == nil {
+		t.Fatal("first revision must record a header delta")
+	}
+	setValues, ok := revisions[0].Headers.Set.(map[string]string)
+	if !ok || setValues["Anthropic-Beta"] != "context-1m" {
+		t.Fatalf("first revision must record the set delta: %+v", revisions[0].Headers)
+	}
+	if revisions[0].Body != nil {
+		t.Fatal("header revisions must not carry a body")
+	}
+	if revisions[1].Headers == nil || len(revisions[1].Headers.Removed) != 1 || revisions[1].Headers.Removed[0] != "X-Debug" {
+		t.Fatalf("second revision must record the removed delta: %+v", revisions[1].Headers)
+	}
+}
+
+func TestHeaderModificationMiddlewareRecordsNamesOnlyWhenHeaderLoggingDisabled(t *testing.T) {
+	resolver := &stubHeaderPolicyResolver{mutators: []core.HeaderPolicy{
+		&stubHeaderPolicy{
+			name: "inject-secret",
+			mutation: &core.HeaderPlan{
+				Set:    map[string]string{"X-Custom-Auth": "literal-secret", "Anthropic-Beta": "context-1m"},
+				Remove: []string{"X-Internal-Debug"},
+			},
+		},
+	}}
+	entry := &auditlog.LogEntry{}
+	auditLogger := &capturingAuditLogger{config: auditlog.Config{Enabled: true, LogHeaders: false}}
+
+	_, entry = runHeaderModificationMiddleware(t, resolver, auditLogger, entry)
+
+	revision := entry.Data.RequestRevisions[0]
+	names, ok := revision.Headers.Set.([]string)
+	if !ok {
+		t.Fatalf("set delta type = %T, want []string", revision.Headers.Set)
+	}
+	if len(names) != 2 || names[0] != "Anthropic-Beta" || names[1] != "X-Custom-Auth" {
+		t.Fatalf("set names = %v, want sorted names only", names)
+	}
+	if len(revision.Headers.Removed) != 1 || revision.Headers.Removed[0] != "X-Internal-Debug" {
+		t.Fatalf("removed names = %v", revision.Headers.Removed)
+	}
+	encoded, err := json.Marshal(revision.Headers)
+	if err != nil {
+		t.Fatalf("marshal name-only delta: %v", err)
+	}
+	if got, want := string(encoded), `{"set":["Anthropic-Beta","X-Custom-Auth"],"removed":["X-Internal-Debug"]}`; got != want {
+		t.Fatalf("encoded name-only delta = %s, want %s", got, want)
+	}
+}
+
+func TestHeaderModificationMiddlewareRedactsValuesWhenHeaderLoggingEnabled(t *testing.T) {
+	resolver := &stubHeaderPolicyResolver{mutators: []core.HeaderPolicy{
+		&stubHeaderPolicy{
+			name: "defense-in-depth",
+			mutation: &core.HeaderPlan{Set: map[string]string{
+				"X-Api-Key":       "secret",
+				"X-Feature":       "visible",
+				"X-Session-Token": "also-secret",
+			}},
+		},
+	}}
+	entry := &auditlog.LogEntry{}
+	auditLogger := &capturingAuditLogger{config: auditlog.Config{Enabled: true, LogHeaders: true}}
+
+	_, entry = runHeaderModificationMiddleware(t, resolver, auditLogger, entry)
+
+	values, ok := entry.Data.RequestRevisions[0].Headers.Set.(map[string]string)
+	if !ok {
+		t.Fatalf("set delta type = %T, want map[string]string", entry.Data.RequestRevisions[0].Headers.Set)
+	}
+	if values["X-Api-Key"] != "[REDACTED]" || values["X-Session-Token"] != "[REDACTED]" || values["X-Feature"] != "visible" {
+		t.Fatalf("unexpected redacted values: %v", values)
+	}
+}
+
+func TestHeaderModificationMiddlewareRedactsValueCopiedFromSensitiveSource(t *testing.T) {
+	resolver := &stubHeaderPolicyResolver{mutators: []core.HeaderPolicy{
+		&stubHeaderPolicy{
+			name: "copy-session",
+			mutation: &core.HeaderPlan{
+				Set:          map[string]string{"X-Team": "secret-session-token"},
+				SensitiveSet: []string{"X-Team"},
+			},
+		},
+	}}
+	entry := &auditlog.LogEntry{}
+	auditLogger := &capturingAuditLogger{config: auditlog.Config{Enabled: true, LogHeaders: true}}
+	_, entry = runHeaderModificationMiddleware(t, resolver, auditLogger, entry)
+	values := entry.Data.RequestRevisions[0].Headers.Set.(map[string]string)
+	if values["X-Team"] != auditlog.RedactedHeaderValue {
+		t.Fatalf("copied sensitive value was recorded: %v", values)
+	}
+}
+
+func TestHeaderModificationMiddlewareNoMatchLeavesContextUntouched(t *testing.T) {
+	resolver := &stubHeaderPolicyResolver{mutators: []core.HeaderPolicy{&stubHeaderPolicy{name: "no-match"}}}
+	entry := &auditlog.LogEntry{}
+	auditLogger := &capturingAuditLogger{config: auditlog.Config{Enabled: true}}
+
+	carried, entry := runHeaderModificationMiddleware(t, resolver, auditLogger, entry)
+
+	if carried != nil {
+		t.Fatalf("expected no mutation in context, got %+v", carried)
+	}
+	if entry.Data != nil && len(entry.Data.RequestRevisions) != 0 {
+		t.Fatalf("expected no revisions, got %+v", entry.Data.RequestRevisions)
+	}
+}
+
+func TestHeaderModificationMiddlewareAuditDisabled(t *testing.T) {
+	resolver := &stubHeaderPolicyResolver{mutators: []core.HeaderPolicy{
+		&stubHeaderPolicy{name: "pin", mutation: &core.HeaderPlan{Set: map[string]string{"X-A": "1"}}},
+	}}
+	entry := &auditlog.LogEntry{}
+	auditLogger := &capturingAuditLogger{config: auditlog.Config{Enabled: false}}
+
+	carried, entry := runHeaderModificationMiddleware(t, resolver, auditLogger, entry)
+
+	if carried == nil || carried.Set["X-A"] != "1" {
+		t.Fatal("mutation must still apply when audit is disabled")
+	}
+	if entry.Data != nil && len(entry.Data.RequestRevisions) != 0 {
+		t.Fatal("no revisions should be recorded when audit is disabled")
+	}
+}
+
+func TestBuildPassthroughHeadersAppliesMutation(t *testing.T) {
+	src := http.Header{
+		"X-Debug":       []string{"1"},
+		"Accept":        []string{"application/json"},
+		"Authorization": []string{"Bearer secret"},
+	}
+	mutation := &core.HeaderPlan{
+		Set:    map[string]string{"Anthropic-Beta": "context-1m"},
+		Remove: []string{"X-Debug"},
+	}
+	ctx := core.WithHeaderPlan(context.Background(), mutation)
+
+	dst := buildPassthroughHeaders(ctx, src)
+
+	if dst.Get("Anthropic-Beta") != "context-1m" {
+		t.Fatalf("set not applied: %v", dst)
+	}
+	if _, exists := dst["X-Debug"]; exists {
+		t.Fatal("remove not applied")
+	}
+	if dst.Get("Accept") != "application/json" {
+		t.Fatal("unrelated forwarded header lost")
+	}
+	if dst.Get("Authorization") != "" {
+		t.Fatal("credentials must never be forwarded")
+	}
+}
diff --git a/internal/server/http.go b/internal/server/http.go
index 9d78dc06..0489b022 100644
--- a/internal/server/http.go
+++ b/internal/server/http.go
@@ -67,6 +67,7 @@ type Config struct {
 	WorkflowPolicyResolver          RequestWorkflowPolicyResolver          // Optional: persisted workflow resolver used during workflow resolution
 	FailoverResolver                RequestFailoverResolver                // Optional: translated-route failover resolver
 	TranslatedRequestPatcher        TranslatedRequestPatcher               // Optional: request patcher for translated routes after workflow resolution
+	HeaderPolicyResolver            HeaderPolicyResolver                   // Optional: outbound header-policy resolver applied after workflow resolution
 	BatchRequestPreparer            BatchRequestPreparer                   // Optional: batch request preparer before native provider submission
 	ExposedModelLister              ExposedModelLister                     // Optional: additional public models to merge into GET /v1/models
 	KeepOnlyAliasesAtModelsEndpoint bool                                   // Whether GET /v1/models should hide concrete provider models
@@ -339,6 +340,13 @@ func New(provider core.RoutableProvider, cfg *Config) *Server {
 	// still keeping workflow resolution failures loggable through the audit middleware.
 	e.Use(WorkflowResolutionWithResolverAndPolicy(provider, modelResolver, workflowPolicyResolver))
 
+	// Header-modification workflow steps run right after workflow resolution:
+	// they read the inbound headers and stash the outbound header mutation in
+	// context for the translated and passthrough outbound request builders.
+	if cfg != nil && cfg.HeaderPolicyResolver != nil {
+		e.Use(HeaderPolicyPlanningMiddleware(cfg.HeaderPolicyResolver, auditLogger))
+	}
+
 	// Public routes
 	e.GET("/health", handler.Health)
 	e.GET("/health/ready", handler.Ready)
diff --git a/internal/server/internal_chat_completion_executor.go b/internal/server/internal_chat_completion_executor.go
index 2cee1cbf..81ad2662 100644
--- a/internal/server/internal_chat_completion_executor.go
+++ b/internal/server/internal_chat_completion_executor.go
@@ -78,6 +78,10 @@ func (e *InternalChatCompletionExecutor) ChatCompletion(ctx context.Context, req
 	if ctx == nil {
 		ctx = context.Background()
 	}
+	// Header modifications belong only to the user's provider request. Internal
+	// guardrail/cache execution may resolve to another provider and must not
+	// inherit that request-scoped mutation.
+	ctx = core.WithoutHeaderPlan(ctx)
 	ctx = core.WithRequestOrigin(ctx, core.RequestOriginGuardrail)
 	ctx = gateway.WithAttemptRecorder(ctx)
 
diff --git a/internal/server/internal_chat_completion_executor_test.go b/internal/server/internal_chat_completion_executor_test.go
index 7b5f7a4b..0626290e 100644
--- a/internal/server/internal_chat_completion_executor_test.go
+++ b/internal/server/internal_chat_completion_executor_test.go
@@ -79,6 +79,7 @@ func TestInternalChatCompletionExecutor_UsesTranslatedPlanAndAuditMetadata(t *te
 	ctx := core.WithRequestSnapshot(context.Background(), &core.RequestSnapshot{
 		UserPath: "/team/alpha/guardrails/privacy",
 	})
+	ctx = core.WithHeaderPlan(ctx, &core.HeaderPlan{Set: map[string]string{"X-Outer-Rule": "must-not-leak"}})
 	resp, err := executor.ChatCompletion(ctx, &core.ChatRequest{
 		Model: "rewrite-model",
 		Messages: []core.Message{
@@ -104,6 +105,9 @@ func TestInternalChatCompletionExecutor_UsesTranslatedPlanAndAuditMetadata(t *te
 	if origin := core.GetRequestOrigin(provider.capturedCtx); origin != core.RequestOriginGuardrail {
 		t.Fatalf("provider request origin = %q, want %q", origin, core.RequestOriginGuardrail)
 	}
+	if mutation := core.HeaderPlanFromContext(provider.capturedCtx); mutation != nil {
+		t.Fatalf("internal provider call inherited outer header mutation: %+v", mutation)
+	}
 
 	if len(logger.entries) != 1 {
 		t.Fatalf("audit entries = %d, want 1", len(logger.entries))
diff --git a/internal/server/model_validation.go b/internal/server/model_validation.go
index 036d557c..6e51aaa9 100644
--- a/internal/server/model_validation.go
+++ b/internal/server/model_validation.go
@@ -103,6 +103,20 @@ func deriveWorkflowWithPolicy(
 		}
 		return workflow, nil
 
+	case core.OperationRealtime:
+		workflow.Mode = core.ExecutionModeRealtime
+		if err := applyWorkflowPolicy(c.Request().Context(), workflow, policyResolver, core.NewWorkflowSelector("", "", userPath)); err != nil {
+			return nil, err
+		}
+		return workflow, nil
+
+	case core.OperationMCP:
+		workflow.Mode = core.ExecutionModeMCP
+		if err := applyWorkflowPolicy(c.Request().Context(), workflow, policyResolver, core.NewWorkflowSelector("", "", userPath)); err != nil {
+			return nil, err
+		}
+		return workflow, nil
+
 	case core.OperationChatCompletions, core.OperationResponses, core.OperationEmbeddings:
 		workflow.Mode = core.ExecutionModeTranslated
 		resolution, parsed, err := ensureRequestModelResolution(c, provider, resolver)
diff --git a/internal/server/model_validation_test.go b/internal/server/model_validation_test.go
index 694f5456..354f4676 100644
--- a/internal/server/model_validation_test.go
+++ b/internal/server/model_validation_test.go
@@ -54,6 +54,36 @@ func (p *modelCountingValidationProvider) ModelCount() int {
 	return p.modelCount
 }
 
+func TestDeriveWorkflowAppliesPathPolicyToRealtimeAndMCP(t *testing.T) {
+	for _, tt := range []struct {
+		path string
+		mode core.ExecutionMode
+	}{
+		{path: "/v1/realtime", mode: core.ExecutionModeRealtime},
+		{path: "/mcp/github", mode: core.ExecutionModeMCP},
+	} {
+		t.Run(tt.path, func(t *testing.T) {
+			e := echo.New()
+			req := httptest.NewRequest(http.MethodPost, tt.path, nil)
+			req = req.WithContext(core.WithEffectiveUserPath(req.Context(), "/team/alpha"))
+			c := e.NewContext(req, httptest.NewRecorder())
+			resolver := &staticWorkflowPolicyResolver{match: func(selector core.WorkflowSelector) (*core.ResolvedWorkflowPolicy, error) {
+				if selector.UserPath != "/team/alpha" || selector.Provider != "" || selector.Model != "" {
+					t.Fatalf("selector = %+v, want path-only", selector)
+				}
+				return &core.ResolvedWorkflowPolicy{VersionID: "workflow-1", Features: core.DefaultWorkflowFeatures()}, nil
+			}}
+			workflow, err := deriveWorkflowWithPolicy(c, nil, nil, resolver)
+			if err != nil {
+				t.Fatalf("deriveWorkflowWithPolicy() error = %v", err)
+			}
+			if workflow == nil || workflow.Mode != tt.mode || workflow.Policy == nil {
+				t.Fatalf("workflow = %+v, want mode %q with policy", workflow, tt.mode)
+			}
+		})
+	}
+}
+
 func TestModelValidation(t *testing.T) {
 	provider := &mockProvider{
 		supportedModels: []string{"gpt-4o-mini", "text-embedding-3-small", "openai/gpt-oss-120b"},
diff --git a/internal/server/passthrough_support.go b/internal/server/passthrough_support.go
index 1161403c..a7f39116 100644
--- a/internal/server/passthrough_support.go
+++ b/internal/server/passthrough_support.go
@@ -108,6 +108,8 @@ func buildPassthroughHeaders(ctx context.Context, src http.Header) http.Header {
 	if requestID != "" && strings.TrimSpace(dst.Get("X-Request-ID")) == "" {
 		dst.Set("X-Request-ID", requestID)
 	}
+	// Apply the resolved egress plan after safe client-header forwarding.
+	core.HeaderPlanFromContext(ctx).Apply(dst)
 	if len(dst) == 0 {
 		return nil
 	}
diff --git a/internal/server/realtime_service_test.go b/internal/server/realtime_service_test.go
index 58042724..bbe37792 100644
--- a/internal/server/realtime_service_test.go
+++ b/internal/server/realtime_service_test.go
@@ -4,6 +4,8 @@ import (
 	"context"
 	"net/http"
 	"testing"
+
+	"github.com/enterpilot/gomodel/internal/core"
 )
 
 func TestIsWebSocketUpgrade(t *testing.T) {
@@ -47,7 +49,14 @@ func TestRealtimeUpstreamHeaders(t *testing.T) {
 	target := http.Header{}
 	target.Set("Authorization", "Bearer upstream-key")
 
-	got := realtimeUpstreamHeaders(context.Background(), client, target)
+	ctx := core.WithHeaderPlan(context.Background(), &core.HeaderPlan{
+		Set: map[string]string{
+			"X-Custom":      "operator-value",
+			"X-Rule":        "applied",
+			"Authorization": "Bearer attacker",
+		},
+	})
+	got := realtimeUpstreamHeaders(ctx, client, target)
 
 	if got.Get("Authorization") != "Bearer upstream-key" {
 		t.Errorf("Authorization = %q, want injected upstream key", got.Get("Authorization"))
@@ -55,8 +64,11 @@ func TestRealtimeUpstreamHeaders(t *testing.T) {
 	if got.Get("OpenAI-Beta") != "" {
 		t.Errorf("OpenAI-Beta = %q, want stripped (GA endpoint rejects it)", got.Get("OpenAI-Beta"))
 	}
-	if got.Get("X-Custom") != "keep-me" {
-		t.Errorf("X-Custom = %q, want forwarded", got.Get("X-Custom"))
+	if got.Get("X-Custom") != "operator-value" {
+		t.Errorf("X-Custom = %q, want operator mutation", got.Get("X-Custom"))
+	}
+	if got.Get("X-Rule") != "applied" {
+		t.Errorf("X-Rule = %q, want mutation applied", got.Get("X-Rule"))
 	}
 	for key := range got {
 		if len(key) >= 13 && http.CanonicalHeaderKey(key)[:13] == "Sec-Websocket" {
diff --git a/internal/server/realtime_webrtc_service.go b/internal/server/realtime_webrtc_service.go
index 1db701d4..427dc556 100644
--- a/internal/server/realtime_webrtc_service.go
+++ b/internal/server/realtime_webrtc_service.go
@@ -191,6 +191,9 @@ func (s *realtimeService) forwardRealtimeHTTP(ctx context.Context, target *core.
 	if contentType != "" {
 		req.Header.Set("Content-Type", contentType)
 	}
+	// The resolved header plan applies at the final outbound boundary. Protected
+	// provider credentials and the signaling content type remain untouched.
+	core.HeaderPlanFromContext(ctx).Apply(req.Header)
 
 	// The fallback keeps hand-constructed services (tests, embedded wiring)
 	// working, but never with an unbounded client: signaling requests must
diff --git a/internal/server/realtime_webrtc_service_test.go b/internal/server/realtime_webrtc_service_test.go
index 0bf7af66..73cdecfa 100644
--- a/internal/server/realtime_webrtc_service_test.go
+++ b/internal/server/realtime_webrtc_service_test.go
@@ -73,6 +73,53 @@ func newRealtimeTestHandler(mock *realtimeWebRTCMock, usageLogger usage.LoggerIn
 	return handler
 }
 
+func TestForwardRealtimeHTTPAppliesHeaderPlan(t *testing.T) {
+	var got http.Header
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		got = r.Header.Clone()
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer upstream.Close()
+
+	service := &realtimeService{httpClient: upstream.Client()}
+	ctx := core.WithHeaderPlan(t.Context(), &core.HeaderPlan{
+		Set: map[string]string{
+			"X-Order":       "operator-rule",
+			"X-Added":       "applied",
+			"Authorization": "Bearer attacker",
+			"Content-Type":  "text/plain",
+		},
+		Remove: []string{"X-Debug"},
+	})
+	target := &core.RealtimeHTTPTarget{
+		URL: upstream.URL,
+		Headers: http.Header{
+			"Authorization": {"Bearer provider-key"},
+			"X-Order":       {"provider-default"},
+			"X-Debug":       {"remove-me"},
+		},
+	}
+
+	resp, err := service.forwardRealtimeHTTP(ctx, target, strings.NewReader("offer"), "application/sdp", nil, realtimeRoute{providerType: "openai"})
+	if err != nil {
+		t.Fatalf("forwardRealtimeHTTP() error = %v", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	if got.Get("X-Order") != "operator-rule" || got.Get("X-Added") != "applied" {
+		t.Fatalf("header mutation not applied: %v", got)
+	}
+	if got.Get("X-Debug") != "" {
+		t.Fatalf("X-Debug = %q, want removed", got.Get("X-Debug"))
+	}
+	if got.Get("Authorization") != "Bearer provider-key" {
+		t.Fatalf("Authorization = %q, want provider credential preserved", got.Get("Authorization"))
+	}
+	if got.Get("Content-Type") != "application/sdp" {
+		t.Fatalf("Content-Type = %q, want signaling media type preserved", got.Get("Content-Type"))
+	}
+}
+
 func TestRealtimeCalls_SDPHappyPath(t *testing.T) {
 	var upstreamReq struct {
 		contentType string
diff --git a/internal/server/workflow_policy_test.go b/internal/server/workflow_policy_test.go
index 04b5f3d3..d981dfbb 100644
--- a/internal/server/workflow_policy_test.go
+++ b/internal/server/workflow_policy_test.go
@@ -5,8 +5,11 @@ import (
 	"encoding/json"
 	"errors"
 	"net/http"
+	"net/http/httptest"
 	"testing"
 
+	"github.com/labstack/echo/v5"
+
 	"github.com/enterpilot/gomodel/internal/core"
 	"github.com/enterpilot/gomodel/internal/gateway"
 )
@@ -17,6 +20,49 @@ func (f requestWorkflowPolicyResolverFunc) Match(selector core.WorkflowSelector)
 	return f(selector)
 }
 
+func TestDeriveWorkflowWithPolicy_RealtimeAndMCPUseUserPathScope(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name string
+		path string
+		mode core.ExecutionMode
+	}{
+		{name: "realtime", path: "/v1/realtime", mode: core.ExecutionModeRealtime},
+		{name: "mcp", path: "/mcp/github", mode: core.ExecutionModeMCP},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			e := echo.New()
+			req := httptest.NewRequest(http.MethodPost, tt.path, nil)
+			req = req.WithContext(core.WithEffectiveUserPath(req.Context(), "/team/alpha"))
+			c := e.NewContext(req, httptest.NewRecorder())
+			var matched core.WorkflowSelector
+			policy := &core.ResolvedWorkflowPolicy{
+				VersionID: "version-1",
+				Features:  core.WorkflowFeatures{Audit: true, Usage: false, Budget: false},
+			}
+			workflow, err := deriveWorkflowWithPolicy(c, nil, nil, requestWorkflowPolicyResolverFunc(func(selector core.WorkflowSelector) (*core.ResolvedWorkflowPolicy, error) {
+				matched = selector
+				return policy, nil
+			}))
+			if err != nil {
+				t.Fatalf("deriveWorkflowWithPolicy() error = %v", err)
+			}
+			if workflow == nil || workflow.Mode != tt.mode {
+				t.Fatalf("workflow = %+v, want mode %q", workflow, tt.mode)
+			}
+			if matched.Provider != "" || matched.Model != "" || matched.UserPath != "/team/alpha" {
+				t.Fatalf("selector = %+v, want user-path-only selector", matched)
+			}
+			if workflow.Policy != policy || workflow.UsageEnabled() || workflow.BudgetEnabled() {
+				t.Fatalf("matched workflow feature policy was not attached: %+v", workflow.Policy)
+			}
+		})
+	}
+}
+
 type countingBatchResolver struct {
 	calls    int
 	resolved core.ModelSelector
diff --git a/internal/workflows/compiler.go b/internal/workflows/compiler.go
index ee74dc5f..c250ae51 100644
--- a/internal/workflows/compiler.go
+++ b/internal/workflows/compiler.go
@@ -6,23 +6,34 @@ import (
 
 	"github.com/enterpilot/gomodel/internal/core"
 	"github.com/enterpilot/gomodel/internal/guardrails"
+	"github.com/enterpilot/gomodel/internal/headerpolicy"
 )
 
 type compiler struct {
-	registry    guardrails.Catalog
-	featureCaps core.WorkflowFeatures
+	guardrails     guardrails.Catalog
+	headerPolicies headerpolicy.Catalog
+	featureCaps    core.WorkflowFeatures
 }
 
 // NewCompilerWithFeatureCaps creates the default workflow compiler for the
 // v1 payload with process-level feature caps applied at compile time.
 func NewCompilerWithFeatureCaps(registry guardrails.Catalog, featureCaps core.WorkflowFeatures) Compiler {
+	return NewCompilerWithCatalogs(registry, nil, featureCaps)
+}
+
+// NewCompilerWithCatalogs creates a compiler with independently owned message
+// guardrail and outbound header-policy catalogs.
+func NewCompilerWithCatalogs(guardrailCatalog guardrails.Catalog, headerPolicyCatalog headerpolicy.Catalog, featureCaps core.WorkflowFeatures) Compiler {
 	return &compiler{
-		registry:    registry,
+		guardrails: guardrailCatalog, headerPolicies: headerPolicyCatalog,
 		featureCaps: featureCaps,
 	}
 }
 
 func (c *compiler) Compile(version Version) (*CompiledWorkflow, error) {
+	if c == nil {
+		return nil, core.NewProviderError("", http.StatusBadGateway, "workflow compiler is not configured", nil)
+	}
 	features := version.Payload.Features.runtimeFeatures().ApplyUpperBound(c.featureCaps)
 	policy := &core.ResolvedWorkflowPolicy{
 		VersionID:      version.ID,
@@ -36,10 +47,20 @@ func (c *compiler) Compile(version Version) (*CompiledWorkflow, error) {
 		GuardrailsHash: "",
 	}
 
+	legacyHeaderPolicies := make(map[string]struct{})
+	if c.headerPolicies != nil {
+		for _, name := range c.headerPolicies.Names() {
+			legacyHeaderPolicies[name] = struct{}{}
+		}
+	}
+
 	var pipeline *guardrails.Pipeline
 	if policy.Features.Guardrails {
 		steps := make([]guardrails.StepReference, 0, len(version.Payload.Guardrails))
 		for _, step := range version.Payload.Guardrails {
+			if _, legacy := legacyHeaderPolicies[step.Ref]; legacy {
+				continue
+			}
 			steps = append(steps, guardrails.StepReference{
 				Ref:  step.Ref,
 				Step: step.Step,
@@ -53,24 +74,67 @@ func (c *compiler) Compile(version Version) (*CompiledWorkflow, error) {
 		}
 	}
 
+	headerSteps := make([]headerpolicy.Reference, 0, len(version.Payload.HeaderPolicies)+len(version.Payload.Guardrails))
+	seenHeaderPolicies := make(map[string]struct{})
+	for _, step := range version.Payload.HeaderPolicies {
+		headerSteps = append(headerSteps, headerpolicy.Reference{Ref: step.Ref, Step: step.Step})
+		seenHeaderPolicies[step.Ref] = struct{}{}
+	}
+	// Compatibility: workflow versions authored by the preview stored header
+	// policies in guardrails. Compile them into the egress stage, but only when
+	// that legacy workflow enabled guardrails (matching its former behavior).
+	if policy.Features.Guardrails {
+		for _, step := range version.Payload.Guardrails {
+			if _, legacy := legacyHeaderPolicies[step.Ref]; !legacy {
+				continue
+			}
+			if _, duplicate := seenHeaderPolicies[step.Ref]; duplicate {
+				continue
+			}
+			headerSteps = append(headerSteps, headerpolicy.Reference{Ref: step.Ref, Step: step.Step})
+		}
+	}
+	headerPolicies, err := c.compileHeaderPolicies(headerSteps)
+	if err != nil {
+		return nil, err
+	}
+
 	return &CompiledWorkflow{
-		Version:  version,
-		Policy:   policy,
-		Pipeline: pipeline,
+		Version:        version,
+		Policy:         policy,
+		Pipeline:       pipeline,
+		HeaderPolicies: headerPolicies,
 	}, nil
 }
 
+func (c *compiler) compileHeaderPolicies(steps []headerpolicy.Reference) ([]core.HeaderPolicy, error) {
+	if len(steps) == 0 {
+		return nil, nil
+	}
+	if c == nil || c.headerPolicies == nil {
+		return nil, core.NewProviderError("", http.StatusBadGateway, "header policies are configured but no policy catalog is available", nil)
+	}
+	policies, err := c.headerPolicies.BuildHeaderPolicies(steps)
+	if err == nil {
+		return policies, nil
+	}
+	if gatewayErr, ok := errors.AsType[*core.GatewayError](err); ok {
+		return nil, gatewayErr
+	}
+	return nil, core.NewProviderError("", http.StatusBadGateway, "compile header policies: "+err.Error(), err)
+}
+
 func (c *compiler) compileGuardrails(steps []guardrails.StepReference) (*guardrails.Pipeline, string, error) {
 	if len(steps) == 0 {
 		return nil, "", nil
 	}
-	if c == nil || c.registry == nil {
+	if c == nil || c.guardrails == nil {
 		return nil, "", core.NewProviderError("", http.StatusBadGateway, "guardrails are enabled but no guardrail registry is configured", nil)
 	}
-	if c.registry.Len() == 0 {
+	if c.guardrails.Len() == 0 {
 		return nil, "", core.NewProviderError("", http.StatusBadGateway, "guardrails are enabled but no guardrails are loaded", nil)
 	}
-	pipeline, hash, err := c.registry.BuildPipeline(steps)
+	pipeline, hash, err := c.guardrails.BuildPipeline(steps)
 	if err == nil {
 		return pipeline, hash, nil
 	}
diff --git a/internal/workflows/compiler_test.go b/internal/workflows/compiler_test.go
index a0ccbf0e..2fddc910 100644
--- a/internal/workflows/compiler_test.go
+++ b/internal/workflows/compiler_test.go
@@ -2,12 +2,45 @@ package workflows
 
 import (
 	"errors"
+	"fmt"
+	"sort"
 	"testing"
 
 	"github.com/enterpilot/gomodel/internal/core"
 	"github.com/enterpilot/gomodel/internal/guardrails"
+	"github.com/enterpilot/gomodel/internal/headerpolicy"
 )
 
+type compilerHeaderPolicy struct{ name string }
+
+func (p compilerHeaderPolicy) Name() string { return p.name }
+func (p compilerHeaderPolicy) ResolveHeaderPlan(core.HeaderPolicyInput) *core.HeaderPlan {
+	return &core.HeaderPlan{Set: map[string]string{"X-Test": "1"}}
+}
+
+type compilerHeaderCatalog map[string]core.HeaderPolicy
+
+func (c compilerHeaderCatalog) Names() []string {
+	names := make([]string, 0, len(c))
+	for name := range c {
+		names = append(names, name)
+	}
+	sort.Strings(names)
+	return names
+}
+
+func (c compilerHeaderCatalog) BuildHeaderPolicies(steps []headerpolicy.Reference) ([]core.HeaderPolicy, error) {
+	policies := make([]core.HeaderPolicy, 0, len(steps))
+	for _, step := range steps {
+		policy, ok := c[step.Ref]
+		if !ok {
+			return nil, fmt.Errorf("unknown header policy ref: %q", step.Ref)
+		}
+		policies = append(policies, policy)
+	}
+	return policies, nil
+}
+
 func TestCompilerCompile_Guardrails(t *testing.T) {
 	registry := guardrails.NewRegistry()
 	rule, err := guardrails.NewSystemPromptGuardrail("policy-system", guardrails.SystemPromptInject, "be precise")
@@ -55,6 +88,50 @@ func TestCompilerCompile_Guardrails(t *testing.T) {
 	}
 }
 
+func TestCompilerCompile_HeaderPoliciesAreSeparateFromMessagePipeline(t *testing.T) {
+	catalog := compilerHeaderCatalog{"headers": compilerHeaderPolicy{name: "headers"}}
+
+	compiled, err := NewCompilerWithCatalogs(nil, catalog, core.DefaultWorkflowFeatures()).Compile(Version{
+		ID: "workflow-headers",
+		Payload: Payload{
+			SchemaVersion:  1,
+			Features:       FeatureFlags{Guardrails: false},
+			HeaderPolicies: []HeaderPolicyStep{{Ref: "headers", Step: 10}},
+		},
+	})
+	if err != nil {
+		t.Fatalf("Compile() error = %v", err)
+	}
+	if compiled.Pipeline != nil {
+		t.Fatal("header policy was compiled into the message guardrail pipeline")
+	}
+	if len(compiled.HeaderPolicies) != 1 || compiled.HeaderPolicies[0].Name() != "headers" {
+		t.Fatalf("compiled header policies = %#v, want headers", compiled.HeaderPolicies)
+	}
+}
+
+func TestCompilerCompile_LegacyHeaderGuardrailReferenceMigratesAtCompileTime(t *testing.T) {
+	catalog := compilerHeaderCatalog{"headers": compilerHeaderPolicy{name: "headers"}}
+
+	compiled, err := NewCompilerWithCatalogs(nil, catalog, core.DefaultWorkflowFeatures()).Compile(Version{
+		ID: "workflow-legacy",
+		Payload: Payload{
+			SchemaVersion: 1,
+			Features:      FeatureFlags{Guardrails: true},
+			Guardrails:    []GuardrailStep{{Ref: "headers", Step: 10}},
+		},
+	})
+	if err != nil {
+		t.Fatalf("Compile() error = %v", err)
+	}
+	if compiled.Pipeline != nil {
+		t.Fatal("legacy header ref was left in the message guardrail pipeline")
+	}
+	if len(compiled.HeaderPolicies) != 1 {
+		t.Fatalf("len(HeaderPolicies) = %d, want 1", len(compiled.HeaderPolicies))
+	}
+}
+
 func TestCompilerCompile_AppliesProcessFeatureCaps(t *testing.T) {
 	failoverEnabled := true
 	compiled, err := NewCompilerWithFeatureCaps(nil, core.WorkflowFeatures{
diff --git a/internal/workflows/service.go b/internal/workflows/service.go
index 5b031b82..64f77f88 100644
--- a/internal/workflows/service.go
+++ b/internal/workflows/service.go
@@ -23,9 +23,10 @@ const (
 
 // CompiledWorkflow is the immutable runtime projection cached in the hot-path snapshot.
 type CompiledWorkflow struct {
-	Version  Version
-	Policy   *core.ResolvedWorkflowPolicy
-	Pipeline *guardrails.Pipeline
+	Version        Version
+	Policy         *core.ResolvedWorkflowPolicy
+	Pipeline       *guardrails.Pipeline
+	HeaderPolicies []core.HeaderPolicy
 }
 
 // Compiler turns one persisted workflow version into its runtime projection.
@@ -341,6 +342,23 @@ func (s *Service) PipelineForWorkflow(workflow *core.Workflow) *guardrails.Pipel
 	return compiled.Pipeline
 }
 
+// HeaderPoliciesForContext resolves the workflow's outbound attempt policies
+// independently from the message guardrail pipeline.
+func (s *Service) HeaderPoliciesForContext(ctx context.Context) []core.HeaderPolicy {
+	if s == nil || ctx == nil {
+		return nil
+	}
+	workflow := core.GetWorkflow(ctx)
+	if workflow == nil || workflow.Policy == nil {
+		return nil
+	}
+	compiled := s.snapshot().byVersionID[strings.TrimSpace(workflow.Policy.VersionID)]
+	if compiled == nil {
+		return nil
+	}
+	return compiled.HeaderPolicies
+}
+
 // StartBackgroundRefresh periodically reloads active workflows until stopped.
 func (s *Service) StartBackgroundRefresh(interval time.Duration) func() {
 	if interval <= 0 {
@@ -548,8 +566,9 @@ func compiledWorkflowForVersion(compiled *CompiledWorkflow, version Version) *Co
 		return nil
 	}
 	next := &CompiledWorkflow{
-		Version:  version,
-		Pipeline: compiled.Pipeline,
+		Version:        version,
+		Pipeline:       compiled.Pipeline,
+		HeaderPolicies: append([]core.HeaderPolicy(nil), compiled.HeaderPolicies...),
 	}
 	if compiled.Policy != nil {
 		policy := *compiled.Policy
diff --git a/internal/workflows/service_test.go b/internal/workflows/service_test.go
index f6a0a54a..f6463acb 100644
--- a/internal/workflows/service_test.go
+++ b/internal/workflows/service_test.go
@@ -245,6 +245,25 @@ type contextCancelingStore struct {
 	cancelOnDeactivate context.CancelFunc
 }
 
+type projectionHeaderPolicy struct{ name string }
+
+func (p projectionHeaderPolicy) Name() string { return p.name }
+
+func (projectionHeaderPolicy) ResolveHeaderPlan(core.HeaderPolicyInput) *core.HeaderPlan { return nil }
+
+func TestCompiledWorkflowForVersionPreservesHeaderPolicies(t *testing.T) {
+	policy := projectionHeaderPolicy{name: "pin-beta"}
+	projected := compiledWorkflowForVersion(&CompiledWorkflow{
+		Version:        Version{ID: "preview"},
+		Policy:         &core.ResolvedWorkflowPolicy{VersionID: "preview"},
+		HeaderPolicies: []core.HeaderPolicy{policy},
+	}, Version{ID: "persisted", Version: 2})
+
+	if projected == nil || len(projected.HeaderPolicies) != 1 || projected.HeaderPolicies[0].Name() != "pin-beta" {
+		t.Fatalf("projected header policies = %#v", projected)
+	}
+}
+
 type refreshFailingStore struct {
 	staticStore
 	failListActive error
diff --git a/internal/workflows/types.go b/internal/workflows/types.go
index b8a1a61d..f0036096 100644
--- a/internal/workflows/types.go
+++ b/internal/workflows/types.go
@@ -57,9 +57,10 @@ func (s *Scope) UnmarshalJSON(data []byte) error {
 
 // Payload is the immutable persisted workflow JSON document.
 type Payload struct {
-	SchemaVersion int             `json:"schema_version" bson:"schema_version"`
-	Features      FeatureFlags    `json:"features" bson:"features"`
-	Guardrails    []GuardrailStep `json:"guardrails,omitempty" bson:"guardrails,omitempty"`
+	SchemaVersion  int                `json:"schema_version" bson:"schema_version"`
+	Features       FeatureFlags       `json:"features" bson:"features"`
+	Guardrails     []GuardrailStep    `json:"guardrails,omitempty" bson:"guardrails,omitempty"`
+	HeaderPolicies []HeaderPolicyStep `json:"header_policies,omitempty" bson:"header_policies,omitempty"`
 }
 
 // FeatureFlags configures gateway-owned behaviors for a request.
@@ -102,6 +103,13 @@ type GuardrailStep struct {
 	Step int    `json:"step" bson:"step"`
 }
 
+// HeaderPolicyStep references one named outbound header policy. Policies are
+// resolved before caching and applied only to the primary provider attempt.
+type HeaderPolicyStep struct {
+	Ref  string `json:"ref" bson:"ref"`
+	Step int    `json:"step" bson:"step"`
+}
+
 // Version is one immutable persisted workflow version row.
 type Version struct {
 	ID           string    `json:"id" bson:"_id"`
@@ -204,6 +212,37 @@ func normalizePayload(payload Payload) (Payload, string, error) {
 		payload.Guardrails = append(payload.Guardrails, item.step)
 	}
 
+	type indexedHeaderPolicy struct {
+		step  HeaderPolicyStep
+		index int
+	}
+	indexedPolicies := make([]indexedHeaderPolicy, 0, len(payload.HeaderPolicies))
+	seenPolicies := make(map[string]struct{}, len(payload.HeaderPolicies))
+	for i, policy := range payload.HeaderPolicies {
+		policy.Ref = strings.TrimSpace(policy.Ref)
+		if policy.Ref == "" {
+			return Payload{}, "", newValidationError("header policy ref is required", nil)
+		}
+		if _, exists := seenPolicies[policy.Ref]; exists {
+			return Payload{}, "", newValidationError("duplicate header policy ref: "+policy.Ref, nil)
+		}
+		seenPolicies[policy.Ref] = struct{}{}
+		indexedPolicies = append(indexedPolicies, indexedHeaderPolicy{step: policy, index: i})
+	}
+	sort.SliceStable(indexedPolicies, func(i, j int) bool {
+		if indexedPolicies[i].step.Step != indexedPolicies[j].step.Step {
+			return indexedPolicies[i].step.Step < indexedPolicies[j].step.Step
+		}
+		if indexedPolicies[i].step.Ref != indexedPolicies[j].step.Ref {
+			return indexedPolicies[i].step.Ref < indexedPolicies[j].step.Ref
+		}
+		return indexedPolicies[i].index < indexedPolicies[j].index
+	})
+	payload.HeaderPolicies = payload.HeaderPolicies[:0]
+	for _, item := range indexedPolicies {
+		payload.HeaderPolicies = append(payload.HeaderPolicies, item.step)
+	}
+
 	raw, err := json.Marshal(payload)
 	if err != nil {
 		return Payload{}, "", newValidationError("marshal workflow payload", err)
diff --git a/tests/integration/setup_test.go b/tests/integration/setup_test.go
index 7a0f1d36..a6c55e64 100644
--- a/tests/integration/setup_test.go
+++ b/tests/integration/setup_test.go
@@ -187,6 +187,7 @@ func resetPostgreSQLStorage(t *testing.T) {
 		"budget_settings",
 		"workflow_versions",
 		"guardrail_definitions",
+		"header_policy_definitions",
 		"auth_keys",
 		"model_overrides",
 		"aliases",
@@ -214,6 +215,7 @@ func resetMongoDBStorage(t *testing.T) {
 		"budget_settings",
 		"workflow_versions",
 		"guardrail_definitions",
+		"header_policy_definitions",
 		"auth_keys",
 		"model_overrides",
 		"aliases",