Prompt injection protection that survives a missed detection
Combine prompt-injection detection with deterministic action policy, data controls and evidence so a missed classification cannot become an authorized breach.
The problem
What this is actually about
Prompt injection detection is probabilistic. It reduces the number of attacks that reach an agent, but the attacker chooses the hard cases and needs one success. A classifier therefore cannot be the authority for an irreversible action.
Containment makes the model untrusted by design. Even if hostile content changes its plan, the requested tool call is evaluated against identity, resource, data sensitivity and deterministic policy before the target accepts it.
What the platform does about it
Read from the product architecture rather than written here, so this page cannot promise something no module ships.
What data may it see, combine and send outward?
- Classification from public to regulated, with PII, PHI, PCI, credentials, source code and privileged material called out
- Cross-system combination controls, because access to two datasets separately is not permission to join them
- External model controls over approved providers, permitted data classes, regions, retention and training use
- Egress protection across uploads, API calls, webhooks, prompts, exports and storage writes
What is it doing right now, and should this action be allowed?
- A gateway between the agent and the tool, API or database it is calling
- A recorded decision per action, carrying agent, user, resource, context, risk, policy version and outcome
- Behavioural baselines, so a hundredfold jump in record reads reads as an anomaly rather than a busy afternoon
- Runaway protection that suspends an agent stuck in a loop before it exhausts cost or capacity
- Human approval for sensitive actions, and two-person approval for critical ones
Under which rule was this decided?
- Rules authored in natural language, compiled to structured policy, and verified by a human before activation
- Conditions over agent, owner, department, tool, action, resource, data class, geography, environment, time, risk, user, transaction value and tenant
- Simulation against historical traffic, so a rule states what it would have blocked before it blocks anything
- Versioned policy, with every decision recording the version that produced it
What exactly happened, and how far did it reach?
- A complete event trail per session: model and version, human user, tools, data, decisions, approvals, secrets and destinations
- An incident timeline to the second, including the actions policy refused
- Session replay of observable requests, tool calls, data access and results
- Blast radius across systems, records, credentials, downstream actions and affected customers
- A kill switch that revokes tokens, closes sessions, disconnects MCP and preserves evidence
What it leaves behind
The artefacts these modules produce. Evidence generated by a decision, rather than assembled for an audit afterwards.
- A record of which data classes each agent has actually touched
- A blocked-egress event naming the data class and the destination
- An allow, deny or escalate decision on every governed action
- A suspension when behaviour leaves the baseline
- A simulated impact figure before activation
- A policy version stamped on every decision
- A defensible timeline for a security review
- Preserved evidence that survives the containment that follows it
See it working
Every claim above has somewhere on this site you can go and check it.
- See indirect injection contained
The model follows hostile content, but the resulting action is still refused.
- Inspect the action boundary
See what the enforcement point can allow, deny, redact, rate-limit or route for approval.
- Review detection and response
See how detectors prioritize review without becoming the authorization layer.
Common questions
- Can prompt injection be prevented completely?
- No reliable classifier can guarantee that. The defensible design combines prevention and detection with least privilege and deterministic controls on the actions and data that matter.
- Is an LLM firewall the same as a guardrail?
- Guardrails inspect model inputs and outputs. An agent firewall also evaluates the proposed downstream action and can enforce a decision independently of the model.
- How does AI DLP fit?
- Data classification and egress rules determine whether sensitive fields may enter a prompt, appear in a response or leave through a tool call. Redaction can occur before the action proceeds.