A firewall for agents that can actually act.
Guard sits between your agent and the world. It inspects user input, retrieved documents, model output and every tool call against policy you write as code, and stops the ones that shouldn't happen. Median decision time: under 18 milliseconds.
Four checkpoints. One policy.
Try a few attacks.
Nothing you type leaves your browser.
What Guard stops.
Direct and indirect prompt injection
Instructions hidden in emails, PDFs, web pages, tickets and tool results, including invisible text, encoded payloads and multi-turn setups.
Unsafe tool calls
Argument-level policy on every call: spend limits, allow-listed recipients, read-only scopes, rate limits and human approval for high-impact actions.
Exfiltration and leakage
PII, secrets, source code and confidential documents detected on the way out, including through URLs, markdown images and tool arguments.
Policy circumvention
Role-play, obfuscation, many-shot and crescendo attacks, scored on the conversation, not just the latest message.
Harmful and off-policy output
Topic restrictions, regulated advice, toxicity and brand rules, with your own categories trained from as few as 200 labelled examples.
Unsupported claims
Optional checks that answers are supported by retrieved sources before they reach a customer.
Rules your security team can read.
Policies live in your repository, are reviewed like code and are tested by Reinforced Evals before they reach production. No vendor console as the source of truth.
- Versioned, diffable, reviewable
- Dry-run mode to measure impact before enforcing
- Every decision exported to your SIEM with full context
agent: support-agent
tools:
issue_refund:
max_amount_usd: 500
require_approval_above: 200
deny_if_provenance: [retrieved, tool_output]
send_email:
recipients: customer_on_ticket_only
input:
injection: { action: block, threshold: 0.85 }
output:
pii: { action: redact, types: [card, ssn, iban] }
audit: { sink: splunk, retain_days: 365 }median decision latency
fewer successful indirect injections in our AgentBreach-2 benchmark
false-positive rate on benign enterprise traffic at default thresholds
ways to deploy: proxy, sidecar or SDK
Guard FAQ.
What are AI guardrails?
AI guardrails are runtime controls that inspect what goes into and comes out of a model or agent, and block, rewrite or escalate anything that violates policy. Effective guardrails for agents must also inspect retrieved content and tool calls, not just chat text. Our guardrails architecture guide covers the details.
How does Guard stop prompt injection?
Guard combines trained injection classifiers, provenance tracking (it knows which text came from a user, a tool or a web page) and action policies. Even if injected text slips past detection, a payment or email tool call that violates policy is blocked before it executes. See prompt injection: detection and defense.
How much latency does Guard add?
Median decision latency is under 18 ms and p99 is under 60 ms for typical agent traffic. Checks run in parallel, and streaming responses are inspected in chunks so time-to-first-token is unaffected.
Do we have to change our agent code?
No. Guard runs as a drop-in proxy in front of any OpenAI-compatible or Anthropic-compatible endpoint, as a sidecar next to your tool servers (including MCP servers), or through a two-line SDK call.
What happens when Guard blocks something?
Your policy decides: return a safe refusal, strip the offending content, require human approval, or raise a security event to your SIEM. Every decision is logged with the signal that triggered it.
Can Guard run without sending data to you?
Yes. Guard runs entirely in your VPC or on-prem, with classifiers served locally. Managed deployments support zero data retention.
Related: AI guardrails architecture guide · Prompt injection defense · Red Teaming
Put a policy boundary around every agent.
A 45-minute briefing with our evaluation team. Bring a use case; leave with a threat model, a draft eval plan and a sense of where you stand.