Guardrails

The first line of defense that inspects and cleanses prompts and retrieved context before they reach the LLM. This layer detects and neutralizes prompt injection attacks, strips malicious code, and enforces schema compliance.

• Semantic Filtering: Uses a separate classifier model to detect jailbreak attempts and toxic intent in user queries.
• Regex & Pattern Matching: Blocks known attack signatures, such as 'ignore previous instructions' or encoded payloads.
• Context Sanitization: Scans retrieved document chunks for hidden instructions or adversarial text designed to hijack model behavior.

A post-generation filter that evaluates the LLM's response for hallucinations, toxicity, and policy violations before it is returned to the user. This is the last chance to catch errors.

• Hallucination Detection: Cross-references generated claims against the retrieved source documents to calculate a faithfulness score.
• Toxicity Classification: Runs the output through a dedicated toxicity model to catch hate speech, harassment, or profanity.
• RegEx Compliance: Verifies that the output matches required formats (e.g., valid JSON, no exposed PII patterns) and redacts or blocks failures.

Defines the absolute off-limits areas for the AI system. These guardrails ensure the model refuses to engage with out-of-scope or high-risk subjects, maintaining strict conversational boundaries.

• Topic Classifiers: Deploy a dedicated natural language inference (NLI) model to detect if a query falls into a banned category (e.g., violence, self-harm, political campaigning).
• Keyword Blocklists: Maintain a curated list of forbidden terms that trigger an immediate refusal response.
• Jailbreak Resistance: Specifically trained to resist social engineering attacks that attempt to trick the model into discussing banned topics by using hypotheticals or role-playing.

A critical guardrail for enterprise compliance that identifies and masks personally identifiable information (PII) and other sensitive data in both the retrieved context and the generated output.

• Named Entity Recognition (NER): Uses transformer-based models to detect names, addresses, credit card numbers, and social security numbers with high precision.
• Pattern Matching: Identifies structured sensitive data like API keys, authentication tokens, and internal project codes.
• Dynamic Masking: Replaces detected entities with type-appropriate placeholders (e.g., [PERSON_NAME], [CREDIT_CARD]) rather than blocking the entire response, preserving utility.

Real-time monitoring and kill-switches that prevent runaway costs, latency spikes, or cascading failures in production RAG pipelines.

• Latency Thresholds: Automatically terminate a request if the guardrail processing or LLM generation exceeds a defined time limit (e.g., 5 seconds).
• Token Budget Enforcement: Hard limits on the total token count for the prompt and response to control compute costs and prevent denial-of-wallet attacks.
• Toxic Burst Detection: Monitors the rate of policy violations across the system; if a threshold is breached, the circuit breaker trips to halt all traffic until an operator intervenes.

Every guardrail decision must be transparent and auditable. This characteristic ensures that all interventions are logged with a clear, human-readable rationale for compliance and debugging.

• Decision Logging: Records the input, the triggered guardrail rule, the action taken (block, redact, warn), and a confidence score.
• Explainability Tags: Attaches metadata to the response indicating why a guardrail fired (e.g., 'blocked: toxicity_score=0.97').
• Immutable Audit Trail: Streams all guardrail events to a tamper-proof logging system for forensic analysis and regulatory reporting.

Intercepts model outputs in real-time to detect and block hate speech, harassment, and profanity before they reach the end user. Uses classification models fine-tuned on enterprise-specific toxicity taxonomies.

• Mechanism: Scores each generated token sequence against a toxicity classifier; blocks responses exceeding a configurable threshold
• Example: A customer-facing chatbot automatically replaces a toxic completion with a canned 'I cannot respond to that' message
• Key metric: Sub-5ms latency overhead for real-time streaming responses

Scans retrieved document chunks and generated outputs for personally identifiable information using named entity recognition. Automatically masks or redacts Social Security numbers, credit card data, email addresses, and phone numbers before they enter the model's context window.

• Pre-retrieval: Strips PII from chunks before vector embedding to prevent storage of sensitive data
• Post-generation: Validates final output against regex patterns and NER models
• Compliance: Enforces GDPR, CCPA, and HIPAA data handling requirements

Detects and neutralizes malicious instructions embedded in retrieved documents that attempt to hijack the LLM's behavior. Implements input sanitization and instruction boundary enforcement.

• Direct injection: Blocks 'ignore previous instructions' patterns in retrieved text
• Indirect injection: Scans third-party content for hidden prompts before RAG ingestion
• Defense layers: Combines signature-based detection with semantic similarity scoring against known attack vectors

Validates generated claims against the retrieved source documents to prevent hallucination. Implements a claim extraction → evidence alignment → contradiction detection pipeline.

• Cross-references each factual assertion with its source chunk
• Flags unsupported claims for human review or automatic suppression
• Produces an audit trail mapping every output statement to a specific retrieval result

Enforces corporate governance rules by validating outputs against configurable policy documents. Blocks responses that violate internal guidelines on topics like financial advice, medical claims, or competitive intelligence.

• Policy-as-code: Rules defined in Rego or custom DSL, version-controlled in Git
• Semantic matching: Uses embedding similarity to detect policy violations beyond keyword matching
• Example: Blocks a RAG system from providing investment recommendations even when source documents contain financial data

Identifies adversarial prompts designed to bypass safety guardrails through obfuscation, role-playing, or encoding tricks. Maintains a continuously updated signature database of known jailbreak patterns.

• Detects base64-encoded malicious instructions
• Identifies 'DAN' (Do Anything Now) and similar role-play attacks
• Uses perplexity scoring to flag anomalous prompt structures