AI Runtime Defense
Nothing reaches the user
until it has been scanned.
After the model generates a response, that response is evaluated against two rule layers — universal rules that apply everywhere, and workspace rules that encode domain constraints. Matches are blocked, redacted, or flagged.
Structure
Two layers of rules
Validation is not a single filter. Universal rules protect the integrity of the system itself; workspace rules protect the domain the system is operating in.
Universal rules apply to every workspace without exception. They exist because certain failures are unacceptable regardless of context — a leaked system prompt, a credential in plaintext, a response indicating the model has been manipulated into breaking character.
Workspace rules are configured per deployment and encode what must never be said in that specific domain. They are additive: a workspace never loses universal protection by defining its own.
Universal Rules
Applied to every workspace
GOV-001
blockPrompt-injection leak — the response echoes instruction-override language, indicating injected content shaped the output.
GOV-002
blockJailbreak-persona leak — the response adopts an unrestricted or jailbroken persona.
GOV-003
blockSystem-prompt exposure — the response surfaces its own system prompt.
GOV-004
blockInternal-instructions leak — the response emits internal instruction framing or configuration blocks.
GOV-005
redactCredential leak — API keys, secret keys, or passwords are replaced with a redaction marker rather than blocking the whole response.
Workspace Rules
Domain constraints, enforced automatically
Each workspace defines what must never appear in its output. The rules are configuration, not prompt text — the model cannot produce output that violates them.
Regulated healthcare and pharma
Block diagnostic language, prescribing instructions, and dosage guidance. Flag regulatory determinations such as claims that a product is safe, approved, or certified.
Financial services and trade compliance
Treat sanction and control checks as absolute. Attempts to override, bypass, or skip a compliance check are blocked rather than negotiated.
Public-facing deployments
Block clinical diagnosis, medication advice, and outcome guarantees — the categories where a confident-sounding wrong answer causes real harm.
Advisory and professional services
Block guaranteed-outcome language where the deployment must give guidance without promising a result.
Enforcement
Block, redact, or warn
Not every violation warrants the same response. Severity determines what happens to the response and what the user sees.
Block
The response is withheld entirely. The user receives a governed result and can escalate through break-glass review if the block was situationally wrong.
Redact
The response is delivered with the offending span replaced. Used where the response is otherwise useful — a leaked credential does not justify discarding the whole answer.
Warn
The response is delivered and flagged. Surfaces in the console's flagged filter for review without interrupting the user's work.
Recorded either way
Every action — block, redact, or warn — is written to the audit ledger with the specific rule that triggered it.
Guardrails the model cannot negotiate with
See how output validation runs after generation and before delivery — as code, not as instruction.