# Guardrails > How Prompt Guard, Expert Witnesses, Judge, and Jury layer content safety and PII protection around a call, and why they fail closed by default. A single content filter is a single point of failure: if it misses a jailbreak attempt or its classifier goes offline, nothing else stands between the request and the model. Agent Stream runs every LLM call through a layered, auditable safety pipeline instead, combining deterministic rules, purpose-trained classifiers, and LLM-based review. No single guardrail outage silently removes protection, so a request stays governed even when one layer fails. [PII protection →](/products/affinidi-trust-fabric/agent-stream/concepts/pii-protection.md) ## What each guardrail layer does | Layer | Runs | What it does | | Prompt Guard | Request (pattern and AI matching) and response (pattern matching only) | Deterministic regex and model-backed PII inspection. Configure each match to reject or redact it with a static placeholder. A stable NER ID pseudonym can preserve relationships between values instead. See [PII protection and NER IDs →](/products/affinidi-trust-fabric/agent-stream/concepts/pii-protection.md). | | Expert Witnesses | Request seam, response seam, or both | Purpose-trained external safety classifiers, consulted in addition to Prompt Guard. Multiple witnesses can run on one surface. | | Judge | Request, in parallel with the Decider | An LLM-based, or OpenAI-moderation-based, pre-check that can moderate or block a request before the main model is called. Running in parallel with the Decider absorbs its latency. | | Jury | Response | A multi-juror LLM post-review that can approve, block, or re-drive (regenerate) the model’s response before it returns, with a single retry policy shared by the whole panel. | Guardrails compose. A surface can run Prompt Guard alone for a low-risk internal tool, or all four layers, plus multiple expert witnesses on both seams, for a customer-facing deployment. Request-side and response-side guardrails are not the same set of checks: Request seamPrompt Guard (pattern + AI matching), Expert Witnesses, Judge. Runs before the provider is called, so a block here never incurs a model cost. Response seamJury, Prompt Guard (pattern matching only), Expert Witnesses. Runs after the model responds, so it catches problems only visible in the output itself. ## Built-in Expert Witness providers Built-in Expert Witness providers include EnkryptAI (Detect API, named-Guardrail, AI-Proxy, and legacy Policy modes), Lakera Guard, Azure Prompt Shields for request-side injection detection, Azure Content Safety for response-side harm moderation, and a generic OpenAI-moderation shape. A new provider onboards through a data-driven profile, declaring its auth header, request template, and verdict rule, rather than through a code change. ## Why guardrails fail closed by default Fail-closed is the default posture of every guardrail: if the guardrail cannot reach its classifier, or its rule engine cannot complete, the request is blocked rather than passed through silently. Fail-open can be set explicitly on a guardrail when the operator prefers availability over protection - a deliberate, per-guardrail choice. ## Redact-and-continue Redact-and-continue is the Prompt Guard behaviour where a matched pattern is replaced in-place, either with a static placeholder such as or a stable NER ID pseudonym, and the modified request continues down the pipeline. This is distinct from block, which halts the request. ## Why layering matters - Prompt Guard catches known patterns deterministically and cheaply. - Expert Witnesses add purpose-trained detection for categories a regex cannot express, such as jailbreak attempts or nuanced toxicity. - Judge stops a clearly unsafe request before the cost of a model call is incurred. - Jury catches problems that only appear in the model’s own output, including cases where Judge passed the request but the response itself needs redirection or regeneration. ## Rejection category A Rejection Category is one of the stable canonical labels applied to every guardrail block: hate, toxicity, prompt injection, jailbreak, PII, secrets, policy violation, and more. Categories are what make rejection breakdown dashboards possible per team, member, surface, and stage in [Observability →](/products/affinidi-trust-fabric/agent-stream/concepts/observability.md). A failed source authentication, a rate limit, a required payment, an open circuit breaker, a timeout, or an upstream error stop a request for a different reason: they’re not guardrail content decisions, so they’re recorded by their own pipeline stage rather than as a Rejection Category. See [Pipeline and stages →](/products/affinidi-trust-fabric/agent-stream/concepts/pipeline-and-stages.md) for where each of those stages sits. ## Related - [PII protection and NER IDs](/products/affinidi-trust-fabric/agent-stream/concepts/pii-protection.md): A deeper look at how Prompt Guard detects and pseudonymizes sensitive data. - [Pipeline and stages](/products/affinidi-trust-fabric/agent-stream/concepts/pipeline-and-stages.md): Where guardrail stages sit relative to routing, the provider call, and metering. - [OPA policies](/products/affinidi-trust-fabric/agent-stream/concepts/opa-policies.md): Access-control decisions that run alongside content guardrails. - [Governance records](/products/affinidi-trust-fabric/agent-stream/concepts/governance-records.md): How each guardrail’s verdict and evidence is captured into a signed, tamper-evident transcript. - [Observability](/products/affinidi-trust-fabric/agent-stream/concepts/observability.md): The rejection breakdown dashboards built from Rejection Category data.