Shut down the OWASP top risks

Stop a single missed jailbreak or leaked secret from compromising every AI feature you ship.

Every AI feature you add widens the attack surface. Prompt injection is LLM01, the first entry in the OWASP Top 10 for LLM Applications, yet a single content filter is a single point of failure: miss one jailbreak, or let one classifier go offline, and nothing stands between a crafted request and the model. As more teams ship their own features, each wiring up its own checks, safety becomes inconsistent and impossible to prove.

What you can do

  • Apply the same layered guardrails on every surface you configure so that protection does not depend on each team getting its own checks right.
  • Block prompt injection and jailbreak attempts before the model runs so that an unsafe request never reaches a provider or incurs a model cost.
  • Redact or pseudonymise PII and other sensitive values on the way in so that matches are replaced before the request reaches a provider.
  • Fail closed by default so that a classifier outage blocks the request rather than silently passing it through unprotected.
  • Label every block with a rejection category so that you can show exactly what was caught, and why.

How it works

Agents & appsOpenAI SDKModelprovidersAgent Stream surfaceREQUEST SEAMPrompt GuardExpert WitnessJudgebefore the model runsModel callwith failoverRESPONSE SEAMJuryPrompt GuardExpert Witnessafter the model returns✕ Fail closedblock on match or outage

Safety is configured once on a surface and applied to every call through a layered pipeline, so no single control is the only thing standing between a request and the model. Prompt Guard runs deterministic regex on both seams and model-backed AI Matching on the request seam, rejecting a match outright or applying redact-and-continue to replace it with a fixed token such as <EMAIL> or a stable NER ID. Expert Witnesses add purpose-trained external classifiers on the request seam, the response seam, or both. On the request seam the Judge runs an LLM-based or moderation-based pre-check, in parallel with the Decider on a buffered request in Decide LLM based on content mode, blocking a clearly unsafe request before the main model is called. On the response seam the Jury runs a multi-juror review that can approve, block, or re-drive the answer before it returns.

Expert Witnesses and the AI Matching detector fail closed by default: if one errors or times out, the request is blocked rather than passed through. Each block is tagged with a canonical rejection category (prompt injection, jailbreak, PII, secrets, toxicity, policy violation, and more), with Uncategorized as the fallback. The categories feed the rejection dashboards.

  • Guardrails: How Prompt Guard, Expert Witnesses, Judge, and Jury layer around a call and why they fail closed.
  • PII protection: How sensitive data is detected and pseudonymised with NER IDs before it reaches a provider.
  • Block and re-review calls with Judge and Jury: Step-by-step configuration of the request pre-check and response review on a surface.