Skip to content

Runtime guardrails↑

AQtive Guard (AQG) runtime guardrails enforce real-time security controls on live LLM traffic. While AI-SPM rules perform static analysis on AI assets, runtime guardrails actively inspect messages as they flow between users, agents, and LLM providers.

When a message is sent to or received from an LLM, the guardrails service evaluates it against your configured policies. Based on the results, the message is either allowed, blocked, or redacted before reaching its destination.

Key concepts↑

Guardrails↑

Guardrails are the individual security checks applied to messages. Each guardrail targets a specific category of risk:

  • Jailbreak: Detects prompt injection and attempts to bypass safety controls.
  • Toxicity: Identifies harmful, offensive, or inappropriate language.
  • PII: Scans for sensitive personal data like SSNs, email, and credit card or phone numbers.
  • Secrets: Spots leaked credentials, API keys, and authentication tokens.

Outcomes↑

When a guardrail evaluates a message, it produces one of three outcomes:

  • OK: The message passed all checks and is allowed through to its destination.
  • Redacted: Sensitive content was detected and removed or masked before the message was forwarded.
  • Blocked: The message violated a policy and was stopped entirely.

Severity levels↑

Each guardrail finding is assigned a severity level: Critical, High, Medium, Low or Info. Severity levels are based on AQG policy severity mapping, and determine issue trigger activation. For example, you can configure a policy to block messages with critical findings while only redacting those at medium or above.

Architecture↑

The AI Gateway is an on-premises proxy that runs the guardrails service. It sits between your AI applications and their LLM providers and inspects all traffic against your configured policies.

There are two ways to route LLM traffic through the AI Gateway:

  • Browser extension: Intercepts browser-based interactions with AI services like ChatGPT, Google Gemini, and others, and routes them through the AI Gateway for inspection.
  • Agent enrollment: Configure your AI agents to send LLM API calls through the AI Gateway by updating their base URL.

Once traffic is flowing through the gateway, you can configure policies to define which guardrails are applied and what actions are taken when violations are detected.