🔱 Trishul Guardrail Middleware
checking…

One guardrail layer between any agent and the LLM.

Trishul is a pluggable middleware proxy that enforces declarative safety policy across the whole agent lifecycle — inbound prompt-injection & PII firewall, policy-aware tool execution with human-in-the-loop approval, and a streaming egress verifier that catches secrets split across token boundaries. No changes to your app code.

Ingress firewallTool-policy HITL Streaming egress verifierPolicy as code Circuit breaker

Ingress firewall

Detect prompt injection & mask PII / secrets before the prompt reaches the model.

Try: injection PII bundle leaked key

How it decides

Two-layer detection, one declarative policy.

1 · Deterministic — regex+checksum PII (Luhn card, Verhoeff Aadhaar), 15+ secret types, weighted injection signals.
2 · LLM-judge — only ambiguous injection scores escalate to the model, so you pay per-call rarely.
3 · Policy — thresholds, mask modes & block severities all live in policy.json.
4 · Large context — sliding window scores injection buried deep in long inputs.
Proxy output appears here.

Tool-execution guard

Risk-scored tool calls; destructive ops & off-domain data egress route to a human queue.

Try: get_user (low) delete_record (critical) exfiltration

Human approval queue

Paused executions awaiting a decision.

No pending items yet — evaluate a risky tool call.

Egress output verifier

Scan model output for leaked secrets, echoed PII, SQL dumps, fake tool confirmations & system-prompt leaks.

Try: secret + fake confirm SQL dump

Why streaming is hard

A secret like sk-ant-… can be split across two SSE chunks. Per-chunk scanners miss it. Trishul keeps a rolling overlap buffer, so boundary-split secrets are still caught before they reach the user.

Streamed, scrubbed output appears here.

Evaluation harness

Runs the adversarial ingress + egress suites and reports detection accuracy and policy-enforcement rate — the exact things the judges score.

Active policy policy.json

Every decision above is driven by this declarative document. Swap it to re-tune the whole system — no redeploy.

loading…