01
Deterministic
Fast rule- and pattern-based detectors run first - regex, checksum-validated PII for 65+ types, signatures, and allow/deny lists. They resolve the clear cases at low cost and latency.
Runtime AI firewall
Inline enforcement on every prompt, response, and token.
Guardrails are individual checks. An AI firewall is the enforcement layer that runs them on every request and decides to allow, block, redact, or mask in real time, including mid-stream. ZNYX is both: the firewall and the engine behind it.
Detector waterfall · trace 8f21c4block · 12 ms
- deterministic.secret1ms
- deterministic.pii1ms
- ml.prompt_injection5ms
- ml.jailbreak3ms
- ml.toxicity1ms
- policy.scorecard1ms
2 hitsfail-closed gate · policy prod-v42
- ladder tiers
- 4
- detectors
- 40
- remediations
- 6
Definition
What is an AI firewall?
An AI firewall is the inline enforcement layer that inspects every prompt, response, and streamed token and decides allow, block, redact, or mask in real time. It is to LLM traffic what a web application firewall is to HTTP: it sits between your app and the model and stops prompt injection, jailbreaks, data exfiltration, and unsafe output before they cause harm. ZNYX is an open-source, self-hosted AI firewall that enforces all of this inside your boundary.
Defense in depth
Deterministic → ML → LLM-judge, with a fail-closed gate
Cheap checks run first and most requests never reach the expensive tiers. Escalation is deliberate, budgeted, and audited, and when the engine cannot decide, the gate closes.
02
ML classifiers
When deterministic checks are uncertain, ML classifiers escalate for nuanced calls - toxicity, sentiment, topic and competitor detection, language ID, and PII NER - scored with precision, recall, F1, and AUROC.
03
LLM judge
The hardest decisions escalate to an audited LLM-judge layer with K-member consensus and denial-of-wallet budgets - for groundedness, intent, and other context-heavy judgments.
04fail-closed
Scorecard gate
Detector scores are combined against your policy scorecard. If the engine cannot reach a confident verdict, the gate closes rather than passing the request.
Inline inspection
How inline inspection works
The firewall sits directly on the AI request path and inspects traffic at three moments: before the model sees a prompt, after it returns a response, and continuously while a response streams.
01
Before the model (input)
Every prompt is inspected before it reaches the model. The firewall catches prompt injection, jailbreaks, system-prompt leakage attempts, malicious URLs, and PII or secrets so unsafe or sensitive input is blocked, redacted, or masked first.
02
After the model (output)
Responses are inspected before they reach the user or a downstream tool. The firewall checks for toxicity and bias, hallucination and groundedness via NLI, leaked secrets, unsafe code, and policy-violating content, and enforces structured-output and JSON-schema rules.
03
During streaming (live tokens)
For real-time SSE streaming, the firewall evaluates tokens as they emit, so a response can be stopped mid-stream the moment it crosses a policy line, instead of waiting for the full completion to finish.
Remediation
Six ways to answer a hit
Blocking is rarely the right product decision. Each detector maps to the action your policy chooses, per environment, and streaming responses are evaluated as tokens arrive over SSE.
- block
- Reject the request or response and return your policy error.
- redact
- Remove the offending span before it continues downstream.
- mask
- Replace matched entities with typed placeholders.
- re-ask
- Send the model a corrective turn and re-evaluate.
- refrain
- Substitute a safe canned response.
- ask-human
- Route to a reviewer queue before release.
Egress gate
Nothing leaves without passing DLP
The output gate is the last thing a response passes. It enforces host allowlists, JSON-schema contracts, and data-loss policy on the fully assembled answer as well as on each streamed chunk.
policy · prod-v42 · output stage
output:
dlp:
enabled: true
pii:
action: mask
types: [email, phone, ssn, credit_card]
secrets:
action: block
hosts:
allowlist: ["*.acme.com", "api.internal"]
schema:
enforce: true
on_fail: re-ask
streaming:
evaluate: per_chunk
Comparison
AI firewall vs web application firewall
If you run a WAF in front of your web apps, an AI firewall is the equivalent control for your LLM and agentic apps: same inline placement, different threat model.
| Concern | Web application firewall | AI firewall (ZNYX) |
|---|---|---|
| Protects | HTTP and web application traffic | LLM prompts, responses, streamed tokens, retrieved context, and agent tool calls |
| Inspects | Requests and responses for known web attack patterns | Natural-language intent and content with deterministic, ML, and LLM-judge layers |
| Top threats | SQL injection, XSS, request smuggling | Prompt injection, jailbreaks, data exfiltration, hallucination, excessive agency |
| Actions | Allow or block | Allow, block, redact, mask, re-ask, refrain, or ask a human |
Detectors
Everything the firewall can see
Prompt injection
InputIdentify direct and indirect prompt-injection and adversarial instruction chains that try to override your application prompt.
Jailbreak
InputRecognize jailbreak templates, multi-turn escalation, and evasion attempts that try to bypass policy controls.
PII (65+ types)
Input & OutputDetect and redact PII across 65+ types, including checksum-validated regional IDs - in your boundary, never sent to a vendor.
Secrets & exfiltration
Input & OutputCatch leaked API keys, tokens, and credentials, and block data-exfiltration and sensitive-business-data patterns.
Toxicity, bias & sentiment
Input & OutputFlag abusive, hateful, biased, or off-brand content across user input and model output with configurable thresholds.
Topic & competitor control
Input & OutputKeep conversations in bounds and stop responses from referencing competitors or excluded products.
Malicious URL & phishing
Input & OutputBlock phishing links, IP-literal and punycode/homoglyph domains, and other malicious URL patterns.
Insecure code
OutputDetect SQL injection, XSS, command injection, path traversal, and insecure-deserialization patterns in generated code.
Hallucination & groundedness
OutputScore responses for groundedness against provided context using NLI-backed entailment and citation integrity.
System-prompt leakage
OutputCatch responses that echo your system prompt, matched against keyed fingerprints so the prompt itself is never stored.
Agent plans & agency
AgentScore agent plans and live steps for actions beyond the task, gate destructive ones behind a named human, and bound runaway loops before the invoice.
Tool & MCP governance
AgentScan MCP manifests at registration for poisoned descriptions and over-broad permissions, then govern which tools may be called and with what arguments.
Tool-output injection
AgentCatch instructions hidden in what a tool returns, re-inspected before that text re-enters the agent’s context and becomes its next instruction.
Retrieval & memory integrity
AgentInjected chunks, poisoned vectors, cross-tenant retrieval and cache hits, and what an agent persists to memory - checked at the retrieval and write stages.
Structured-output & language
OutputEnforce JSON-schema contracts on outputs and apply allow/block language policies across 35+ languages.
15 shown · 40 shipped in the runtime
See OWASP LLM Top-10 coverage →Coverage
Coverage across the AI threat surface
Forty detectors run behind the firewall: prompt injection and jailbreak, PII across 65+ types, secrets and exfiltration, toxicity, bias and sentiment, topic and competitor, malicious URLs and phishing, insecure code, hallucination and groundedness, system-prompt leakage, and multilingual variants. Agentic and MCP stages add retrieval, agent-plan, agent-step, and memory-write evaluation, supply-chain manifest scans, tool-output guards, and excessive-agency checks, mapped to the OWASP LLM Top 10.
See OWASP LLM Top-10 coverageFAQ
AI firewall, answered
What an AI firewall is, how it differs from guardrails, where it runs in your stack, and what it costs you in latency.
An AI firewall is the inline enforcement layer that sits between your application and the model. It inspects every prompt, response, and streamed token and decides allow, block, redact, mask, re-ask, or refrain in real time. Like a web application firewall protects HTTP traffic, an AI firewall protects the LLM request path - guarding against prompt injection, jailbreaks, data exfiltration, and unsafe output before anything reaches the model or the user.
Guardrails is the broad term for the detectors, policies, and checks that define what is allowed. The AI firewall is where those guardrails are enforced inline on live traffic - the runtime that actually inspects each request and applies the allow, block, redact, or mask decision. ZNYX gives you both: 40 detectors composed into policies, enforced by an inline firewall that runs deterministic, ML, and LLM-judge layers behind a fail-closed gate.
Yes. The enforcement runtime is open-source and self-hostable. You pull it, drop it into your stack, and it inspects prompts and responses inside your own boundary - so your prompts, PII, and secrets never leave your environment. An optional hosted control plane adds centralized policies, evidence, and traces, and Enterprise customers can self-host that too for fully private, air-gappable deployment.
It runs inline on the AI request path, between your application and the model provider. The self-hosted runtime evaluates inputs before the call, outputs after the call, and tokens during SSE streaming. ML and LLM-judge models run in an in-boundary inference sidecar inside your VPC, and it deploys via Docker, Docker Compose, or Kubernetes - cloud- and model-neutral.
The deterministic layer runs first and resolves most traffic with low overhead. Heavier ML and LLM-judge checks only escalate when the deterministic and ML layers are uncertain, and denial-of-wallet budgets cap judge spend. You compose policies to apply the right depth of inspection on input, output, streaming, retrieval, or agent steps so cost and latency stay proportional to risk.