Every text stageLLM01
Jailbreak & prompt injection
jailbreak
Instruction-override attempts, role-play escapes, and known injection patterns, with per-session state so a slow multi-turn escalation is not missed.
On by default
Reference
Every detector, and what it catches
40 detectors ship in the engine. This is all of them: the policy key you would write, the stage it runs at, the OWASP row it maps to, and whether it is on before you configure anything. 8 are on by default; the rest are opt-in, and the table says which is which.
- Detectors
- 40
- On by default
- 8
- Can redact or rewrite
- 6
- Mapped to an OWASP row
- 30
4 detectors
Prompt & jailbreak
Input & output
Abuse & flooding
abuse
Per-identity request floods and abusive usage patterns, budgeted once per user turn rather than once per agent sub-step.
On by default
Every text stage
Gibberish & obfuscation
gibberish
Text with no natural-language structure, which is how encoded and token-smuggled payloads usually look before they are decoded.
Off by default, opt in
InputLLM01
Cross-modal injection
multimodal_injection
Instructions hidden in an image, audio, or video attachment, scanned with the same injection patterns as text - and flagged as unscanned when nothing was extracted, so "no detector fired" cannot quietly mean "nothing was looked at".
Off by default, opt in
7 detectors
Data protection
Every text stageLLM02
PII
pii
65+ personal-data types with checksum validation on national identifiers such as Aadhaar, PAN, NINO, NHS, and CPF, so a number-shaped string is not a false positive.
On by default · can redact
Every text stageLLM02
Secrets & credentials
secrets
API keys, tokens, private keys, and connection strings. A hard block rather than a redaction, because a leaked key is not repaired by hiding it.
On by default
Every text stageLLM02
Exfiltration
exfiltration
Data being routed somewhere it should not go: encoded payloads, unexpected egress targets, and known exfiltration shapes.
On by default
Every text stageLLM02
Sensitive business data
sensitive_business_data
Internal, confidential, and pre-release material that is not personal data and so is invisible to a PII scanner.
Off by default, opt in · can redact
OutputLLM08
System-prompt leakage
system_prompt_leakage
Responses that disclose your own instructions, guardrail wording, or internal configuration.
Off by default, opt in
Every text stageLLM08
Document metadata leakage
document_metadata_leakage
Authorship, revision history, file paths, and other metadata that rides along inside retrieved documents.
Off by default, opt in
OutputLLM02
Reasoning-trace disclosure
reasoning_trace_disclosure
Extended-thinking traces and raw tool-call arguments treated as outputs rather than debugging leftovers, flagged when they go uninspected or carry what was redacted out of the answer.
Off by default, opt in
4 detectors
Content safety
Every text stage
Toxicity
toxicity
Harassment, hate, and abusive content in either direction.
On by default
Every text stage
Bias
bias
Output that treats protected groups unequally - the check an AI-governance reviewer asks for by name.
Off by default, opt in
Every text stage
Sentiment
sentiment
Tone thresholds, for the cases where a technically correct answer is still the wrong answer to send a customer.
Off by default, opt in
Every text stage
Language
language
Which languages are permitted, so a policy tuned in one language cannot be sidestepped by switching to another.
Off by default, opt in
4 detectors
Brand & policy
Every text stage
Topic restriction
topic_restriction
Subjects your assistant must stay off, whether the user raises them or the model wanders into them.
On by default
Every text stage
Competitor mentions
competitor
Named competitors in your own product surface, with the option to rewrite rather than refuse.
On by default · can redact
Every text stage
Regulated-advice compliance
compliance
Financial, medical, and legal advice that needs a disclaimer or a refusal, by jurisdiction.
Off by default, opt in · can redact
Output
Copyright
copyright
Verbatim reproduction of protected text in a response.
Off by default, opt in
7 detectors
Output integrity
OutputLLM07
Hallucination & groundedness
hallucination
Claims the retrieved context does not support, scored by natural-language inference rather than string overlap.
Off by default, opt in
OutputLLM07
Citation integrity
citation_integrity
Citations that do not exist, do not resolve, or do not say what the answer claims they say.
Off by default, opt in
OutputLLM07
Numerical consistency
numerical_consistency
Figures in the answer that contradict the figures in the source - the failure mode a human reviewer is worst at catching.
Off by default, opt in
Every text stageLLM10
Insecure code
code_safety
Generated code with injection flaws, unsafe deserialisation, weak crypto, or shell-execution patterns.
Off by default, opt in
Every text stageLLM10
Malicious URL & phishing
malicious_url
Links to known-bad, look-alike, and freshly registered domains, in prompts and in responses.
Off by default, opt in · can redact
OutputLLM10
Structured-output contract
structure
Responses that must satisfy a schema, so a downstream parser is never handed something it cannot read.
Off by default, opt in
OutputLLM10
Terminal control-character sanitiser
output_control_char_sanitizer
ANSI escapes in model output that a terminal, log viewer, or IDE pane would act on - clipboard writes via OSC 52, and cursor moves that overwrite what is already on screen.
Off by default, opt in · can redact
7 detectors
Agentic & MCP
Tool registrationLLM04
MCP manifest scanner
mcp_manifest_scanner
Tool manifests scanned at registration for poisoned descriptions, over-broad permissions, exfiltration sinks, and SSRF targets, with a host allowlist that fails closed.
Off by default, opt in
Tool registrationLLM03
Tool-permission audit
tool_permission_audit
Over-broad tool and function declarations caught at registration, before any agent can misuse them: open-ended executors, bundled destructive capability, wildcard or admin scopes, and unconstrained free-form parameters.
Off by default, opt in
Input & outputLLM04
Tool governance
tools
Which tools may be called, with what argument shapes, under whose scope.
Off by default, opt in
Tool outputLLM01
Tool-output injection
tool_output_injection
Instructions hidden in what a tool returns, re-inspected before that text re-enters the agent context.
Off by default, opt in
Agent plan & stepLLM03
Excessive agency
excessive_agency
Plans and live steps that reach beyond what the task needs - the destructive action nobody asked for.
Off by default, opt in
Agent plan & stepLLM03
Human-approval gate
human_approval_gate
High-impact, irreversible, or externally-visible actions blocked unless a named human approver is on record in request metadata - sharing its action taxonomy with excessive_agency so the two can never disagree on what counts as destructive.
Off by default, opt in
Input, output & agentLLM06
Unbounded consumption
unbounded_consumption
Runaway loops and denial-of-wallet spend, bounded before the invoice rather than after it.
Off by default, opt in
7 detectors
Retrieval & memory
RetrievalLLM01
Retrieval chunk injection
retrieval_chunk_injection
Injected instructions inside retrieved chunks, caught at the retrieval stage rather than after the model has already read them.
Off by default, opt in
RetrievalLLM09
Embedding & vector integrity
embedding_integrity
Poisoned or drifted vectors in your index, which is the attack that survives every prompt-level defence.
Off by default, opt in
RetrievalLLM09
Tenant-scope assertion
tenant_scope_assertion
Cross-tenant and unattributed chunks reaching the model after a similarity search that ran across the whole index before any tenant filter was applied.
Off by default, opt in
RetrievalLLM09
Retrieval jamming
retrieval_jamming
Blocker documents engineered to make the model refuse to answer, surfaced by refusal-shaped language, ranking dominance, and near-contentless chunks that look like a source but carry no substance.
Off by default, opt in
Memory writeLLM05
Memory-write poisoning
memory_write_poisoning
What an agent is about to persist, checked before it becomes something the agent trusts tomorrow.
Off by default, opt in
Input, output & retrievalLLM09
Semantic-cache integrity
semantic_cache_integrity
Cached answers served instead of asking the model: another tenant’s entry, a collision between two questions that embed alike and mean different things, or a planted one.
Off by default, opt in
Memory write & retrievalLLM05
Corpus poisoning
corpus_poisoning_monitor
Content written to become the corpus’s answer rather than to instruct it: self-declared authority, one question restated to win ranking, and ingest bursts from a single source.
Off by default, opt in
Beyond the built-ins
Your own detectors run in the same pipeline
A custom detector is not a second-class citizen bolted on the side. Regex rules, a webhook, or a Python class extending the plugin base all run in the same ordered pipeline, under the same policy semantics, and appear in the same traces and scorecards as the built-ins.
FAQ
Detector questions
How many there are, why most are opt-in, and how to add your own.
40 in the engine's registry. 8 are on in a default policy bundle and the rest are opt-in, either because they need policy input that only you can supply - which topics, whose brand, which jurisdictions - or because they run at a stage that only agentic deployments have, such as retrieval, tool output, or memory writes.
Because a detector that fires without your policy is a false positive generator. Topic restriction needs to know your topics; compliance needs to know your jurisdiction; the agentic detectors need an agent. Shipping them all on would mean every new deployment starts by fighting its own guardrails, so the default bundle enables the ones that are correct without configuration and leaves the rest to you.
Yes. The engine takes custom detectors as regex rules, a webhook, or a Python class extending the plugin base, and they run in the same pipeline with the same policy semantics as the built-ins. Custom detector counts are capped per plan on the hosted console and unlimited on Enterprise.
6 of them. Those are marked "can redact" below: they can rewrite the text in place - masking a PII match, removing a competitor name, appending a required disclaimer - so a request can continue safely instead of being refused outright.