Everything the runtime does, written down.

Identify direct and indirect prompt-injection and adversarial instruction chains that try to override your application prompt.

Recognize jailbreak templates, multi-turn escalation, and evasion attempts that try to bypass policy controls.

Detect and redact PII across 65+ types, including checksum-validated regional IDs - in your boundary, never sent to a vendor.

Catch leaked API keys, tokens, and credentials, and block data-exfiltration and sensitive-business-data patterns.

Flag abusive, hateful, biased, or off-brand content across user input and model output with configurable thresholds.

Keep conversations in bounds and stop responses from referencing competitors or excluded products.

Block phishing links, IP-literal and punycode/homoglyph domains, and other malicious URL patterns.

Detect SQL injection, XSS, command injection, path traversal, and insecure-deserialization patterns in generated code.

Score responses for groundedness against provided context using NLI-backed entailment and citation integrity.

Catch responses that echo your system prompt, matched against keyed fingerprints so the prompt itself is never stored.

Score agent plans and live steps for actions beyond the task, gate destructive ones behind a named human, and bound runaway loops before the invoice.

Scan MCP manifests at registration for poisoned descriptions and over-broad permissions, then govern which tools may be called and with what arguments.

Catch instructions hidden in what a tool returns, re-inspected before that text re-enters the agent’s context and becomes its next instruction.

Injected chunks, poisoned vectors, cross-tenant retrieval and cache hits, and what an agent persists to memory - checked at the retrieval and write stages.

Enforce JSON-schema contracts on outputs and apply allow/block language policies across 35+ languages.