Instructions arrive as data
A document, a ticket, a web page — anything the model reads can carry instructions. Filtering the user's message alone blocks almost none of it.
LLM guardrails
Assume the attack lands. Keep the moat.
Guardmoat puts a policy layer around every model call — prompt injection, jailbreak attempts, data exfiltration through tools, and unsafe output. Decisions happen in-line before the response leaves your system, and each one lands in an evidence log that holds up when someone asks how it was blocked.
Pre-launch · for teams with a model in production and no policy layer
An LLM feature is a new attack surface with no perimeter.
01 / The threat
01
02
Tools widen the blast radius
An agent with database and email access turns a bad output into an exfiltration channel. The model isn't the asset at risk; the tools around it are.
03
Nobody can show what happened
When an incident is investigated weeks later, prompt logs are free text in an observability tool. There is no decision record to review.
Policy in front of the model, evidence behind it.
02 / The design
01
Declare the policy once
What this application may say, which tools it may call with which arguments, and where human approval is mandatory. Written as rules, versioned like code.
02
Evaluate every call in-line
Inputs are checked for injection and intent drift, tool calls for authorisation, outputs for policy and leakage. A fail is a fail — the response doesn't ship.
03
Leave a record you can defend
Each decision stores the rule, the evidence and the verdict. Post-incident review becomes reading a log, not reconstructing a guess.
Guardrails are not a filter you bolt on. They're the product decision about what your model is allowed to be.
The controls an LLM deployment actually needs.
03 / CapabilitiesInjection & jailbreak detection
Checks across retrieved content and conversation history, not only the latest user message.
Output policy enforcement
Topic, tone, format and prohibited-content rules evaluated before the response is returned.
PII redaction in flight
Detects and masks sensitive fields in both directions, so identifiers don't reach the provider or the user.
Tool-call authorisation
Allowlists scoped by role and argument shape. Destructive actions require explicit approval, not just intent.
Evidence log
Immutable per-decision records — rule, matched evidence, verdict, model and version — retained on your schedule.
Fail-closed defaults
When the policy engine can't decide, the call is refused and escalated. Availability is a trade you make deliberately.
Early access
We're onboarding a handful of teams with a model already in front of customers. Tell us what your agent can reach and what it must never do, and we'll show you how that becomes a policy you can test and prove.
Or email hello@guardmoat.com directly.