Runtime security API and local gateway

Stop unsafe AI actions before execution.

Inspect untrusted input, model output and tool calls against a versioned project policy. Use the hosted Guard API for immediate integration or the customer-operated gateway where traffic must remain inside your environment.

Default production modeENFORCE

Hosted Guard API

Scoped API keys, idempotent request IDs, monthly quotas, immediate revocation and privacy-safe event evidence.

Input and output screening

Block instruction override, hidden prompt extraction, secret leakage, unsafe network instructions and encoded attacks.

Tool-call enforcement

Allow or deny tools, hosts, paths and material actions. Require transaction-bound human approval where policy demands it.

Operational evidence

Store decisions, rule identifiers, digests, latency and bounded metadata—not raw prompts, responses or tool arguments.

Hosted enforcement

One request before every model or tool boundary.

Open control plane

curl -sS https://agentrisklayer.com/v1/guard \
  -H "Authorization: Bearer arl_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "request_id": "agent-step-123",
    "input": "Customer request and retrieved context",
    "tool_call": {
      "name": "crm.read",
      "arguments": {"customer_id": "cust_123"},
      "context": {"environment": "production"}
    }
  }'

A repeated request_id returns the original decision without double-counting usage. API keys are shown once, stored as hashes and can be revoked immediately.

Customer-operated gateway

For systems where runtime content must never leave your network, deploy the signed local gateway in front of the tool service.

node agent-risk-runtime.mjs \
  --policy runtime-policy.json \
  --upstream http://127.0.0.1:3000 \
  --port 8787 \
  --audit runtime-audit.jsonl

Download runtime gateway Download example policy

Security boundary

Protection applies only to requests routed through the Guard API or local gateway.
Prevent direct access to protected tools using network controls and service authentication.
The hosted service processes submitted content transiently for evaluation but persists only digests, rule IDs and bounded metadata.
The local gateway can keep runtime content inside the customer environment.
No runtime filter replaces least privilege, sandboxing, secure tool design or independent testing.