Complete feature reference
What the firewall inspects, what it does when a rule fires, who decides, and what it records. Rule ids, scores and thresholds are the real ones from the shipping code — not a marketing summary of them.
Tier‑1 matching runs over a normalised copy of the text — base64 expanded, zero-width characters stripped — so the easy evasions fail before the signatures even run. The default action per category is policy, not a hardcoded table.
| Category | What the signatures look for | Default |
|---|---|---|
| Prompt injection | Ignore-previous-instructions, system-prompt reveal and override, spoofed
[SYSTEM] and <system> blocks, tool-result injection |
block |
| Jailbreak | DAN, developer-mode, "no restrictions", unrestricted-roleplay framings | block |
| Personal data | Email and SSN. Gulf identifiers too: Emirates ID and card PAN (both Luhn-checked), GCC IBAN, GCC phone, passport (context-gated), name | redact gulf: monitor |
| Secrets | JWTs, AWS keys (AKIA and ASIA), sk- tokens,
inline api_key / secret / password /
token assignments |
redact |
| Toxicity | Six independently scored sub-categories. Hate, harassment and sexual content flag; violence, self-harm and illicit content block. Bundled lexicon, operator-overridable | monitor |
| Indirect injection | The same injection and jailbreak detectors run across tool and RAG output, not only user text. Those events are tagged as coming from context rather than the caller | block |
Three checks that only mean anything on the way out. Each is independently switchable and severity-configurable per tenant, and all three ship in monitor until you promote them.
| Rule | Score | Catches | Tunable |
|---|---|---|---|
| exfil_channel | 87 | Image or link URLs encoding a payload in the query, path or fragment — the
 trick. Also zero-width and
bidi-control Unicode, and high-entropy base64 or hex blobs. Fires independently of URL
reputation |
4.0 bits/char 24 chars |
| url_reputation | 83 | Every http(s) URL in a response checked against a local allow/deny
list. Denylisted blocks, unlisted flags, allowlisted passes. Sits behind an adapter, so
a commercial feed can replace the local list without touching call sites |
local lists |
| ungrounded_claim | 65 | Answer claims the retrieved context does not support. Lexical token overlap, with no embedding or model call. Supply no context and the rule is skipped entirely rather than guessing — it will not invent a false flag | 35% overlap |
For tool-using agents there is a separate tool-call stage: per-identity authorisation for which tools a caller may invoke, inspection of MCP and tool output before it re-enters the model's context, and a synchronous human-in-the-loop webhook for calls that should wait for a person.
Each tenant is in monitor or enforce. Monitor screens and records everything and blocks nothing — and it is where an unconfigured tenant lands, with every category switched on. You tune against your own traffic before anything starts failing closed on your users.
Exceptions are hashed per tenant and category and suppress a matched span. Every suppression still emits its own audit event, so the exception is on the record rather than a silent hole. On an internal error the request fails open by default; one environment variable reverses that for deployments where a missed screen is worse than a dropped request.
Signatures are fast and explainable but blunt at the margins. Two optional tiers pick up the ambiguous band. Both are off unless you enable them, both run on your own infrastructure, and both validate the target host so escalation cannot quietly become an egress path.
Scored signatures over normalised text, in-process. Always on.
An ambiguous Tier‑1 score escalates to an on-tenant Llama-Guard-class classifier. Fails closed. Configured per category, each with its own escalation band and timeout.
off by default
Residual in-band hits go to an on-tenant judge model for the policy nuance a classifier cannot carry. On failure it retains the prior verdict rather than guessing in either direction.
off by default
Model weights are your infrastructure decision. What ships is the escalation contract and the calling seam, not a bundled model you have to trust.
Three checks sit in the pipeline before the provider is dispatched to, independent of content screening. Turn the firewall off entirely and these still apply.
| Control | Behaviour | On breach |
|---|---|---|
| Rate limit | Fixed-window request threshold per tenant | 429 + Retry-After |
| Model allow-list | Rejects a request naming an unlisted model before the upstream call, so no token usage is ever recorded against it | 403 |
| Token budget | Blocks once cumulative cost for the period meets the cap. The request that crosses the cap completes — cost is only knowable once the response returns | 403, next request |
Breaches land in the same audit trail as every content decision. No second schema, no separate dashboard to check.
Every verdict is an event — including the allows. Tenant-scoped, time-limited by a retention policy, RBAC-gated, with prompt excerpts behind their own separate permission that is deny-by-default. Someone who can see that a request was blocked cannot necessarily read what it said.
Those aggregates join against per-category control mappings to produce an evidence pack you can export as JSON or HTML:
Region packs for the UAE, UK, EU, Australia and US map redaction, residency and audit-trail evidence to counsel-confirmed citations for each jurisdiction.
Be clear on what that is, though: evidence for the technical controls this thing actually enforces. It is not a gap assessment and it is not a compliance programme — that is the Cyber Suite's job, not this download's.
Run it in monitor mode for a week. If it never catches anything, you have learned something useful for free.