Skip to content
Docs

Data Protection & Guardrails

AgentWatch’s data protection runs inline at the gateway, before the request leaves the organization. That placement is the whole point: a tool that scrubs a trace after the fact has already let the data reach the provider.

What sensitive data does AgentWatch detect?

Section titled “What sensitive data does AgentWatch detect?”
Category Examples
PII Social security numbers, driver’s licenses, passport numbers, names, emails, phone numbers, addresses, dates of birth, IP addresses
Financial Credit card numbers, bank accounts, IBAN, SWIFT, routing numbers
Health / PHI Medical record numbers and diagnoses, under the HIPAA framework
Secrets Provider API keys (recognized by their prefixes), passwords, session tokens, private keys

Detection combines named-entity recognition, pattern matching, allow and deny lists, financial and health-specific detectors, and optional external DLP webhooks. Custom recognizers can be added per organization without code changes — proprietary part numbers, internal customer identifiers, regional ID formats — and severity can be overridden per category.

What happens when sensitive data is found?

Section titled “What happens when sensitive data is found?”

Four actions, selectable by policy:

  • Block — the request is rejected before it reaches the model.
  • Redact — matched spans are replaced with placeholders and the request continues.
  • Log only — detective mode, used while tuning a new pattern.
  • Risk score — a numeric score per request, recorded in the audit trail regardless of the action taken.

DLP also applies to MCP tool calls: every tool invocation’s arguments and response are scanned before being forwarded, which closes the gap where sensitive data moves through tools rather than prompts.

What guardrails are available?

Section titled “What guardrails are available?”

Prompt-injection detection, data-leakage detection, PII and secret guardrails are on by default; toxicity, hate speech, bias, adult content, copyright, and profanity guardrails are available and off by default. Additional checks cover gibberish and invisible-text injection. AWS Bedrock Guardrails can be used as an external engine, with fail-open or fail-closed behavior configurable.

Two properties matter operationally:

  • Detection runs before the prompt reaches the model, so a match blocks rather than annotates.
  • Guardrails apply to tool and context payloads too — MCP tool arguments and retrieved context blocks are checked before they are injected into a prompt, not just the user’s own text.

Can AgentWatch enforce the shape of model output?

Section titled “Can AgentWatch enforce the shape of model output?”

Yes. A JSON Schema can be attached per route, in either direction. Inbound, malformed requests are sanitized or rejected. Outbound, a non-compliant model response is rejected, logged, coerced, or automatically re-prompted with a hint that the previous response did not match the schema — so only valid structured data reaches the application.

Is there a web application firewall?

Section titled “Is there a web application firewall?”

Yes, with both conventional and AI-specific rules. Conventional rules cover SQL injection, cross-site scripting, command injection, and path traversal. AI-specific abuse patterns cover token stuffing (a per-request token budget enforced before forwarding), prompt flooding (burst-rate ceilings), abnormal session blocking, header bombs, and oversized payloads. Rules run in detect or block mode, and rate limiting, CIDR allowlisting, and circuit breakers form a defense-in-depth chain in front of the model.

How is this tuned to avoid false positives?

Section titled “How is this tuned to avoid false positives?”

Detection confidence thresholds are configurable per category, the recognition model can be sized for the precision the deployment needs, results are cached so repeated content is checked cheaply, and log-only mode exists specifically so a new policy can be validated against real traffic before it starts blocking. Name detection in particular is tuned to avoid firing on ordinary factual questions.

Sources and references

Section titled “Sources and references”