Guardrails and Content Safety

Built-in (@presidio-dev/hai-guardrails): Prompt injection (ON), data leakage (ON), PII (ON), secret (ON), toxicity (OFF), hate speech (OFF), bias (OFF), adult content (OFF), copyright (OFF), profanity (OFF). LLM Guard: Gibberish, invisible text detection. Prompt injection detection at the gateway: semantic prompt-guard + keyword/syntax pattern matching + anomalous behaviour analysis. Detection runs before the prompt reaches the upstream LLM; matches above the configured threshold block the request and emit a dlp.violation-class event. Output schema enforcement: when a route has a JSON Schema attached (Section 27), non-compliant LLM responses are intercepted and either rejected (502), warned (logged), transformed, or re-prompted — ensuring only valid structured data reaches the client. External: AWS Bedrock Guardrails, circuit breaker, fail-open/fail-closed. Apply scope: guardrails run on both input prompts AND tool/context payloads (MCP tool arguments + retrieved context blocks before they’re injected into the LLM prompt) — end-to-end compliance. Config: Thresholds (injection: 0.7, toxicity: 0.7), block-on-violation toggle. RBAC: managing guardrail policies requires guardrails.manage; viewing audit logs requires guardrails.audit.

---