← Back
Home › Systems › AI and agent security

agent-guardrails

prompt-injection defense and permission system

Claude Code permissions

SystemTechniques · 17Primitives · 68 agent-guardrails Human-in-the-loop approvalagentic-ai · medium: Classify each proposed action as auto, ask or deny; park asks as durable pending records a human approves, edits or rejects, executing once, with timeouts that deny.›Prompt injection defenseagentic-ai · medium: Treat every untrusted string as data, track where values came from, and make tool calls and rendered output depend on provenance, not on what the model says.›Text classificationmachine-learning · medium: Assign one or more labels to a text; climb a ladder from regexes to linear models on n-grams, embeddings, fine-tuned encoders and LLM prompts, only as far as the data and budget demand.›Linear-time regular expression matc…search-sort · medium: Match a regular expression in O(pattern x text) worst case by tracking all live parse positions at once, then cache the state sets as a lazily built DFA for speed.›Egress proxy filteringsecurity · medium: Forcing sandbox network traffic through a proxy with domain allowlists, TLS SNI checks and request loggingPolicy engines (PDP/PEP, Cedar, Reg…security · medium: Decide allow/deny for (principal, action, resource, context) in a separate engine with default deny, forbid-wins and an auditable list of determining policies.›Taint trackingsecurity · medium: Track untrusted sources to sensitive sinks through dataflowLeast privilege and isolationsecurity · low: Assume every component will be compromised and limit what it can then reach: narrow identities, separate accounts, sandboxed processes.›Aho-Corasick multi-pattern matchingsearch-sort · low: Find all occurrences of many fixed patterns in one pass over the text, in time independent of the pattern count, using a trie with failure links.›Glob matchingsearch-sort · low: Glob/gitignore pattern matching without backtracking blowupAuthorization models (RBAC, ABAC, R…security · low: How to decide who may do what to which object; roles for coarse rules, relationships for sharing, and checks on every object.›Agent sandboxingagentic-ai · unknown: Agent tracingagentic-ai · unknown: Constrained decodingagentic-ai · low: Force LLM output to match a regex, JSON schema or grammar by masking, at every step, the tokens that would leave the language.›Shell command parsingcompilers · low: Tokenizing and parsing shell commands (quotes, pipes, substitutions) to evaluate permission rulesCapability-based security (object c…security · low: Authority is a handle you hold, not an identity you have: code can only act on objects it was explicitly given handles to, and handles can only be narrowed and passed on.›Capability tokenssecurity · low: Unforgeable, attenuable tokens granting specific rights (macaroons, biscuits, object capabilities)Secret scanningsecurity · low: Detect committed credentials with provider-specific patterns, entropy checks and live verification, then revokeStatechartsgraphics · low: State machines with nesting, parallel regions, history and entry/exit actions, so UI and animation logic stays linear in size instead of exploding.›Dual control approvalsecurity · low: Four-eyes / maker-checker approval with quorum policies for sensitive operationsHierarchical timing wheelsystems · low: Timers bucketed by expiry into wheels of slots, coarser wheels for far deadlines: O(1) insert and cancel for millions of timeouts.›Html sanitizationsecurity · low: Allowlist-based HTML sanitizing of untrusted markupByte-pair encoding (BPE) tokenizati…machine-learning · low: Learn a subword vocabulary by repeatedly merging the most frequent adjacent pair; byte-level BPE encodes any input losslessly with 32k-200k tokens.›+ 10 more techniques+ 52 more primitives

Similar systems

Share the most building blocks with this one.

llm-guardrails 21 %agent-gateway 17 %llm-dlp 17 %support-agent 16 %