CleverGuard

CleverGuard is the content scanning engine that inspects every piece of data flowing through your AI agents. It detects PII, prompt injection attempts, leaked secrets, and toxic content, then takes action based on your guardrail profile.

Key Concepts

What CleverGuard scans

CleverGuard runs four scanner types on agent traffic:

PIINames, emails, phone numbers, SSNs, addresses. Regex (standard) or regex + ML classifier (strict).

Prompt InjectionAttempts to override system instructions. Regex + ML classifier (standard) or regex + ML + LLM classification (strict).

SecretsAPI keys, passwords, tokens, connection strings. Pattern-based detection.

ToxicityHarmful, offensive, or inappropriate content. Standard or off (no strict mode).

Direction-specific scanning

CleverGuard scans input (data going to the agent) and output(data coming from the agent) independently. Each direction has its own action setting from the guardrail profile's data handling section:

Flag — Log the finding as a DLP event but allow the data through.
Redact — Mask the sensitive content before forwarding (e.g., replace SSN with ***-**-****).
Block — Reject the request entirely and return an error to the caller.

Scanner configuration

Each scanner can be set to strict, standard, or off (toxicity supports standard and off only). These levels are controlled by the guardrail profile attached to the agent (compiled from Agent Review questionnaire answers). Agents without a guardrail profile run with default standard settings.

CleverGuard scanner results showing a DLP event with PII detection, the matched content highlighted, and the action taken (redact)

CleverGuard logs every detection as a DLP event, showing what was found, where, and what action was taken.

Understanding a DLP Event

A scan is triggered

When an agent sends or receives data, CleverGuard automatically runs all enabled scanners against the content. This happens inline — before the data is forwarded.

Findings are evaluated

Each scanner reports its findings with a confidence score and the matched content span. CleverGuard checks the guardrail profile to determine the action for this direction (input or output).

Action is taken

Based on the data handling configuration:

Flag: The DLP event is logged and the data passes through unchanged.
Redact: Sensitive spans are replaced with placeholder tokens before forwarding.
Block: The entire request is rejected with an error response.

Diagram showing data flow through CleverGuard: input arrives, scanners run, action is applied, output continues or is blocked

Data flows through the scanner pipeline. Each finding triggers the configured action for that direction.

DLP event is recorded

Every finding is logged as a DLP event in cleverguard_dlp_events with the scanner type, finding details, confidence, action taken, and session context. These events appear in the SOC Console security feed and are available for audit export.

URL blocking

CleverGuard can strip URLs from agent traffic to prevent data exfiltration via URL-encoded payloads — a common attack vector where a compromised agent encodes sensitive data into a URL. URL blocking is controlled independently for each direction via the guardrail profile (from questionnaire item N3):

Output blocking (block_urls_in_output) — strips URLs from agent responses. Prevents exfiltration.
Input blocking (block_urls_in_input) — strips URLs from incoming messages. Prevents URL-based injection payloads.

Tip

Both directions also support blocking data URIs (data:, javascript:, blob:) which are common exfiltration vectors. Each direction is configured independently in the guardrail profile.

Custom content rules

Beyond the built-in scanners, you can define custom content rules via the guardrail profile's llm_policy field. This is a free-text policy statement injected as a hard constraint into the scanner, allowing you to flag domain-specific sensitive content (e.g., internal project code names, unreleased product details).

Guardrail Profiles SOC Console Audit Trails Emergency Controls