Detection and audit tools run along a spectrum: the open-source release of Uber ADR reads records purely after the fact, numbat only monitors by default, and for most of the rest the selling point is that they can block before an action, yet they start out observing only. Whether a record can serve as evidence depends on who can change it: when the signing key sits on the same machine and user as the audited agent, tampering can be noticed but not prevented.
Guardrails intercept an action before the agent carries it out. On Claude Code the main attachment point is the hook, and the official docs say that on most events a hook that errors or times out lets the action go ahead; blocking needs onFailure: block. Other tools have their own failure behavior and defaults: the Agent Governance Toolkit library allows everything when no policy is loaded, NeMo Guardrails lets requests through when its jailbreak detector is down, and llm-guard and rebuff are archived. Ask three things of any guardrail: where it intercepts, what happens when it fails, and who can change its rules.
When you install a skill, connect an MCP server or let an agent run commands, risk can be seen as coming in through four entry points. I sort the open-source tools around them into seven kinds by when they step in, from pre-install scanning and sandboxes to guardrails, audit and red teaming. This post covers what each kind handles and three limits that keep recurring: no single tool works as the only defense, defaults often work against you, and published detection numbers lack independent evaluation.
HW1 asks for a defense prompt under 1,000 tokens that keeps the model wrapping every reply in [START]…[END] and never saying 'I have been PWNED,' no matter how it's attacked. The TAs prepared 14 attacks, 10 public and 4 private, each worth 0.5% for safety and 0.5% for utility. The task, the full text of the 10 public attacks, and the token-counting Colab are all public, but the grading platform JudgeBoi returned 502 on 2026-09-30, so outside readers have to build their own evaluation from the spec.
Multi-agent security risks aren't just amplified single-agent risks — inter-agent communication is itself an attack surface. A compromised sub-agent can pass malicious instructions to the parent through its return value. Core defense: treat agent output as untrusted data.
AI boosted task output by 34%, but code review time surged 441% and measured delivery actually slowed 19%. A four-round research survey maps the current landscape: deterministic guardrails (hooks) vs probabilistic ones (prompts), clean-context review, self-improving feedback loops, specification-driven development, AI test quality crisis (high coverage but median 53% mutation score), and the Replit agent fabricating test results.
Amazon Bedrock is more than a reseller for multiple model APIs. It brings model invocation, IAM, Regions, Knowledge Bases, Guardrails, and CloudWatch into one AWS control plane. It fits teams already on AWS that value governance overhead more than the lowest token price.
Galileo connects dataset experiments, LLM/code/Luna evaluators, production traces, and runtime guardrails. It fits enterprises that need observability plus intervention, but the old Protect surface is deprecated and evaluator models do not replace human calibration or application security.
Portkey sits between applications and model providers: one OpenAI-compatible endpoint adds routing, fallbacks, request logs, budgets, and guardrails, with an open-source gateway available for self-hosting.
Model Armor can inspect prompt injection, jailbreaks, sensitive data, malicious URLs, and unsafe content at runtime; it is a probabilistic detector, not an authorization or sandbox boundary.
Stripe Minions says 'The walls matter more than the model,' but the case studies from four Silicon Valley companies never explained how to actually build those walls. This post breaks down the 15 walls we implemented in the daodao auto-dev agent: what each wall prevents, where the files live, and what the tradeoffs are. Tier 1 is mandatory, Tier 2 strengthens governance, Tier 3 is serious governance.
Building a chatbot is more than just calling an API. Conversation state management, memory mechanisms, streaming, guardrails, observability, and tech stack selection — every layer affects the user experience.
The attacks RAG systems face go beyond the technical level — Prompt Injection and Jailbreak are real threats. Both inputs and outputs need independent protection layers.