One gateway between your agents and the models
AI-FW intercepts every AI call, inspects the prompt, enforces policy, routes to the right model, and audits the result. Here is how each layer works.
Safeguarding the agentic workforce
AI-FW couples identity and access management with an inference firewall, so every agent is identified, authorized, inspected, and governed.
Built for every layer of AI governance
Explore the platform by the problem it solves for your team.
Guardrails
Every prompt and response, scanned in real time
Built-in rules run on every request, in a fixed evaluation order: jailbreak and prompt-injection detection, PII masking, toxicity filtering, and data-exfiltration blocking. Add your own regex, keyword, and semantic rules, or let AI draft them for you.
Highlights
- Four built-in guardrail classes, enable or disable each one
- Custom rules with block / mask / accept / log-only actions
- Source-IP and destination-IP scoping on every rule
- Deny-by-default mode when nothing else matches
- Structure-preserving rewrites, tool calls survive intact
Semantic intent analysis
Judge meaning, not just text
Describe a policy in plain language, “detect requests to exfiltrate secrets”, and AI-FW scores every request against it. Choose between three scoring engines, from cloud embeddings to a fully offline model that never leaves your network.
Highlights
- Natural-language policy descriptions with block and flag thresholds
- Three engines: embeddings API, chat classifier, or offline ONNX
- Flag band escalates risk scores without blocking
- Long content scored in head + tail segments, no smuggling past the cutoff
- Fail-closed: a scoring error blocks the request, never forwards it unjudged
Model routing
The right model, the right backend, every time
A central model registry holds every model your org is allowed to call, with its own provider, backend URL, and API key. Routing rules steer requests by agent, group, tag, IP, model, risk, or header; strict mode rejects anything unregistered.
Highlights
- Model inventory with per-model keys, corporate keys stay server-side
- Conditional routing rules: first match wins, ordering expresses priority
- Strict-model toggle blocks unregistered or shadow models
- Default model and default backend fallbacks
- Shadow AI discovery flags models you didn’t configure
Identity & access
Know exactly who, or what, is calling
Authenticate human users and machine agents alike: API keys, JWT, mutual TLS, or Kerberos for domain-joined agents. Four RBAC roles scope the admin surface, and OIDC SSO plus SCIM provisioning plug into your identity provider.
Highlights
- Agent identity via API keys, JWT, mTLS, or Kerberos
- Four admin roles: Admin, Read-Only, AI-FW Admin, Agent-Trust Admin
- OIDC SSO with runtime role mapping and safe default
- SCIM 2.0 provisioning for users and role groups
- Risk-scored identities: users, agents, and IPs
Risk & audit
Visibility without retention
Every transaction is logged with metadata, model, identity, latency, decision, truncated previews. Raw content is never persisted. Live dashboards show allowed vs blocked traffic, risk leaderboards, and audit events for every change.
Highlights
- Metadata-only transaction log, zero content retention
- Risk auto-block: violations in a rolling window trigger cooldown
- Per-category risk cards: semantic, PII, PCI, health data
- Audit events for configuration and security changes
- Log export: pull API plus syslog forwarding
Reliability & caching
Fast, resilient, and cost-aware
Per-model resilience policies retry, fail over, or distribute across backends. An opt-in completion cache re-serves exact and near-duplicate prompts, with strict identity and tenant isolation so cached answers never leak across callers.
Highlights
- Per-model retry limits, failover, and weighted distribution
- Exact + semantic completion cache (local embeddings)
- Cache scopes per agent, group, model, or global, first match wins
- Streams and flagged content are never cached
- Anonymous caching off by default; identity-salted keys
Native for the tools your teams actually use
Speak OpenAI or Anthropic, AI-FW translates between them. Claude Code, Cursor, OpenAI SDKs, MCP tools, and M365 Copilot all flow through the same inspection pipeline.