<!-- https://avertgate.com/docs/ai-guard · Inspectors -->

# AI Guard

An optional model layer for semantic cases regex cannot see — intent, indirect instructions, fragmented leaks. It always runs *after* the deterministic checks.

## Two layers

| Layer | Phase | What it inspects | Setting |
| --- | --- | --- | --- |
| Layer 1 | Request | Outbound arguments and action intent; semantic exfiltration | `inspect_request` |
| Layer 2 | Response | Indirect prompt injection in returned results | `inspect_response` |

## Providers

| `provider` | Use |
| --- | --- |
| `typesafe` | TypeSafe AI Jev. The default. Typed JSON output, ~50–100 ms. |
| `ollama` | Local / on-premise model. |
| `openai` | OpenAI-compatible endpoints: vLLM, LM Studio, Azure, OpenAI. |
| `anthropic` | Anthropic API. |
| `custom` | Your own HTTP endpoint. |

## Configuration

<!-- policy.yaml -->
```yaml
guard_model:
  enabled: true
  provider: "typesafe"
  endpoint: "https://api.typesafe.ai/v1/classify"
  model: "jev-security-v1"
  timeout_ms: 1000          # fail-closed on timeout
  min_content_length: 10    # skip very short content
  inspect_request: true
  inspect_response: true
  thresholds:
    confidence: 0.6
```

## Structured output

TypeSafe AI Jev returns a typed decision instead of free text, so there are no parse errors:

<!-- decision.json -->
```json
{
  "allow": false,
  "threatCategory": "data_leak",   // jailbreak | injection | data_leak | abuse | none
  "confidence": 0.93,
  "reason": "Outbound email body contains customer table export"
}
```

## Failure behaviour

If the model errors or `timeout_ms` is exceeded the call is handled **fail-closed**. When the model is disabled or unconfigured, AvertGate runs with the Tier-1 deterministic checks only, at zero cost.

> **Data**: Which fields go to the guard provider, and where it runs, depends on configuration. If data must not leave your network, use a local Ollama/vLLM.