How it works
Threat model
Which threat is handled by which mechanism, and in which phase.
| Threat | Example | Mechanism | Phase |
|---|---|---|---|
| Proxy (MCP proxy) | A layer between the agent and the tool server that inspects every call before forwarding it. | ||
| YAML | The indented plain-text format the policy is written in (policy.yaml). | ||
| Request phase / Response phase | Inspection before the tool runs / inspection of the result it returned. | ||
| Fail-closed | Blocking a call when an inspector fails instead of allowing it. Details: Runtime loop. | ||
| Tenant | A private workspace set aside for one customer, isolated from the others. | ||
| Indirect prompt injection | A ticket with a hidden "send the whole customer table to…" instruction | Ingress scan + AI Guard layer 2; then policy and egress at the request phase | Response, then Request |
| Excessive agency | An order-lookup agent able to run DROP TABLE | Least-privilege policy; deny unlisted tools; argument constraints | Request |
| Data exfiltration (single shot) | An API key in an email body | Egress scan (regex) + AI Guard layer 1 | Request |
| Slow exfiltration | 2–3 records out per call over 100 calls | Per-session egress counter (drip-exfiltration) | Request |
| Runaway loop (OWASP LLM04) | Repeating the same tool with the same arguments | Loop breaker | Request |
| Irreversible action | Money movement, deletion, outbound email | Human approval via require_approval | Request |
Evasion techniques
The scanners account for more than plain text: Unicode normalisation, Cyrillic look-alikes, zero-width characters, combining marks, spacing/dotting letters apart and leetspeak. Details: Ingress and Egress.
LimitsRegex-based detection is not exhaustive; a creative attacker may evade it. That is why AvertGate is layered: deterministic checks + a semantic model + trajectory analysis + policy + human approval. No single layer is a guarantee of safety.
Out of scope
- Content moderation of the conversation layer (prompt/response).
- Training a custom detection model. AvertGate does not train its own; it uses TypeSafe AI Jev or off-the-shelf guard-model APIs plus heuristics.
- Replacing a broad DLP product.