Safety Guardrails & Tripwires

Security in Agent Substrate operates as a middleware pipeline executed before and after every LLM completion and tool invocation.

Tripwire Architecture

Unlike basic prompt injection defenses that rely solely on system prompt phrasing, Agent Substrate evaluates inputs against deterministic rules and heuristic classifiers:

from substrate.agents import ReActAgent
from substrate.agents.middleware.guardrails import (
    PromptInjectionGuardrail,
    PIIRedactionGuardrail,
    ToolCallValidator
)

agent = ReActAgent(
    model="claude-3-7-sonnet",
    middleware=[
        PromptInjectionGuardrail(sensitivity="high", on_violation="halt"),
        PIIRedactionGuardrail(redact_types=["ssn", "credit_card", "api_key"]),
        ToolCallValidator(allowed_risk_tiers=["low", "medium"])
    ]
)

Guardrail Features

1. Pre-Turn Prompt Injection Filter: Intercepts jailbreaks, delimiter injections, and system prompt overrides before tokens reach the LLM.
2. PII Masking: Automatically detects Social Security numbers, credit cards, and sensitive tokens, replacing them with anonymous tokens ([REDACTED_SSN]) before storing them in logs.
3. Tool Call Schema Validation: Verifies that generated parameters strictly adhere to expected JSON schemas, rejecting malformed calls before execution.