The firewall finds leaks in every action and scores prompt injections in every session.

Before each decision, Paidwen reads the parameters of the action. It counts the secrets, the payment card numbers, the IBANs and the email addresses, and your rules read these counts. A value it finds is masked before the journal and before an approval request: the agent keeps the real parameters, on your side.

Beside the decisions, a model reads the messages of your users and the outputs of your tools. It scores how strongly each text tries to override the instructions of the agent, and your rules read the highest score of the session.

Your rules read five fields.

firewall.secrets: the distinct secrets, found by the 217 content rules of gitleaks.
firewall.cards: the distinct card numbers that pass the Luhn check.
firewall.ibans: the distinct IBANs whose check digits and country format are valid.
firewall.emails: the distinct email addresses whose domain has a public suffix.
firewall.injection: the highest prompt injection score of the session so far, between 0 and 1. It is 0 until the model scores a text of the session.

CEL

firewall.secrets > 0
firewall.ibans > 0 && tool.kind == "http"
firewall.emails > 100
firewall.injection > 0.9

The first rule can block an action that sends a key. The second can wait for a human before bank details leave over HTTP. The third can note an export of more than 100 addresses. The fourth can stop a session whose content tries to take over the agent: LlamaFirewall, the firewall of Meta, blocks from 0.9.

The model scores each session beside the decisions.

The model is Llama Prompt Guard 2 22M, from Meta. It scores a text as malicious when the text explicitly tries to override the instructions the agent received: prompt injections and jailbreaks.
It reads the messages of the users and the outputs of the tools, never the system instructions.
It runs beside the decisions, never in their path: a decision takes no longer. The score of a text reaches the next decisions of its session.
A session keeps its score for 24 hours after its last scored text.
Paidwen sends no text to the model until a rule of your organization reads firewall.injection, active or in observation.

The model is measured on 21,395 public texts.

At 0.9, the threshold of Meta, a rule on firewall.injection catches 79.7% of the attacks, with 0.13% false positives. It catches 96.3% of the direct attacks of Gandalf, but 16.4% of the subtle injections of deepset. On benign texts, it fires on 0.02% of the instructions of Dolly, 0.29% of its Wikipedia passages, and 3.9% of the texts of NotInject, which carry the words of attacks.

Three settings let the model read a session.

The agent keeps its content, as it does by default.
The actions carry their session, through the context of the SDK (see Sessions).
The environment variable OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT is true in the process of the agent. The SDK then sends the output of each tool, and the OpenTelemetry instrumentations of your model client send the messages.

Start each rule in observation.

A rule in observation notes what it would decide and blocks nothing. Read what it caught in Actions for a week, then make it active. The preview of a rule replays the last 30 days with the same counts and scores.

The masked values keep their place.

A secret becomes [secret], a card [card], an IBAN [iban] and an email [email] in the journal and in the approval request, and in the texts that the model reads. The decision line keeps the four counts, the names of the gitleaks rules that found a secret, and the score of the session when a rule reads it.

The detectors come from gitleaks and Presidio, and the model from Meta.

The secrets follow the rules, keywords, entropy thresholds and allowlists of gitleaks, under the MIT license.
The cards, IBANs and emails follow the recognizers of Presidio, under the MIT license.
An email counts when its domain has a public suffix of the ICANN section of the Public Suffix List, under the Mozilla Public License 2.0.
The model is Llama Prompt Guard 2 22M, under the Llama 4 Community License. It runs on the servers of Paidwen.

The firewall has twelve limits.

It reads the parameters of the actions that go through the SDK.
A secret without a known shape, like a password, passes.
A secret encoded in base64, hexadecimal or percent encoding passes.
Names, postal addresses and national identifiers are not detected.
The cards and IBANs are read in ASCII digits, and the Mastercard series that starts with 2 is not read.
A detector never decides alone: only your rules block, wait or quarantine.
The score comes after its text: an action can run before the model scores the tool output that led to it.
The model reads English best. Meta measures a lower accuracy in other languages.
The model targets explicit attacks. A subtle injection often passes, and Meta writes that "adversaries may develop sophisticated attacks specifically to bypass detection".
The model reads the first 32 KiB of a text, in at most 8 segments of 512 tokens.
An action without a session reads a score of 0.
The queue of the model holds 10,000 texts. Beyond that, the oldest texts leave without a score.