AI Security Architecture
Your Board Can Approve.
DataGrout enforces security at the infrastructure layer — not in prompts. Multi-tier prompt injection defense, policy cascade, PII redaction, scoped credentials, human approval gates, and complete audit trails on every agent action.
The AI Security Gap You're Being Asked to Sign Off On
Engineering teams are deploying agents to production. Security teams are being handed the risk without the controls.
Agents are touching production systems with no audit trail
AI agents are being deployed by engineering teams with broad credentials and no logging. When something goes wrong, you can't answer 'what did the agent do?' — let alone prove it to a regulator.
Prompt injection is a real and underestimated attack surface
Any agent that processes untrusted input — emails, documents, user messages, tool outputs — is vulnerable to prompt injection. Single-pass classifiers are easily bypassed. The attack can override system prompts, exfiltrate data, and hijack agent behavior.
Credentials are over-scoped and under-revoked
Teams connect AI agents to Salesforce, QuickBooks, and internal systems using broad API keys. There's no fine-grained scope, no instant revocation path, and no visibility into which agents are using which credentials.
Compliance requires proof, not promises
SOC 2, HIPAA, and internal audit requirements don't accept 'the agent was prompted to behave correctly.' You need cryptographic evidence of what ran, what policy governed it, and what data was accessed.
Six Independent Layers. All Composing Together.
Detection alone isn't enough. DataGrout also constrains what a compromised agent can do — even if an attack slips past detection.
Multi-Tier Prompt Injection Defense
Warden runs three independent detection tiers — a structural canary probe, a semantic intent lens, and a Prolog-backed adjudication engine — composing into a weighted ensemble. An attacker must defeat all three simultaneously. Even if injection succeeds, the enforcement layer blocks the resulting actions independently.
- warden.canary: structural integrity checks + Unicode/bidi/control-char defenses
- warden.intent: semantic intent analysis — detects authority claims and goal divergence
- warden.adjudicate: Prolog rule evaluation with fact/rule scoring and grounded evidence
- warden.ensemble: all three tiers in one call with multi-turn session tracking
Policy Enforcement at the Infrastructure Layer
Security controls live at the platform layer, not in prompts that agents can drift from. SemanticGuard enforces side-effect restrictions, destructive operation blocking, PII field-level enforcement, and integration allowlisting — before any upstream call is made.
- Side-effect controls: None / Read / Write / Delete tiers enforced per agent
- Destructive operation blocking: hard-stops on delete/bulk-update without human approval
- PII auto-redaction: email, phone, SSN, credit card stripped from responses before the agent sees them
- Policy cascade: server → integration → per-call, restrictions are monotonic (can only tighten)
Cryptographic Proof via Cognitive Trust Certificates
Every governed workflow produces a Cognitive Trust Certificate — an Ed25519-signed cryptographic proof that the plan was cycle-free, type-safe, policy-compliant, and within budget, before execution, and that those properties held after. Shareable links let auditors verify without a DataGrout account.
- Signed at compile time (plan verified safe) and updated at runtime (execution receipt)
- Covers: who called what tool, under which policy, what data was accessed, what it cost
- Tamper-evident end-to-end — signature chain detectable if anything was modified
- Independent verifier: share a CTC link — auditors verify without access to your systems
Scoped Credentials & Instant Revocation
Per-connector credential scopes limit what each agent can access. Leaked keys are just souvenirs — scoped to a specific integration and revocable instantly without touching application code.
- Per-connector OAuth scopes — agents can't access beyond their declared surface
- Kill switch: revoke any tool, connector, or agent access instantly
- IP allowlisting per connector for additional network-layer restriction
- Private Connectors: outbound-only VPN for on-prem — zero inbound firewall exposure
Human Approval Gates for Sensitive Operations
flow.request-approval pauses any workflow for human review before destructive, financial, or first-run operations execute. The final safety net when automated policy isn't enough.
- Configurable by operation type: delete, bulk-write, first-run, cost threshold
- Approval gate blocks execution — downstream tools never fire without sign-off
- Composable inside any multi-step workflow via flow.into
Persistent Security Constraints Across All Workflows
logic.constrain lets you define security rules once — 'no agent may exfiltrate data to external URLs,' 'responses must never contain SSNs' — that flow.into checks automatically before executing every matching workflow step, org-wide.
- Constraints defined once, enforced automatically across all agents on the server
- Rules survive prompt changes — agents can't forget what was never in a prompt
- Auditable as infrastructure-enforced policy, not instructional text
The Complete Security Stack
Detect
- Warden 3-tier ensemble: canary + intent lens + Prolog adjudication
- Multi-turn session tracking detects fragment assembly and escalation patterns
- Confidence scoring with categorized threat types and evidence excerpts
Enforce
- SemanticGuard: side-effect controls, destructive op blocking, PII redaction
- Policy cascade from server → integration → per-call; can only tighten
- Human approval gates before destructive or financial operations
Prove
- CTCs: Ed25519-signed proof of every workflow — before and after execution
- Tamper-evident audit trail: who, what, when, under which policy, at what cost
- Shareable verifier links for auditors — no DataGrout account required
Security That Lives in the Infrastructure, Not the Prompt.
Give your agents the security posture they need — and give yourself the audit trail you need to stand behind it.