Prompt Injection Protection
for AI Agents
Prevent prompt injection before it silences your system prompt, exfiltrates data, or hijacks your agent's behavior. Prompt injection is the #1 security risk for LLM-powered agents — and detection alone isn't enough.
DataGrout also constrains what a compromised agent can do — even if an attack slips past detection.
Free to start · No credit card required
Prompt Injection Attack Taxonomy
Prompt injection attacks aren't just "jailbreaks." Modern attacks are sophisticated, multi-vector, and specifically designed to exploit agentic AI systems that can take real-world actions.
The DataGrout Defense Stack
Detection alone isn't enough. DataGrout also constrains what a compromised agent can do even if injection gets past detection. Six independent layers, all composing together.
Warden
4-tier detection: Unicode scanner, canary probe, intent lens, Prolog adjudication. Session tracking catches multi-turn fragment assembly.
Input Sanitizer
Untrusted content wrapped in XML container tags, control chars stripped, length limits enforced before any content reaches an LLM prompt.
SemanticGuard + Policy
Even if injection succeeds, the agent can't act dangerously. Side-effect restrictions, destructive op blocking, PII enforcement, integration allowlisting.
Starlark + Prolog
Code runs in a Rust NIF sandbox — no filesystem, no network, no imports. Prolog uses a ~70-predicate whitelist; everything else throws permission_error.
CTCs
Ed25519-signed Cognitive Trust Certificates prove every workflow was cycle-free, type-safe, policy-compliant, and untampered — before and after execution.
Human-in-the-Loop
Policy-driven pause via flow.request-approval for destructive, high-cost, or first-run operations. The final safety net.
4-tier detection: Unicode scanner, canary probe, intent lens, Prolog adjudication. Session tracking catches multi-turn fragment assembly.
Untrusted content wrapped in XML container tags, control chars stripped, length limits enforced before any content reaches an LLM prompt.
Even if injection succeeds, the agent can't act dangerously. Side-effect restrictions, destructive op blocking, PII enforcement, integration allowlisting.
Code runs in a Rust NIF sandbox — no filesystem, no network, no imports. Prolog uses a ~70-predicate whitelist; everything else throws permission_error.
Ed25519-signed Cognitive Trust Certificates prove every workflow was cycle-free, type-safe, policy-compliant, and untampered — before and after execution.
Policy-driven pause via flow.request-approval for destructive, high-cost, or first-run operations. The final safety net.
Key Differentiator
Every other prompt injection tool focuses on detection. DataGrout also enforces: even a successfully injected payload can't exfiltrate data, write to systems, or execute dangerous code — because the policy, sandbox, and approval layers block it independently of whether Warden caught the attack.
Free to start · No credit card required
3-Tier Prompt Injection Detection
Three independent detection methods compose into a weighted ensemble. An attacker must defeat all three simultaneously.
warden.canary5–20 creditsT1 — Canary
Structural integrity check. Runs multiple independent verification tasks against untrusted content using a validator model. Also includes built-in bidirectional text detection, hidden Unicode selector scanning, control character scanning, and format smuggling defenses. Content containing injected instructions will interfere with the validator's ability to comply, producing detectable failures.
Why This Matters
Catches a large class of injection techniques that don't require semantic understanding — hidden Unicode, bidi overrides, homoglyphs, outright model hijacking. Best for scanning documents, emails, and tool outputs. Note: does not perform semantic intent analysis — use warden.intent for user-facing inputs.
Which tool to use
warden.intentRight default for user-facing inputs — semantic intent analysiswarden.canaryStructural probe + Unicode/bidi/control-char defenseswarden.adjudicateExplains why something was blocked with grounded evidencewarden.ensembleFull pipeline — all three tiers in one callUse Warden as a Flow Gate
Place warden.ensemble as the first step inside flow.into, then use flow.route to branch on the verdict. Downstream tools never execute if the verdict is block — injection detection is enforced at the workflow layer before any action runs.
"I need to..." → Tool
Warden leads for prompt injection detection, but security-conscious developers combine it with these suites for complete agent governance.
Warden detects. SemanticGuard enforces. Flow requires approval. Invariant audits code. Inspect provides forensics. CTCs prove nothing was tampered with.
Protect your agent in 5 steps
From zero to full defense-in-depth. Each layer is independent — enable incrementally.
pip install datagrout-conduit==0.3.0
from datagrout.conduit import Client
# Connect using a bearer token (simplest method)
# For mTLS, call Client.bootstrap_identity() once — no tokens needed afterward.
async with Client(
"https://gateway.datagrout.ai/servers/{uuid}/mcp",
auth={"bearer": "your-access-token"}
) as client:
tools = await client.list_tools()# Gate tool calls: call warden.ensemble as the first step inside flow.into,
# then use flow.route to branch on the verdict.
# Downstream tools never execute if the verdict is "block".
#
# Tool name format: "data-grout@1/<suite>.<tool>@1"
result = await client.call_tool("data-grout@1/flow.into@1", {
"plan": [
{
"tool": "data-grout@1/warden.ensemble@1",
"args": {
"content": "$user_input",
"expected_context": {
"goal": "answer a customer support question",
"authority": "support agent",
"allowed_actions": ["read_tickets", "update_status"]
}
},
"output": "$warden_result"
},
{
"tool": "data-grout@1/flow.route@1",
"args": {
"value": "$warden_result.recommended_action",
"routes": {
"block": {
"tool": "data-grout@1/flow.request-feedback@1",
"args": {"message": "Input blocked by Warden."}
},
"warn": {"tool": "your_downstream_tool@1", "args": {}},
"allow": {"tool": "your_downstream_tool@1", "args": {}}
}
}
}
]
})# Call warden.ensemble proactively to screen untrusted content.
# Returns: passed, confidence (0-1), recommended_action (allow/warn/block),
# should_block, signals, failure_reason
#
# expected_context narrows the comparison scope — goal, authority, allowed_actions.
result = await client.call_tool("data-grout@1/warden.ensemble@1", {
"content": user_input,
"expected_context": {
"goal": "answer a customer support question",
"authority": "support agent",
"allowed_actions": ["read_tickets", "update_status"]
}
})
if result["should_block"]:
raise SecurityError(f"Injection detected: {result['failure_reason']}")
# For targeted single-tier checks:
# "data-grout@1/warden.canary@1" → structural/hygiene probe
# "data-grout@1/warden.intent@1" → semantic intent analysis (right default for user input)
# "data-grout@1/warden.adjudicate@1" → threat classification with grounded evidence# logic.constrain stores symbolic rules that apply across ALL workflows.
# flow.into checks these before executing any matching step.
await client.call_tool("data-grout@1/logic.constrain@1", {
"name": "no_external_exfiltration",
"rule": "agent cannot send data to external URLs without explicit human approval"
})
await client.call_tool("data-grout@1/logic.constrain@1", {
"name": "pii_never_in_output",
"rule": "responses must never contain email addresses, SSNs, or phone numbers"
})
# For operations that require a human pause before executing:
# call "data-grout@1/flow.request-approval@1" inside a flow.into plan step.Video walkthroughs
Setting up Warden in 2 minutes
Coming soon
Configuring your first security policy
Coming soon
Frequently Asked Questions
Ready to protect your AI agents?
Configure DataGrout's full defense stack in minutes. Detection, isolation, enforcement, sandboxing — all in one platform.
Free to start · No credit card required