← back to all posts

18 October 2026

Project: AI Security Guardrails Lab

A policy-driven security layer for prompt screening, tool authorization, sensitive-output redaction, and adversarial AI testing.

projectai-securitydevsecopspythonpolicy-as-code

AI-enabled services introduce a new path from untrusted input to data, models, and action tools. This project places an explicit security decision point on that path.

The AI Security Guardrails Lab is model-independent and runs with Python’s standard library. It can sit in front of a hosted model, retrieval service, or tool-calling workflow without requiring model credentials for local testing.

Security controls

  • Prompt checks for instruction override, system-prompt extraction, secret requests, and command execution.
  • Role-based tool authorization with a global denylist for high-risk operations.
  • Unicode normalization to catch simple fullwidth-character bypass attempts.
  • Output redaction for access-key shapes, bearer tokens, and email addresses.
  • Audit events that store decision metadata and hashes instead of raw prompts.

Validation

The repository includes twelve adversarial cases with explicit expected decisions. GitHub Actions runs the unit tests, live HTTP API tests, and evaluation suite on every push and pull request.

The evaluation report is deterministic, so CI also verifies that the committed report matches the current policy and test dataset.

Architecture

untrusted prompt + caller role + requested tools
                     |
                     v
              guardrail decision
                /          \
             block        allow
               |             |
        hashed audit     model service
                              |
                       output redaction
                              |
                           caller

The guardrail layer is deliberately separate from the model. High-impact approval remains outside the model, tool permissions stay narrow, and each decision is traceable without recording sensitive prompt content.

Cloud integration

The included Azure AI Foundry pattern uses workload identity, Key Vault references, private networking, restricted retrieval access, and centralized telemetry. The same enforcement service can also be placed in front of other model platforms.

The repository also includes a threat model and an incident-response playbook for unsafe output, attempted data exfiltration, and unexpected tool use.