Obiguard's Policy engine lets you define exactly what each AI agent is allowed to do — and block, flag, or redact anything outside that envelope in real time.
Pick what to protect against — personal data, secrets, internal systems, toxic language, profanity, sexual content, jailbreaks, or a rule you write in a sentence. Choose Watch, Mask or Block, and say whether it covers prompts, replies or both. Obiguard builds the Criteria, Control and rule for you. Industry policies (PDPA, PCI DSS, GDPR, OWASP LLM Top 10, BNM RMiT, MAS) work the same way.
Criteria bind a guard, keyword, regex, or LLM judge to a scope — prompt, response, both, or tool call — and an action. One criterion, one decision point.
Bundle related criteria into a named set. A support-agent set might include no-pii-in-responses, no-competitor-mention, and a jailbreak guard.
Assign a Policy Set to an AI Agent. The set travels with the agent — across models, frameworks, and deployment environments. One set per agent.
A criterion set to human review holds the request in the Review Queue, where approvers, admins, and owners approve or reject it. Every decision is written back to the Audit Ledger.
Author or edit rules freely. A draft has no effect on live traffic.
Submit the version for approval. A reviewer can approve it or reject it.
Approved versions are ready to publish and carry a version label and rules hash.
The published version is enforced. The previous version is superseded.
