Platform

AI guardrails, enforced where the traffic is

AI guardrails are rules applied to every request your AI systems and agents make. Aicura turns your governance decisions into guardrail rules, signs and versions them, and deploys them to an AI gateway in your network, which acts on each request and records every block, redaction and budget breach.

Included in Pro and Enterprise. Guardrail authoring and signed bundles start in Essentials. Compare plans

Make the gateway block what your policy prohibits

Your policy says staff must not paste customer records into a chatbot. Most AI governance stops at that document, and most enforcement is an approval workflow, but an approval recorded last quarter does not stop a prompt sent today. Aicura joins the two, so the thing your policy prohibits is the thing the gateway blocks.

Rules for everyone, plus rules for each system

One global set of guardrail rules is the minimum every request carries. A set for a single AI system or agent adds that system's own rules.

A system's rule takes over from the global rule that targets the same thing and leaves every other global rule standing. The system's Guardrails tab shows exactly which rules are in force and where each came from.

Guardrails, Guardrail sets tab in Aicura

See why every rule exists

Each rule shows where it came from, which the app calls its origin. A rule comes from the system's register record, from what it is permitted to do, from a control, from the last version, from you directly, or is suggested.

Actions are block, escalate, redact, reroute and warn.
Any rule can be observe only, recording what it would have done without touching traffic.
A refusal message can be set for the version or overridden per rule.
A refusal reaches the calling application as a normal reply in the format it already speaks, such as OpenAI or Anthropic, so the user sees the message even if the application was never changed.
A banner shows every change since the previous published version.

What a rule can do

Content scanners: Prompt injection, jailbreak, secrets and toxicity, your own scanner types, and scanner scripts you write.
Blocked topics: Keep named topics off limits through a topic scanner.
Personal information: Redact by mask or hash, or block the request outright, per kind of personal information.
Approved tools: Refuse the request or strip the tool and forward. Tool calls in responses are always enforced.
Approved models: Fence which providers and models a system may reach, including any backup the gateway falls back to.
Response caching: Whether and on what match a response may be served from cache. A system with a redact rule is never cached.
Approved system prompts: Fires when a request's system prompt, the standing instructions to the model, matches none you have approved by checksum.
Custom rules: Call any scanner with any parameters, and handle traffic from systems the register does not know.

Nothing reaches live traffic until you deploy it

Editing locks the set, so two people cannot write over each other, and the gateway keeps serving the last published version meanwhile. Publishing cuts a locked, signed version. Deploying it to a gateway is a separate act.

Before a deploy, Aicura checks the version against what the gateway says it can run. A rule naming a scanner the gateway does not have is refused with the reason, rule by rule. Nothing typed in the app reaches live traffic until it is published and deployed.

Each publish and deploy, and every block, redaction and escalation, is snapped into the Evidence Vault, Aicura's store of dated snapshots, as it happens.

The gateway runs in your network

The gateway enforces your rules from inside your own network, so prompts and responses go through your gateway, not through Aicura. Each system attached to it has a fail mode, which says whether a request goes through (open) or is refused (closed) when a rule cannot be checked. Blocks, redactions and limit breaches are always recorded, and allowed requests are sampled at a rate you set.

How the gateway and the other components in your network work

Gateway detail, Enforcement tab in Aicura

Scanners, including your own

Every scanner declares what it is for. The platform types are personal information, topic, prompt injection, jailbreak, secrets and toxicity, and you can add your own types with their own parameters.

Scanner scripts. Write detection logic in Starlark, a small Python-like language, test it against fixtures under the same step budget and timeout the gateway uses, and publish a signed version that rules call by id.
Backends. Gateways advertise scanners from native, ONNX, external, LLM Guard, Presidio, Bedrock Guardrails, Granite Guardian and scanner script backends. Bedrock Guardrails and Granite Guardian call a service you run.

Scanner script detail, Source tab in Aicura

Cap how much each system can use

A budget set holds period budgets and per-minute rate limits, counted on the gateway itself. The global set applies to every request, and a system's own set adds its limits. Both apply.

Cap tokens or requests over a reset period, or per minute.
On a breach, reject the request, or let it through and record it.
Count against the system as a whole, or against each agent credential (runtime identity) it presents.
A breach stops before the provider is called, and a gateway restart does not reset the count.

Let a release check with Aicura before it goes ahead

A pipeline, release tool or operator can ask Aicura before it acts. Each question (Deploy, Roll back, Retire, Train, Use model, Enable tool, Use vendor) has its own rules module, written in Rego, that denies with a plain sentence naming the fix or warns. Preview runs the rules against a real system, model, vendor or tool before you publish, and the answers come from a preflight engine in your network.

Preflight engine, Decisions tab in Aicura

Questions

What is an AI guardrail?

An AI guardrail is a rule applied to AI traffic at request time. It covers what may go into a model or agent, what may come out and what an agent may do. A policy document describes intent. A guardrail enforces it, blocking, redacting or constraining each request as it happens.

What is an AI gateway?

An AI gateway sits in front of your AI traffic, between the applications and agents that call models and the providers that serve them. Aicura's gateway runs in your own network. It enforces the guardrail rules, budgets and rate limits deployed to it, and records every block, redaction and limit breach as an enforcement event.

Do we have to use Aicura's AI gateway?

No. Every published guardrail version can be exported as a signed bundle for a gateway you run yourself, which pulls the bundles you export. The Aicura gateway is the one you can deploy to directly from the app, with a capability check before each deploy.

Can we test an AI guardrail before it blocks real traffic?

Yes. Any Aicura guardrail rule can be set to observe only. It evaluates every request and records the verdict it would have applied, without touching the traffic, and every event it raises is marked as observed. Switch it on once the record shows it does what you meant.

What happens when an AI guardrail rule cannot be checked?

In Aicura, each AI system attached to a gateway has a fail mode. Fail open lets the request through, fail closed refuses it. A scanner that is unavailable, errors or runs past its budget is handled by the calling rule's own scanner-unavailable behaviour. A gateway with no systems attached refuses every request.