ons, and maintains immutable audit trails. It treats every AI interaction as a potential data transfer event requiring zero-trust verification.

Core Solution

Building an AI data boundary requires a middleware architecture that decouples business logic from model providers while enforcing consistent security policies. The system operates in three phases: prompt interception and sanitization, output classification and routing, and agent action validation.

Architecture Rationale

1. Decoupled Provider Layer: Hardcoding model endpoints creates vendor lock-in and inconsistent policy enforcement. A gateway abstracts the underlying model (OpenAI, Anthropic, Azure OpenAI, open-weight alternatives) and applies uniform controls.
2. Zero-Trust Prompt Processing: Every prompt is treated as untrusted input. Sensitive data is detected, redacted, or replaced with contextual placeholders before transmission.
3. Output Classification: Model responses are not assumed safe. They are scanned for synthesized PII, leaked credentials, or policy violations before reaching the end user.
4. Agentic Permission Scoping: Agents operate under explicit action budgets. Each requested operation is validated against least-privilege policies, with human approval gates for high-risk actions.

Implementation: TypeScript Guardrail Middleware

The following examples demonstrate a production-ready guardrail system. The architecture uses a pipeline pattern for extensibility and clear separation of concerns.

1. Prompt Sanitizer

Intercepts outgoing requests, detects sensitive patterns, and applies contextual redaction.

interface SanitizationRule {
  pattern: RegExp;
  type: 'pii' | 'credential' | 'internal_ref';
  replacement: (match: string) => string;
}

class PromptSanitizer {
  private rules: SanitizationRule[];

  constructor(rules: SanitizationRule[]) {
    this.rules = rules;
  }

  sanitize(text: string): { sanitized: string; metadata: Record<string, unknown> } {
    let processed = text;
    const metadata: Record<string, unknown> = { redactions: [], riskScore: 0 };

    for (const rule of this.rules) {
      const matches = processed.matchAll(rule.pattern);
      for (const match of matches) {
        const placeholder = rule.replacement(match[0]);
        processed = processed.replace(match[0], placeholder);
        metadata.redactions.push({ type: rule.type, originalLength: match[0].length });
        metadata.riskScore = (metadata.riskScore as number) + 1;
      }
    }

    return { sanitized: processed, metadata };
  }
}

// Usage configuration
const sanitizer = new PromptSanitizer([
  {
    pattern: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/g,
    type: 'pii',
    replacement: () => '<REDACTED_EMAIL>'
  },
  {
    pattern: /(?:sk-|pk-)[A-Za-z0-9]{20,}/g,
    type: 'credential',
    replacement: () => '<REDACTED_API_KEY>'
  },
  {
    pattern: /(?:prod|staging)-db-[a-z0-9-]+/g,
    type: 'internal_ref',
    replacement: (m) => `<INTERNAL_REF:${m.length}>`
  }
]);

2. Output Classifier

Validates model responses against sensitivity thresholds before delivery.

interface ClassificationResult {
  status: 'approved' | 'flagged' | 'blocked';
  reason: string;
  confidence: number;
}

class OutputClassifier {
  private thresholds: { pii: number; credential: number; business_logic: number };

  constructor(thresholds: { pii: number; credential: number; business_logic: number }) {
    this.thresholds = thresholds;
  }

  classify(text: string): ClassificationResult {
    const piiCount = (text.match(/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/g) || []).length;
    const credCount = (text.match(/(?:sk-|pk-)[A-Za-z0-9]{20,}/g) || []).length;
    
    if (credCount > 0) {
      return { status: 'blocked', reason: 'Credential detected in output', confidence: 0.95 };
    }
    if (piiCount > this.thresholds.pii) {
      return { status: 'flagged', reason: 'Excessive PII density', confidence: 0.88 };
    }
    return { status: 'approved', reason: 'Within policy limits', confidence: 0.99 };
  }
}

3. Agent Policy Enforcer

Validates agentic actions against scoped permissions and execution budgets.

interface AgentAction {
  tool: string;
  parameters: Record<string, unknown>;
  targetSystem: string;
  riskLevel: 'low' | 'medium' | 'high';
}

interface PolicyScope {
  allowedTools: string[];
  maxActionsPerHour: number;
  requireApprovalFor: string[];
}

class AgentPolicyEnforcer {
  private scope: PolicyScope;
  private executionLog: AgentAction[];

  constructor(scope: PolicyScope) {
    this.scope = scope;
    this.executionLog = [];
  }

  validate(action: AgentAction): { allowed: boolean; requiresApproval: boolean; reason: string } {
    const hourWindow = new Date().getHours();
    const recentActions = this.executionLog.filter(
      a => new Date(a.parameters['timestamp'] as number).getHours() === hourWindow
    );

    if (recentActions.length >= this.scope.maxActionsPerHour) {
      return { allowed: false, requiresApproval: false, reason: 'Hourly action limit exceeded' };
    }

    if (!this.scope.allowedTools.includes(action.tool)) {
      return { allowed: false, requiresApproval: false, reason: 'Tool not in allowed scope' };
    }

    const requiresApproval = this.scope.requireApprovalFor.includes(action.targetSystem);
    return { allowed: true, requiresApproval, reason: 'Policy check passed' };
  }

  log(action: AgentAction): void {
    this.executionLog.push(action);
  }
}

Architecture Decisions

• Pipeline over Monolith: Each guardrail component operates independently. This allows swapping the classifier for a dedicated ML model or updating redaction rules without redeploying the entire gateway.
• Contextual Placeholders: Instead of stripping sensitive data entirely, the sanitizer replaces it with typed placeholders (<INTERNAL_REF:12>). This preserves syntactic structure, preventing model confusion while maintaining security.
• Immutable Execution Logs: Agent actions are logged with cryptographic hashes. This enables forensic reconstruction without storing raw prompt/output pairs, balancing auditability with privacy.
• Provider Abstraction: The gateway routes requests to approved endpoints based on workload type. High-risk queries are directed to enterprise-tier models with explicit data retention exclusions.

Pitfall Guide

1. Regex-Only Secret Detection

Explanation: Regular expressions fail against obfuscated tokens, base64-encoded credentials, or secrets split across multiple lines. They also generate false positives on benign strings that resemble patterns. Fix: Combine regex with entropy analysis and known-secret databases. Use libraries that calculate character randomness and cross-reference against vendor-specific key formats. Implement contextual validation to reduce false positives.

2. Assuming Enterprise Tiers Disable Training

Explanation: Many vendors retain prompts and outputs for quality improvement unless explicitly opted out. Enterprise agreements often include default retention windows that violate compliance requirements. Fix: Verify Data Processing Agreements (DPAs) for explicit training exclusions. Pass data_retention: "none" or equivalent flags in API requests. Maintain a vendor compliance matrix and audit retention settings quarterly.

3. Ignoring Inherited OAuth Scopes

Explanation: AI connectors read what the authenticated user can access. Stale group memberships, shared drive links, and delegated permissions grant the AI unintended visibility into sensitive repositories. Fix: Implement least-privilege OAuth scopes during connector onboarding. Conduct periodic access reviews and revoke unused grants. Use just-in-time access provisioning for high-sensitivity data sources.

4. Treating AI Outputs as Safe by Default

Explanation: Models can hallucinate, repeat training data, or synthesize sensitive information from fragmented inputs. Outputs are not inherently sanitized. Fix: Route all responses through a classification layer before rendering. Apply the same redaction and policy checks used for prompts. Block delivery if confidence thresholds are breached.

5. Skipping Agent Action Logging

Explanation: Agentic AI executes commands across systems. Without detailed audit trails, organizations cannot trace state changes, attribute actions to users, or recover from erroneous executions. Fix: Implement immutable action logs with user/context correlation. Store execution hashes, tool parameters, and approval status. Integrate with SIEM for real-time anomaly detection.

6. Over-Redacting Prompts

Explanation: Stripping too much context breaks model reasoning. Replacing all numbers, internal references, or technical terms degrades output quality and increases hallucination rates. Fix: Use contextual redaction with typed placeholders. Preserve structural elements like JSON keys, code syntax, and logical operators. Test redaction rules against benchmark datasets to measure quality impact.

7. Single-Point Policy Enforcement

Explanation: Relying on one gateway creates a bottleneck and single point of failure. If the gateway crashes or is bypassed, all AI interactions proceed without controls. Fix: Distribute lightweight policy checks across client, gateway, and model layers. Implement fallback modes that default to strict blocking if the primary enforcer is unavailable. Use circuit breakers to prevent cascade failures.

Production Bundle

Action Checklist

• Define AI data classification policy: Map data types (PII, credentials, internal refs, business logic) to handling rules and retention limits.
• Inventory approved AI tools: Catalog all models, connectors, and agentic platforms. Verify DPAs, retention settings, and training exclusions.
• Deploy guardrail middleware: Implement prompt sanitization, output classification, and agent policy enforcement using a decoupled pipeline architecture.
• Review identity and OAuth scopes: Audit connector permissions, revoke stale grants, and enforce least-privilege access for AI readers.
• Configure agent action budgets: Set hourly limits, require approval gates for high-risk systems, and enable immutable execution logging.
• Establish continuous monitoring: Integrate guardrail logs with SIEM, track redaction rates, flag policy violations, and conduct quarterly compliance audits.

Decision Matrix

Scenario	Recommended Approach	Why	Cost Impact
Internal knowledge base queries	Gateway redaction + enterprise model with training exclusion	Preserves context while preventing data leakage to public models	Moderate (API costs + gateway infrastructure)
Customer support automation	Output classification + human approval gates	Prevents accidental PII exposure in customer-facing responses	High (approval workflow overhead + monitoring)
Agentic workflow automation	Scoped permissions + immutable action logs + circuit breakers	Limits blast radius of erroneous executions and enables forensic recovery	High (logging storage + approval infrastructure)
Developer coding assistance	Contextual placeholder redaction + open-weight local model	Maintains code structure while keeping IP on-premise	Low-Moderate (compute costs + maintenance)
Marketing content generation	Public model + strict input filtering	Low sensitivity data allows cost-effective external processing	Low (standard API pricing)

Configuration Template

# ai-guardrail-config.yaml
gateway:
  provider_routing:
    high_risk: azure-openai
    standard: anthropic
    local: ollama
  timeout_ms: 5000
  retry_policy:
    max_attempts: 2
    backoff: exponential

sanitization:
  rules:
    - type: pii
      pattern: "\\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Z|a-z]{2,}\\b"
      replacement: "<REDACTED_EMAIL>"
    - type: credential
      pattern: "(?:sk-|pk-)[A-Za-z0-9]{20,}"
      replacement: "<REDACTED_API_KEY>"
    - type: internal_ref
      pattern: "(?:prod|staging)-db-[a-z0-9-]+"
      replacement: "<INTERNAL_REF:{length}>"
  max_redaction_ratio: 0.35

classification:
  thresholds:
    pii: 3
    credential: 0
    business_logic: 5
  action_on_violation: block

agent_policy:
  allowed_tools:
    - read_file
    - search_db
    - create_ticket
  max_actions_per_hour: 50
  require_approval_for:
    - prod_database
    - payment_gateway
  logging:
    format: json
    retention_days: 90
    hash_algorithm: sha256

Quick Start Guide

1. Initialize the gateway: Deploy the TypeScript middleware as a reverse proxy in front of your AI model endpoints. Configure provider routing based on workload sensitivity.
2. Load policy rules: Import the YAML configuration into the guardrail service. Validate regex patterns against a sample dataset to ensure redaction does not degrade model performance.
3. Test with controlled prompts: Run a suite of benchmark prompts containing synthetic PII, credentials, and internal references. Verify that the sanitizer replaces sensitive data with placeholders and that the classifier blocks policy violations.
4. Enable agent scoping: Configure the policy enforcer with your tool allowlist and approval gates. Execute a dry-run workflow to confirm that high-risk actions trigger approval requests and that execution logs are generated.
5. Monitor and iterate: Connect guardrail logs to your observability stack. Track redaction rates, classification flags, and agent approval latency. Adjust thresholds and rules based on operational feedback and compliance requirements.