Secrets are masked right in the streaming response chunks, before they ever reach the client.
chunk: "sk-live-4f…" → [SECRET] §00 / Platform · Self-hosted LLM Firewall
How control works over every AI request.
One fixed pipeline: kill-switch, access, budget, DLP inbound and outbound, audit. Below we break down what each stage does and what each DLP layer catches. Every claim comes with a technical proof: latency, method, verdict.
§01 / Request pipeline
One path. One order. The same route every request.
11 stages run on a fixed rail: none is skipped, none jumps the queue. DLP fires twice, as gates inbound and outbound. The full pre-call pipeline adds milliseconds to a request and scales linearly across replicas, without slowing the development flow.
01 kill-switch
Emergency stop before any work
L0–L4 · Redis · instant
02 auth
Who this is and what role
JWT / OIDC / SAML · RBAC
03 model ACL
Is the requested model allowed
whitelist allowed_models
04 rate limit
Is it within its limit
Redis sliding-window · per-role RPM
05 budget
Is there budget for the request
user / team / org · 402 when exhausted
06 DLP · pre DLP
What reaches the model, no leaks
layers 0–5 concurrent · BLOCK / MASK
07 cache
Have we answered this already?
SHA-256 · opt. cosine of embeddings
08 proxy
Call to the provider
httpx forward · retry + fallback chain
09 DLP · post DLP
What the model returned, under review
layers 6–7 · hallucination / copyright
10 cache store
Store the response for later
write + keyed-HMAC attestation
11 audit + metrics
Every step into an immutable log
HMAC-chained · metrics · SIEM CEF
→ response to client
Same response contract, same request-id
response · 0 hidden hops
0 hidden hops between client and model any stage is overridden by kill-switch / policy-as-code / SIEM
§02 / DLP engine
Eight layers of inspection. Plus multimodal, run concurrently.
Layers 0–7 and multimodal add up to 23 scanner modules on disk. Active stages run in parallel (asyncio.gather), so a request clears them in one shared pass, not the sum of the layers. The label color encodes the layer in the crystal dispersion palette.
in Request from the client
L0
Prompt injection · multi-signal Injection, homoglyphs, prefix-injection, payload-split
fast default
L1
Regex · secrets and PII · Go regex Keys, Luhn-valid cards, INN · SNILS · passport with checksums
instant default
L2
Presidio NER · spaCy PII in free text: names, addresses, phone numbers
fast default
L3
ML classifiers · LLM Guard · CPU Injection, toxicity, secrets, invisible-text by meaning
fast opt-in
L4
Corporate · canary · dictionary + markers Project names, internal domains and IPs, canary tokens
instant default
L5
Semantic guard · semantic similarity Forbidden topics and intent by meaning
fast opt-in
L6
Hallucination · after the response Fabricated citations and DOIs, self-contradiction
post-call opt-in
L7
Copyright · after the response Fingerprints, GPL / AGPL / SPDX headers in output
post-call opt-in
MM
Multimodal · OCR · pytesseract → layers 0–7 Images from messages → OCR → DLP again
OCR · pre opt-in
out Cleaned request to the model
mechanisms on top of the layers
NFKC normalization and zero-width stripping run before the scan: evasion with invisible characters fails.
ｓｋ-ｌｉｖｅ → sk-live → scan The model never becomes an exfil channel: echoing a placeholder back in the response is intercepted.
 → blocked Every verdict turns into an action. Graded-trust never downgrades injection to masking.
BLOCK · MASK · WARN · LOG A DLP failure closes a cloud request; for local ones it opens: the data is already in the perimeter.
cloud: closed · local: open A built-in set plus marketplace packs. DLP profiles are configured per tenant.
built-in + marketplace §03 / Approaches compared
No single method catches everything. So we do not pick one.
Every detection method has its strength and its blind spot: two qualitative profiles show where a method is fast and where it is deep. We show both, instead of selling one as a silver bullet.
Regex L1
speed
depth
deterministic, instant scan, zero drift blind to paraphrase, breaks on obfuscation
NER L2
speed
depth
catches PII in free text, language-aware misses rare formats, throws false positives
ML classifiers L3
speed
depth
reads intent by meaning opaque, drifts, needs threshold calibration
LLM judge scanner
speed
depth
context and reasoning, best recall on hard attacks latency and cost, non-deterministic, not for realtime
Prizma layers concurrent
speed
depth
Runs the layers concurrently and combines the verdicts: regex catches the exact, NER and ML pick up the semantic, the LLM judge works off the main request path, in the scanner.
the whole pipeline · milliseconds per request · asyncio.gather, not the sum of the layers
Need maximal provider breadth without DLP: take LiteLLM, it can stay the transport behind Prizma. More in the FAQ
§04 / Kill-switch L0–L4
Five levels of stop. From all traffic to a single agent.
The scope is nested: the outer level kills all traffic, each inner one narrows the zone. You can cut everything at once or pinpoint a single model, a single user, a single agent, without touching the rest.
L0 Global stop
stopall AI traffic in the org runningnothing, a full stop
L1 User
stopone user's requests runningall other users
L2 Model
stopone model for everyone runningother models stay available
L3 Cloud egress local models keep running
stopegress to cloud models runninglocal models keep running
L4 Agent
stopone autonomous agent runningother agents untouched
stops instantly through Redis · source of truth in PostgreSQL · full HMAC-chained audit trail
§05 / RAG firewall
Every chunk is data. Not a command for the model.
A retrieved fragment is the most common vector for indirect injection. The firewall inspects every chunk on its own and lets only the vetted into context. A poisoned chunk is demoted and never reaches the model.
store
vector DB org_id prefilter at entry
inspect /v1/rag/inspect · inline rag_context
inspect() per-chunk · concurrent
demotion injection into a doc frame
EchoLeak blocks exfil markup
unicode decode-and-rescan
DLP secrets in the chunk
provenance grounding · provenance
org_id cross-tenant filter
spotlight context
in context
§06 / Agents and supply-chain
An autonomous agent under control. As is the model it runs.
An agent acts on its own, so every step is traced, arguments are scanned, and a sensitive action waits on a human. The model itself arrives as a file that is checked before loading, without unpacking.
Runtime · agent run
agent
registry · bound to api-key tool-call
tool-call arguments DLP · args
scan and mask the arguments HITL on hold
waits for approval execution
the call goes to the tool AIRQ 0.72
dual-control anti-self-approval
auto-kill L4 on anomaly
budget per-run · RPM
Supply-chain · model artifact
model artifact
picklePyTorch-zipsafetensorsGGUFONNXKeras
prizma-scan no unpacking · air-gapped · pickletools opcode-walk
verdict allow / block
AIBOM CycloneDX-ML
Zip-Slip · Keras-Lambda · CVE-2025-10155/56/57
Ready?
All your AI traffic under your control
A self-hosted LLM Firewall inside your perimeter. One base_url line, and no prompt leaves directly.
sales@hackadvisor.io NDA on request · reply within one business day