Security guide

Run guardrails before the model sees the prompt.

LineMod is a security gateway with agent behavior observability—guardrails at the edge, harness diagnostics across runs, and policy routing when you need it. This page explains guardrails that run before a model sees the prompt. Scan inbound and outbound content, mask sensitive data, govern agent tools, and write every decision into the audit trail.
Templates

Security policy levels

LineMod ships baseline templates. Pin a default per org or override per API key in Console.
strictMaximum scanning
Blocks high-risk prompts and outputs; recommended for regulated data.
standardBalanced default
Production baseline for most teams.
relaxedLower friction
Internal tools with trusted inputs; still logs verdicts.
offScanning disabled
Only when org policy explicitly allows; not recommended for production.
Pipeline

What runs on each request

StepCheckEvidenceOutcome
01
Prompt injectionReject hidden override instructions.
standard_policypass
02
PII maskingRedact sensitive values before upstream routing.
mask: card, emailredact
03
Tool permissionBlock disallowed agent tool calls.
tools: deny external_postblock
04
Output scanFlag XSS, malicious URLs, or policy violations.
X-LineMod-Output-Riskindexed
Recommended order
Inspect prompt → apply redaction → enforce tool policy → route upstream → scan output → index audit row with X-LineMod-Request-Id.
Keys

API key and header overrides

ConsolePin template per key
Separate production and staging keys with different defaults in API Keys.
HeaderPer-request override
Send X-LineMod-Security when org policy allows single-call tuning.
AgentTool approval tokens
Use X-LineMod-Tool-Approval for human-in-the-loop agent tool governance.
Audit

Observability and review

Every blocked or redacted request is searchable in Console audit with security verdict metadata.
Request IDX-LineMod-Request-Id
Input riskX-LineMod-Security-Risk
Output riskX-LineMod-Output-Risk
Console/console/security