Skip to main content

​
Prompt Firewall

The prompt firewall screens every request before it reaches the provider. Built-in heuristics always run — they cannot be disabled — and you can layer your own rules on top.

​
Built-in heuristics

The firewall ships with heuristics for common prompt-injection and jailbreak patterns (for example, instruction-override attempts and known jailbreak templates). When a request matches, it is blocked with HTTP 400:

​
Your own rules

A firewall policy attached to an agent can add:
  • Regex rules — validated with a safe-regex guard so a pathological pattern can’t cause catastrophic backtracking.
  • Keyword rules — literal terms to block or flag.
Rules can block (reject the request) or warn (allow but record firewall_outcome = "warn"). Test a policy against sample input from the Firewall tab on the gateway detail page before you attach it.

​
Canary tokens

Enable canary_enabled on a policy and the gateway injects a unique kc_canary_<16hex> token into every system prompt before forwarding upstream. If the model ever echoes that token back in its response — a strong signal that a prompt-injection attack extracted the system prompt — the gateway:
  1. Emits an ai_gateway.canary_leak audit entry at critical severity.
  2. Sets firewall_outcome = "warn" on the usage record.
  3. Fires any compliance-pack alert rules listening for ai_gateway.canary_leak.
The canary is stripped from the response before it reaches your app, so it’s invisible in normal operation.

​
Outcomes in telemetry

The firewall outcome is recorded on every call and exported on the OpenTelemetry span as knoxcall.ai_gateway.firewall_outcome (pass / warn / block / tag), so you can alert and dashboard on it in your own backend.