> ## Documentation Index
> Fetch the complete documentation index at: https://docs.knoxcall.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Prompt Firewall

> Built-in prompt-injection heuristics, tenant-supplied regex/keyword rules, and canary tokens that detect system-prompt extraction — enforced on every request.

# Prompt Firewall

The prompt firewall screens every request before it reaches the provider. Built-in heuristics always run — they cannot be disabled — and you can layer your own rules on top.

## Built-in heuristics

The firewall ships with heuristics for common prompt-injection and jailbreak patterns (for example, instruction-override attempts and known jailbreak templates). When a request matches, it is blocked with `HTTP 400`:

```json theme={"dark"}
{
  "error": "firewall_block",
  "error_description": "Request blocked by firewall policy: ignore_previous_instructions, dan_jailbreak"
}
```

## Your own rules

A firewall **policy** attached to an agent can add:

* **Regex rules** — validated with a safe-regex guard so a pathological pattern can't cause catastrophic backtracking.
* **Keyword rules** — literal terms to block or flag.

Rules can **block** (reject the request) or **warn** (allow but record `firewall_outcome = "warn"`).

Test a policy against sample input from the **Firewall tab** on the gateway detail page before you attach it.

## Canary tokens

Enable `canary_enabled` on a policy and the gateway injects a unique `kc_canary_<16hex>` token into every system prompt before forwarding upstream. If the model ever echoes that token back in its response — a strong signal that a prompt-injection attack extracted the system prompt — the gateway:

1. Emits an `ai_gateway.canary_leak` audit entry at **critical** severity.
2. Sets `firewall_outcome = "warn"` on the usage record.
3. Fires any [compliance-pack](/ai-gateway/compliance-packs) alert rules listening for `ai_gateway.canary_leak`.

The canary is stripped from the response before it reaches your app, so it's invisible in normal operation.

## Outcomes in telemetry

The firewall outcome is recorded on every call and exported on the [OpenTelemetry span](/ai-gateway/observability) as `knoxcall.ai_gateway.firewall_outcome` (`pass` / `warn` / `block` / `tag`), so you can alert and dashboard on it in your own backend.