Configure the LLM shield
Agents read things nobody on your team wrote: web pages, uploaded documents, tool output, messages from strangers. Any of it can contain instructions aimed at the model rather than at the reader, and any of it can contain a secret or a customer's personal data that should not travel onward.
The shield handles both directions - it normalizes and fences untrusted content on the way in, and scrubs secrets and PII on the way out, across every output path including events and traces.
The shield is enabled by default. Add shield.toml beside an agent only to change its behavior:
enabled = true
block = ["critical_secret"]An optional content-safety guard uses an OpenAI-compatible endpoint:
[guard]
action = "block"
base_url = "https://guard.example.com/v1"
api_key_env = "GUARD_API_KEY"
model = "llama-guard"If a guard is configured, its key environment variable must exist or the agent will not start.
PII_VAULT_KEY is required whenever any agent has the shield enabled: it seals the
session-scoped token-to-value map (AES-256-GCM) so history stores tokens while the owner
sees restored values at /history and in the sessions list. Without it redacted values
would never persist - a silent data-loss mode - so the platform refuses to boot instead.
See .
Next
- Authenticate callers - who is allowed to send content in the first place.
- Verify configuration content - trusting the agents and documents themselves.
- - every setting and its default.