Security

Configure the LLM shield

Agents read things nobody on your team wrote: web pages, uploaded documents, tool output, messages from strangers. Any of it can contain instructions aimed at the model rather than at the reader, and any of it can contain a secret or a customer's personal data that should not travel onward.

The shield handles both directions - it normalizes and fences untrusted content on the way in, and scrubs secrets and PII on the way out, across every output path including events and traces.

The shield is enabled by default. Add shield.toml beside an agent only to change its behavior:

enabled = true
block = ["critical_secret"]

An optional content-safety guard uses an OpenAI-compatible endpoint:

[guard]
action = "block"
base_url = "https://guard.example.com/v1"
api_key_env = "GUARD_API_KEY"
model = "llama-guard"

If a guard is configured, its key environment variable must exist or the agent will not start. PII_VAULT_KEY is required whenever any agent has the shield enabled: it seals the session-scoped token-to-value map (AES-256-GCM) so history stores tokens while the owner sees restored values at /history and in the sessions list. Without it redacted values would never persist - a silent data-loss mode - so the platform refuses to boot instead.

See .

Next

On this page