Defense-in-depth for every AI request.
Four pre-call checks and two post-call checks run on every request — before any LLM call is made.
Reversible anonymization
Your users' PII never reaches the model — the answer still does
Anoman detects PII before the provider call, swaps it for realistic synthetic values (or reversible tokens), sends only the anonymized prompt to the AI, then de-anonymizes the model's response — so your app receives a coherent answer with the real values restored. Indonesian NIK and Singapore NRIC are recognized out of the box. On by default, enforceable org-wide.
Your app sends → "Email [email protected], NIK 3201094…, re: the invoice"
→ [ANONYMIZE] swap PII for synthetic values
Model sees: "Email [email protected], NIK 3299…" — real data never leaves your boundary
→ LLM generates its answer
→ [DE-ANONYMIZE] restore the real values in the response
Your app receives: the answer with the real [email protected] + NIK — unchanged for you
Pipeline
Request pipeline — guardrails run first
→ Auth + rate limit
→ [PRE-CALL GUARDRAILS]
1. Prompt injection (ML classifier, ~30ms)
2. PII detection (~20ms)
3. Content moderation (keyword + ML, ~5ms)
4. Tool-call policy check (allowlist/denylist, ~10ms)
↳ blocked? Return 403 immediately. Never enqueued, never billed.
→ Cache check
→ Routing (real-time or batch)
→ LLM call
→ [POST-CALL GUARDRAILS]
5. Response content filter
6. Response PII scan
→ Token metering → Response
Guardrail types
Four layers of protection
Prompt Injection Detection
ML-based prompt-injection classifier. Threshold: 0.85 (configurable per customer). Latency: ~30ms on CPU. 100% block rate on known injection strings in benchmarks.
PII Masking (4 modes)
PII detection engine. Entities: EMAIL, PHONE, CREDIT_CARD, SG NRIC, ID NIK, IP_ADDRESS, URL. Modes: redact (replace with [REDACTED]), tokenize (reversible token), synthetic (generated substitute), block (403 reject).
Content Moderation
Keyword + ML classifier. Supports English and Bahasa Indonesia. ~5ms latency. Configurable per policy group.
Conversational Guardrails
YAML + flow-rule config per policy group. Conversational flow enforcement. Blocks system-prompt disclosure, roleplay jailbreaks, and topic steering. Cached by config hash.
Advanced
Per-key overrides + LLM Security Perimeter
Per-key guardrail overrides
Each API key carries a guardrail_overrides JSONB field. Priority stack: System forced (ops) → Per-key overrides → Policy group → System defaults. Example: {"injectionEnabled": false, "piiEnabled": true}.
LLM Security Perimeter (LSP)
Attack signature enforcement at the provider level. 10 seeded signatures across 6 attack categories. Enrolled providers have a telemetry key — events fan out to our analytics store with a 180-day retention. High/critical signatures return 403 before the LLM call.