Inspect tool traffic, protect secrets, and block or redact risky content.
Guardrails inspect calls that pass through Passport. They check arguments before an app receives them and the complete result before an agent sees it, including structured data and resource metadata. Images, audio, and binary content are size-limited but are not interpreted as text.Built-in secret detection protects every plan. Runtime Security and custom rules require Enterprise.
The results card shows observed, blocked, and critical counts, plus recent findings.
Runtime Security is explainable and intentionally conservative. It does not claim to detect every malicious
instruction. Images, audio, and binary content are size-limited but are not understood semantically.
Runtime Security recognizes categories such as instruction override, hidden instruction characters, secret-exfiltration instructions, access-control bypass, destructive commands, and resource abuse.Passport checks block rules against the original content before applying redactions. That prevents one rule from hiding a match from another.Security findings store only bounded metadata: app, tool, phase, category, severity, action, reason, and a one-way fingerprint. Passport does not store the matching request or result in the finding.
Every workspace has a rule that catches common credentials before they cross the wire in either direction, including:
AWS access keys
GitHub tokens
Slack tokens
OpenAI keys
Stripe keys
PEM private keys
Passport’s own session, access, refresh, and agent-key tokens
password assignments
The rule scans the full text payload up to 5 MB, including secrets deep inside a file read or database result. An enforcing rule with a larger payload withholds it instead of passing an uninspected tail.
In the Rules card, choose Add from library or New rule. A rule can inspect arguments, results, or both, and can apply everywhere or only to selected apps.Custom rules accept a regular expression or a plain phrase. Regex runs in a bounded, linear-time engine; lookarounds and backreferences are not supported. A phrase that is not valid regex is matched literally and case-insensitively.Patterns are limited to 200 characters, and at most 32 enabled rules can apply to one call surface. A custom rule inspects up to 100,000 characters. If a blocking or redacting rule receives more, Passport withholds the payload rather than passing an uninspected tail; an alert-only rule records the ceiling event and allows it.Older custom rules may show Review required after an upgrade. Review the displayed pattern before accepting it, including disabled and alert-only rules. If a pattern uses unsupported lookarounds or backreferences, choose Retire and replace it with a supported rule. Retiring a rule disables it immediately. Some pattern and enforcement changes are temporarily unavailable while the workspace completes its upgrade.Rules also inspect sensitive text split across fields or content blocks. If redaction cannot preserve a valid response—for example, because it would change a resource address or object key—Passport withholds the response.
A match raises an alert. The alerts bell groups guardrail hits, tool changes, and security events, folds repeats of the same event into one row, and keeps alerts unread until you choose Mark all read. The Guardrails page shows the latest five hits; the full record is in Activity. Runtime Security findings can also be exported as metadata-only security events or streamed to a security system.Guardrails protect Activity itself: content that a guardrail flags is scrubbed before the record is stored, so a blocked credential cannot reappear in Activity or an export. The exception is a custom alert-only rule, which is explicitly meant to surface the matched content for review.See SIEM and OTLP export.