A single routing rule moves traffic through the Gateway. Your application code does not change. Your model provider does not change. The Gateway becomes the policy and inspection plane between them.
Workflow, chatbot, multi-agent orchestrator, or API caller, built in your framework of choice.
Reverse proxy. Every prompt scored, every response inspected, every MCP endpoint hashed against your registry.
OpenAI, Anthropic, Azure OpenAI, AWS Bedrock, Google Vertex, or self-hosted models.
The Gateway runs a structural injection classifier on the full prompt before it reaches the model, and on the response before it reaches your application. Direct injection (instructions in the user message) and indirect injection (instructions hidden in tool-call results, retrieved documents, or web content) are both detected.
MCP impersonation is the single most exploited vector against bank agents in 2025. The Gateway maintains a per-bank MCP Server Registry of approved endpoints, hashed by URL and TLS certificate fingerprint. Any unregistered or hash-mismatched endpoint is blocked before the call is forwarded.
The Gateway runs Presidio-grade entity detection on every outbound prompt. PAN, CVV, account numbers, customer identifiers, and free-text NPI are replaced with deterministic tokens. The model gets the structure of the prompt, not the sensitive values. Your application un-redacts on the response path if needed.
Each layer is deterministic and independently auditable. A call must pass all four to be forwarded. Any single failure produces a structured policy decision with full provenance.
Deterministic controls are the guarantee. Content classification is best-effort, and we mark which is which.
Overseer and Kill Switch handle behavioral and fleet-level threats. The Gateway handles everything that can be evaluated on a single call without baseline history.
| Threat class | How the Gateway handles it | Layer |
|---|---|---|
| Direct prompt injection | Structural classifier on the user message; instruction-override patterns flagged with origin tag. | L3 |
| Indirect prompt injection | Instructions arriving via tool-call output, RAG retrieval, or fetch_url tagged with their source context. | L3 |
| Malicious MCP endpoint | Hash mismatch against the per-bank MCP Server Registry. Typosquats blocked even with valid TLS. | L4 |
| NPI / PCI exfiltration | 12-class entity detection with deterministic per-session tokenization before the prompt is forwarded. | L4 |
| Reconnaissance prompts | Living-off-the-LLM patterns, system enumeration, credential lookup, persistence-script generation, flagged on signature. | L3 |
| Tool-permission violation | Agent's signed tool certificate checked against the requested call. Out-of-scope tool calls rejected without policy evaluation. | L2 |
| Unsigned agent traffic | Unsigned calls rejected at L1. No agent reaches the model without a verifiable identity. | L1 |
Gateway runs in BladeRun's VPC, colocated with your model providers. Single routing rule. Deploys in days. SOC 2 Type II in scope.
Gateway runs in your VPC under your IAM. No traffic leaves your perimeter. Meets OCC and Federal Reserve constraints on data flow.
For sovereign workloads. Federation participation is opt-in for SaaS / on-prem; air-gapped is local-only and equally functional.
Behavioral detection, automated isolation, and cross-bank intelligence run alongside the Gateway. Every detection event is written to Time Machine and contributes anonymized signal to the Federation.
Per-agent behavioral baseline + fleet correlation. Deterministic, examiner-followable enforcement, no SR 26-2 safe harbor, so model-risk principles still apply.
Explore Overseer →Automatic agent isolation in milliseconds. Immutable forensic log in your S3 bucket, your KMS keys.
Explore Kill Switch →Privacy-preserving cross-bank threat intelligence. Three pipelines combine into shared detection rules.
Explore Federation →Point one workflow at the BladeRun Gateway. Inspection runs in shadow mode for the first week. We show you what was inspected, what would have been flagged, and what would have been blocked. Reversible by routing rule.