prompt-layer detection at L3
domain output policy enforcement
isolation when policy is breached
flagged outputs in Time Machine
"Toxic content" is a broad bucket that mixes brand-safety concerns with security exposure with regulatory liability. Treating them as one problem produces tools that are bad at all three. We split them explicitly.
NSFW, violence, hate speech, self-harm, harassment, misinformation. These are the canonical content-moderation classes. Azure AI Content Safety, OpenAI's moderation API, and Bedrock Guardrails are purpose-built and continuously tuned for them.
BladeRun integrates with these as upstream filters. We do not build a competing classifier.
An attacker coerces a customer-facing agent past its system prompt, pretend-modes, roleplay framings, "developer mode," step-by-step bypasses, and the agent emits something it should not. The cause is a prompt-layer security event; we detect and isolate at L3.
Same classifier as prompt injection. Different downstream impact.
A customer-service agent emits what amounts to investment or tax advice from an entity that is not licensed to give it. A claims-bot emits a coverage promise the policy does not actually grant. A non-licensed agent omits a required disclosure. These are regulatory exposures; provider-native moderation does not see them.
Per-domain output policy. Enforced before the response leaves the Gateway.
A clear table beats a marketing claim. If a row says DELEGATED, BladeRun does not own that detection, your provider moderation does, but BladeRun still writes the audit record and can isolate the agent on a downstream signal.
| Threat / scenario | How it's handled | Coverage |
|---|---|---|
| Jailbreak success on customer-facing agent | L3 classifier on the inbound prompt; instruction-override and roleplay-bypass patterns flagged structurally. Anomaly score on the agent's tool sequence; Kill Switch on threshold. | YES · BLADERUN |
| Financial advice from a non-licensed agent | Per-domain output policy: a customer-service or general-assistant agent emitting buy/sell/hold framing, return projections, or specific instrument recommendations is blocked at the response boundary and the session is flagged for review. | YES · BLADERUN |
| Regulatory disclosure missing | Output policy validates required disclosures for regulated content (Reg E, lending decisions, insurance quotes). Missing-disclosure pattern blocks the response and surfaces the gap to the SOC. | YES · BLADERUN |
| Hate speech / unsafe content | Provider-native moderation owns the detection (Azure Content Safety, OpenAI moderation, Bedrock Guardrails). BladeRun consumes the verdict, writes Time Machine audit, isolates on repeat policy breach. | DELEGATED |
| NSFW / sexual content in output | Provider moderation. BladeRun audit trail and per-agent reputation scoring on top. | DELEGATED |
| Brand-tone enforcement | Specialized brand-safety vendors (Persado, Writer, in-house style models) are purpose-built for this. BladeRun integrates as a downstream policy hook; we do not build a tone classifier. | PARTNER |
| Misinformation / factuality | Out of BladeRun's scope as a primary control. Factuality is a model-quality and retrieval-grounding problem. BladeRun records the response for downstream evaluation and can flag low-confidence emissions for review. | PARTNER |
Banks already buy content moderation through their model provider. It ships in the box with Azure OpenAI, with Anthropic on Bedrock, with Vertex. Showing up to a CISO conversation pretending to compete on hate-speech detection invites the right follow-up question and we lose the meeting.
The security-relevant slice, jailbreaks, regulatory-violation output, missing-disclosure gaps, audit trail, is where BladeRun is differentiated and where the bank's risk actually concentrates. That is the boundary we own. Everything outside it, we route, integrate, or recommend a partner. BladeRun is a verifier, not an issuer, a decision input, not a competing engine. CISOs reward this kind of scoping; everyone else who has tried to be the everything-tool has eventually had to walk it back.
Roleplay-bypass framings, "developer mode" lures, encoded payloads, multi-turn slow-jailbreaks. The Gateway L3 classifier scores instruction-override and bypass intent structurally, paraphrase-resistant, updated through the Federation rule channel. Content inspection is best-effort; the deterministic isolation it triggers is the guarantee.
A customer-service agent at a bank is not licensed to give investment advice. A general-assistant agent at an insurer is not authorized to make a coverage commitment. The output policy enforces this at the response boundary, before the customer sees the answer.
Every flagged output, jailbreak block, regulatory rewrite, provider-moderation downgrade, is written to Time Machine with the original prompt, the original response, the policy that fired, and the operator (human or automated) who reviewed it.
Where jailbreak and regulated-domain output policies run. Same pipeline as the rest of the L1–L5 stack.
Per-agent baseline of how often it triggers content-policy events. Drift from baseline raises risk score and shortens review interval.
Native integration patterns for Azure AI Content Safety, OpenAI moderation, and Amazon Bedrock Guardrails. Ship audit, isolation, and Federation signal on top.
No. BladeRun's primary scope is runtime governance, security and regulatory enforcement. Content safety in the brand-safety / hate-speech / NSFW sense is delegated to your provider moderation (Azure AI Content Safety, OpenAI moderation, Bedrock Guardrails) or a specialized vendor. We integrate, audit, and add isolation on top. We do not replace the content classifier.
Yes, that is the recommended pattern. Provider moderation runs upstream in the model call. BladeRun runs in the call path and consumes the verdict, writes Time Machine audit, isolates on repeat breach, and adds the regulated-domain output policy that provider tools do not cover. The two stack cleanly.
Provider moderation owns the detection. BladeRun owns the response: which agent triggered it, how often, in which session, under which prompt. The audit trail and the cross-session reputation score are the BladeRun contribution. If your provider tier is Bedrock Guardrails or Azure Content Safety, the integration is configured in the Gateway and runs by default.
If a customer requirement materializes that provider-native moderation does not meet, for instance a region or language coverage gap, we would add it. We have not so far because the providers cover the core classes well and we do not believe in shipping a worse version of a solved problem. If that calculus changes, the L3 layer is the place to extend.
The regulated-domain output policy validates required disclosures per content class and per agent role. Lending decision agents must include the adverse-action notice text; Reg E transaction confirmations must include the dispute-rights language; insurance quote agents must include licensure and binding-disclaimer language. The policy is configurable per agent and per institution; the audit record shows the exact language emitted, the disclosure check, and (if rewritten) the original and final versions.
A 1-hour technical session. We map your existing content stack, provider moderation, brand-safety vendor, regulatory review, and show you exactly where BladeRun fits, what it covers, and where it explicitly does not.