Guardrails

How Sector8 evaluates proposed AI actions before execution and returns ALLOW or DENY.

How it works

When your runtime routes proposed actions through Sector8, each action is evaluated before side effects start. Honor the returned decision before dispatch.

Proposed AI action
(tool call, API call, model call, or handoff)
    |
    v
Spotlighting
    |
    v
Pre-filter classifier
    |
    v
Rate limiter
    |
    v
Admission and policy
    |
    +-- DENY   -> runtime blocks the action
    |             decision artifact recorded
    |
    +-- ALLOW  -> runtime may execute the action
                  decision artifact recorded

On the MCP connector path only, a borderline action can be held for a human before that ALLOW or DENY is returned. If nobody answers, it is denied. POST /api/v1/evaluate does not wait; it fails closed to DENY.

Enforcement holds where the runtime routes proposed actions through Sector8 and fails closed on gate unavailability or unknown decisions. See the Quickstart and Evaluate API.

If evaluation fails unexpectedly while the action is routed through Sector8, treat the outcome as fail-closed: your runtime should not execute the proposed action. The gate may surface a context-bound GUARD_INTERNAL_ERROR deny with a decision artifact.

The seven invariants

INV-1 - Single execution gate

No authorized routed path from model output to tool execution that skips evaluation. The admission path is the dispatch control point.

INV-2 - Dual gate requirement

Policy decides intent. Authorization decides capability. Execution requires both.

INV-3 - Per-step enforcement

Evaluation runs per tool call, per agent step, after planning and before execution.

INV-4 - Untrusted executor model

The LLM produces candidates. The control plane decides outcomes. LLM confidence is not a security property.

INV-5 - Spotlighting before policy

Content is trust-tagged before policy evaluation. Untrusted content cannot promote its own trust level.

INV-6 - Explicit execution condition

Execute only on an explicit ALLOW that your runtime honors. DENY, missing, or unknown decisions must not execute. On the MCP connector path, an unresolved human hold must not execute; TTL expiry is a deny.

INV-7 - Decision evidence on deny

Deny responses surfaced to the caller include evidence_hash, has_forensic_payload, policy_version_id, and decision_trace_id so operators can correlate what was blocked and why.

Admission Controller checks

Each tool call passes sequential checks. Failure at any check returns DENY immediately.

Check	What it evaluates	Reason codes on failure
0. Rate limiter	Call rate per session before expensive evaluation	RATE_LIMIT_EXCEEDED
1. Tool registration	Tool must be registered	TOOL_NOT_REGISTERED
2. Lockdown and capability	Capability gate for the requested action	LOCKDOWN_RESTRICTED, CAPABILITY_MISSING
3. Object ownership (BOLA)	Caller must own the target object	BOLA_VIOLATION
4. Role authorization (BFLA)	Caller role must satisfy tool required_role	BFLA_VIOLATION
5. Semantic and request risk	Semantic threats, shell injection, SSRF, segmented-input safety, obfuscated payloads	SEMANTIC_THREAT_DETECTED, MCP_SHELL_INJECTION_BLOCKED, SENSITIVE_PATH_BLOCKED, EXTERNAL_DOMAIN_BLOCKED, PRIVATE_IP_BLOCKED, OBFUSCATED_SHELL_INJECTION, PARAM_INJECTION_DETECTED
6. Compliance gate (AC-6)	Pre-execution PII/PHI scan — block dispatch on the routed path when a pattern matches	GDPR_DATA_MINIMISATION_VIOLATION, HIPAA_MINIMUM_NECESSARY_VIOLATION

Check 5 (security threats) runs before check 6 (compliance) so that the reason code identifies the primary threat. A web_fetch to a private IP with PII in the body returns PRIVATE_IP_BLOCKED, not a compliance code.

Human hold on the MCP connector

On the MCP connector path, a borderline action can be held for a human before the connector returns ALLOW or DENY. A reviewer approves or denies via the API. If no action is taken within the TTL window, the request is denied (fail-closed).

POST /api/v1/evaluate is strictly synchronous. If that path would need to wait, it returns DENY with REVIEW_REQUIRED_FAIL_CLOSED.

MCP connector hold
    |
    v
Human queue (TTL window)
    |
    +-- approved -> connector may return ALLOW and execute
    +-- denied   -> DENY, reviewer recorded with the decision
    +-- TTL expires -> DENY

Every approval is a one-time authorization. A second identical request is evaluated again — approval does not persist as a session-level exemption.

Pre-filter

Before the full Admission Controller runs, a fast-path classifier routes requests. These labels are internal routing, not public decision values:

Internal label	Meaning	What happens
BLOCK	High-confidence malicious	deny immediately, AC skipped
PASS	High-confidence benign	continue on the fast path
REVIEW	Ambiguous	continue to full AC evaluation, or hold on the MCP connector

The pre-filter also decodes and reclassifies obfuscated inputs. Covered forms include zero-width insertion, character arrays, hex escapes, base64 blobs, and rot13.

Spotlighting

All content entering policy evaluation is tagged with a trust source before evaluation.

Source tag	Applied to
[UNTRUSTED_CONTEXT source="rag_retrieval"]	retrieved document chunks
[TOOL_OUTPUT: UNTRUSTED] and [UNTRUSTED_CONTEXT source="tool_output"]	results from previous tool calls
[FILE_UPLOAD: UNTRUSTED] and [UNTRUSTED_CONTEXT source="file_upload"]	uploaded file content

Untrusted content cannot promote its own trust level.

What gets blocked

Prompt injection, shell injection, SSRF, obfuscated payloads, PII and PHI exfiltration, data exfiltration, BOLA violations, BFLA violations, and rate-flood or reasoning-DoS patterns.

Forensic telemetry

Blocked actions produce a decision artifact your operators can audit and correlate.

{
  "decision": "DENY",
  "reason_code": "MCP_SHELL_INJECTION_BLOCKED",
  "evidence_hash": "bdbde1558fb883573b0f6e8630ccba1edaf6bed8cb035fa6a48912809149f287",
  "has_forensic_payload": true,
  "policy_version_id": "0dbca364d66447469637bafa2282e635124fcb99eecd6383038e3b652577ebc7",
  "decision_trace_id": "17e797c0-eb5c-4f97-b4a1-2d3e4f5a6b7c"
}

Field	Description
evidence_hash	Fingerprint of the decision evidence for correlation and integrity checks
has_forensic_payload	Indicates whether additional forensic detail is attached to the record
policy_version_id	Policy version or runtime policy identifier applied to the decision
decision_trace_id	Unique audit identifier linking this decision to the evaluation path

Exact reason_code and policy_version_id values depend on your active policy and environment. See Evaluate for the runtime contract.

Compliance coverage

Pre-execution compliance is preventive, not detective. On the routed path, policy can block risky data movement before local dispatch.

Framework	Controls supported at the tool boundary
GDPR	PII detection, data minimization, Art. 5 and 17 audit trail
HIPAA	PHI patterns, minimum-necessary access, logging controls
PCI-DSS v4	PAN and CVV detection, CDE path blocking, Req. 10.2 and 6.3.2
ISO 27001	A.8.2, A.9.4, A.12.4, A.14.2
SOC 2 Type II	CC6.1, CC6.6, CC7.2, CC9.2