# Prompt firewalls — Use case > Block jailbreaks, redact PII, detect injection, and enforce policy on every prompt and every completion — before either touches the model or the user. *AI teams · Safety · For AI teams* ## Inbound and outbound. Prompt and completion. Same firewall. Apinizer's AI Gateway applies policy on the way in and on the way out — jailbreak detection, PII redaction, injection scoring, regex denylists, and policy-driven blocks — without changing the application. [Request a demo](https://calendly.com/apinizer/15min) · [Read the docs](https://apinizer.com/developers/docs) --- ## The problem *The problem* ### LLM safety isn't a model property. It's a runtime property. Every model has a jailbreak; every prompt can carry PII; every completion can leak. The fix isn't waiting for a perfect model — it's putting a firewall in front of every model and a filter in front of every completion. Apinizer's AI Gateway does both: detect, redact, score, block, audit. Same plane as the API. --- ## Capabilities ### Decode before you scan An attack wrapped in base64 is still an attack. Encoded content — base64, hex, URL encoding, unicode escapes, HTML entities — is decoded before any guard reads it, with depth and size ceilings so a decode bomb cannot stall a request. Only the inspection sees the decoded form; the body forwarded to the provider is never rewritten. ### Jailbreak detection Preset pattern libraries score every inbound prompt, and an external guardrail engine — an LLM-as-judge endpoint, or any OpenAI-compatible judge (vLLM, Ollama) — gives a second opinion when a pattern is not enough. Versioned signature packs mapped to OWASP LLM Top 10 and MITRE ATLAS keep the pattern libraries current, and a drift channel tells you when yours is versions behind. Run it inline, async, or in shadow mode while you tune it. ### PII redaction Twelve built-in identifier types — TCKN, IBAN, Turkish phone, card, email, IP, passport, SSN, and more — validated by checksum before masking, so real identifiers get redacted and ordinary numbers do not. Applied to the prompt on the way in and the completion on the way out, including across streaming chunk boundaries. Where the workflow needs the real value back, the placeholder is restored for authorized roles only — deny-by-default, and every restore audited. ### Content safety on a published taxonomy Fourteen hazard categories from the MLCommons AILuminate taxonomy ship built in, and a catalog screen adds your own without waiting for a release. The same check runs on streaming responses, so a completion that drifts into a blocked category is caught on the way out — and each guard decides for itself whether system, user, assistant, or tool messages are in scope. ### Conversation-integrity checks Forged role sequences and model control tokens are caught structurally before the model sees a tampered conversation. MCP and A2A tool results run through the same masking pipeline as prompts, so a poisoned tool response is not a side door. ### Outbound content filters DLP presets catch credentials and secrets in both directions, and your own regex and element rules catch whatever else must not leave the model. Versioned built-in rule packs cover the 18 HIPAA Safe Harbor identifiers and PCI DSS cardholder data behind a fast-scan gate, and a file embedded in a body is identified by its signature bytes rather than the content type it claims. A block sticks across the whole exchange, not just the offending chunk. ### Policy as data Firewall rules ship as data, not code. Review in Git, apply via APIops, propagate to every Worker in seconds. ### Audit and explainability Every block and redaction captured with reason, score, and policy reference. Auditors and developers see the same explanation. --- ## Real-world examples ### Banking **Scenario:** Istanbul bank blocks account-number leaks in chatbot completions **Outcome:** Outbound filter detects 16-digit patterns adjacent to keywords. Blocked completions log an explanatory event; the user gets a safe fallback message. ### Healthcare **Scenario:** Munich hospital redacts patient identifiers before LLM ingest **Outcome:** Inbound redaction strips names, IDs, dates. The model summarizes; the completion is re-keyed back to the patient on the gateway side, never inside the model. **Metric:** 0 PHI to model ### Public sector **Scenario:** Paris agency scores jailbreak attempts in real time **Outcome:** 1.8% of citizen-chatbot prompts flagged jailbreak-suspicious. Half rerouted to a hardened model with a stricter system prompt; half blocked outright. ### Insurance **Scenario:** Madrid insurer detects RAG-injection in customer documents **Outcome:** Documents uploaded by customers occasionally carry 'ignore previous instructions' patterns. Scorer blocks the prompt; SOC reviews the document offline. ### Media **Scenario:** Milan publisher prevents source-code leaks in AI-assisted editor **Outcome:** Outbound filter blocks any response containing API keys or repo paths. Editorial productivity unchanged; risk posture significantly improved. ### Telecom **Scenario:** Amsterdam carrier enforces locale-specific PII rules **Outcome:** Each jurisdiction's national identifiers — tax IDs, citizen numbers, social-security formats — redacted with the right pattern in the right locale. Same firewall, different rules per region. ### Energy **Scenario:** Prague utility blocks tool-poisoning attempts on operations agents **Outcome:** An adversarial document tried to coerce an operations agent into changing SCADA parameters. Injection scorer caught it; the agent never saw it. ### Government **Scenario:** Caspian-region ministry runs prompt firewall in front of the national chatbot **Outcome:** Per-locale PII patterns, jailbreak rules, and outbound denylist tuned for the local language. The compliance officer signs the audit pack without changes. --- ## Recommended modules - [AI Gateway](https://apinizer.com/products/ai-gateway) — Prompt firewall built in — jailbreak detection, PII redaction, injection scoring, outbound filters. - [Analytics Engine](https://apinizer.com/products/analytics-engine) — Blocks and redactions appear in the same telemetry as cost and latency. - [Monitoring](https://apinizer.com/products/monitoring) — Severity-aware alarms when block rate spikes or new jailbreak patterns appear. - [Identity Manager](https://apinizer.com/products/identity-manager) — Tie firewall outcomes to consumer identity — repeat offenders revoked at the auth layer. --- ## Resources - [Prompt firewall overview](https://docs.apinizer.com/en) — Inbound and outbound rules, scoring blends, policy-as-data — how the firewall composes. - [AI Gateway](https://apinizer.com/products/ai-gateway) — The lane the firewall runs on — alongside routing, caching, and audit. - [Monitoring](https://apinizer.com/products/monitoring) — Anomaly detection on block rates and emerging patterns. - [APIops manifests](https://apinizer.com/developers/apiops) — Firewall rules ship as data, review in Git, apply idempotently. - [Compliance lane](https://apinizer.com/solutions/kvkk-gdpr-bddk-compliance) — How firewall outcomes feed KVKK / GDPR / BDDK evidence. - [Architecture overview](https://docs.apinizer.com/en/concepts/architecture) — Where the firewall sits in the AI lane. --- ## Related use cases - [MCP server governance](https://apinizer.com/solutions/mcp-server-governance) — For AI teams - [AI observability](https://apinizer.com/solutions/ai-observability) — For AI teams - [KVKK / GDPR / BDDK compliance](https://apinizer.com/solutions/kvkk-gdpr-bddk-compliance) — For executives - [Agent-to-Agent (A2A)](https://apinizer.com/solutions/agent-to-agent) — For AI teams --- ## Next step *Safety as a runtime property* **Block before the model. Filter before the user.** A 30-minute walkthrough — jailbreak, PII, injection, outbound filters — on a Kubernetes of your choice. [Book a Demo](https://calendly.com/apinizer/15min) · [Read the docs](https://apinizer.com/developers/docs) --- ## Links - Products: https://apinizer.com/products - AI Gateway: https://apinizer.com/products/ai-gateway - Solutions: https://apinizer.com/solutions - Pricing: https://apinizer.com/pricing - Developers: https://apinizer.com/developers - Documentation: https://docs.apinizer.com/index-en - Blog: https://apinizer.com/blog - Contact: https://apinizer.com/company/contact © 2026 Apinizer. All rights reserved.