Prompt Firewall

Real-time PII detection and redaction for AI requests.

Overview

The Prompt Firewall protects your AI agents from accidentally leaking sensitive data to LLM providers. It detects and redacts:

• Personal Identifiable Information (PII): Names, emails, phone numbers, addresses, SSN
• API Keys: 30+ providers (OpenAI, AWS, GitHub, Stripe, Google, Azure, etc.)
• Financial Data: Credit cards, bank accounts
• Health Information: Medical records, patient IDs

Firewall Modes

Mode	Behavior	Use Case
Monitor	Log detections but don't block	Development, testing
Enforce	Block requests with sensitive data	Strict compliance
Redact	Replace sensitive data with placeholders	Production (recommended)

Configuration

# Set firewall mode
export TOKLIGENCE_FIREWALL_MODE=redact  # or monitor, enforce

Detection Methods

Built-in Regex Filters

Fast pattern-based detection for common formats:

• Email addresses
• Phone numbers (international formats)
• Credit card numbers
• Social Security Numbers
• API keys (pattern-based)

Presidio Sidecar (Optional)

For NLP-based detection across 100+ languages:

• Named entity recognition (NER)
• Context-aware detection
• Multi-language support
• 3-5ms latency, CPU-only

# Enable Presidio sidecar
docker-compose -f docker-compose-presidio.yml up -d
export TOKLIGENCE_FIREWALL_PRESIDIO_URL=http://localhost:5001

API Key Detection

The firewall detects API keys from 30+ providers:

Provider	Pattern
OpenAI	sk-...
Anthropic	sk-ant-...
AWS	AKIA...
GitHub	ghp_..., gho_..., ghs_...
Stripe	sk_live_..., sk_test_...
Google	AIza...
Azure	Connection strings
And more...

Redaction Styles

When in redact mode, sensitive data is replaced:

# Original
My email is john@example.com and my API key is sk-proj-xxxxx

# Redacted
My email is [EMAIL_REDACTED] and my API key is [API_KEY_REDACTED]

Logging & Audit

All detections are logged to the ledger:

{
  "timestamp": "2024-01-15T10:30:00Z",
  "type": "firewall_detection",
  "category": "api_key",
  "provider": "openai",
  "action": "redacted",
  "request_id": "req_xxx"
}

Best Practices

1. Start with Monitor mode to understand detection patterns
2. Review false positives and adjust sensitivity
3. Enable Redact mode for production
4. Use Enforce mode only when blocking is acceptable

Example Configuration

# config/gateway.ini
[firewall]
enabled = true
mode = redact
log_detections = true

# Detection categories
detect_pii = true
detect_api_keys = true
detect_financial = true
detect_health = true

# Presidio integration (optional)
presidio_url = http://localhost:5001

Integration with Coding Agents

The firewall works seamlessly with:

• Codex CLI: Protects prompts before translation
• Claude Code: Protects messages at the gateway
• Custom agents: Any OpenAI/Anthropic-compatible client

All protection happens transparently without code changes.