# 118 AI Guardrails · 18 Categories · Every One Auditable

> NeuralSeek's regulated AI control surface. 118 individually-configurable guardrails across 18 categories. Every guardrail is a real, enforceable, audited setting in the platform — not a slide.

Canonical URL: https://neuralseek.com/guardrails
Alternate (HTML): https://neuralseek.com/guardrails
Content-Type: text/markdown; charset=utf-8

## Hero Stats

- **118** AI Guardrails
- **18** Guardrail Categories
- **120+** LLMs Governed
- **9** Model Providers
- **9** Compliance Frameworks (HIPAA · GDPR · PCI-DSS · CCPA · SOC 2 · ISO 27001 · FedRAMP · ISO 42001 · NIST AI RMF)
- **100%** Audit Coverage

## Trust Anchors

- Born from thousands of go-lives in regulated sectors.
- Verizon runs on NeuralSeek globally with near-zero latency.
- Prompt-injection guardrail list curated from real production attacks.
- Red-team guardrails are continuously updated as new attack patterns emerge.

---

## The 18 Categories and 118 Individual Guardrails

### 1. Retrieval Grounding Guardrails (6)
Domain: Grounding · Controls what comes out of the knowledge base

1. **Document Score Range** — Threshold band for documents pulled from the knowledge base.
2. **Date Penalty** — Freshness weighting; penalize stale documents.
3. **Query Cache** — Reuse retrievals for identical queries within a window.
4. **Max Docs** — Hard ceiling on how many sources reach the LLM per call.
5. **Snippet Size** — How much of each source paragraph is forwarded as context.
6. **Max Raw Score** — Cap on raw retrieval scores before re-ranking.

### 2. Hallucination Prevention Guardrails (11)
Domain: Grounding · Sentence-level enforcement that answers stay grounded

7. **Semantic Score threshold** — Minimum semantic match between answer and source.
8. **Re-Rank** — Semantic re-ranking of retrieved documents.
9. **Check Titles** — Require title-level grounding.
10. **Check URLs** — Require URL-level grounding.
11. **Key Term Penalty** — Penalize answers missing key entities present in the source.
12. **Term Penalty** — Penalize answers missing required terms.
13. **Source Jump penalty** — Penalize answers stitched across unrelated documents.
14. **Total Coverage Weight** — Weight passages by how much of the answer they cover.
15. **Re-Rank Min Coverage %** — Drop answers below a coverage threshold.
16. **Hallucination KW removal** — Sentence-level removal when proper nouns aren't in source.
17. **Hallucinated Term Allowlist** — Closed-loop remediation. Click a hallucinated term on the dashboard to allow-list it permanently.

### 3. Prompt Injection Guardrails (5)
Domain: Adversarial Defense · Direct and indirect injection

18. **Prompt Injection Removal Threshold** — Threshold for removing injection attempts mid-stream.
19. **Prompt Injection Block Threshold** — Threshold for blocking the request outright.
20. **Blocked Word Action** — Action when a blocked word is detected.
21. **Blocked Word List** — Managed + customer-supplied blocked-word list.
22. **Indirect Prompt Injection Protection** — Catches malicious content hidden in retrieved documents, URLs, and tool outputs.

### 4. PII & Sensitive Data Guardrails (5)
Domain: Privacy · 13 detector categories, 5 enforcement actions

23. **PII Action** — Mask / Flag / No Action / Hide / Delete.
24. **Pre-LLM Regex** — Regex pass before content ever reaches the model.
25. **LLM-Based PII Detection** — Contextual; catches what regex misses.
26. **Out-of-the-box Detector Library** — 13 detector categories.
27. **Trust Words** — Allow-list overrides for known-safe terms.

### 5. Answer Confidence Guardrails (7)
Domain: Answer Quality · Sliding-scale thresholds on every gate

28. **Warning %** — Surface a warning below this confidence.
29. **Minimum Confidence %** — Refuse to answer below this confidence.
30. **Minimum Confidence % for URL** — Suppress URLs in the answer below this confidence.
31. **Min Words** — Reject under-length answers.
32. **Max Words** — Cap on answer length.
33. **Verbosity** — Per-tenant terse ↔ verbose dial.
34. **Force KB** — Refuse to answer outside the knowledge base.

### 6. Profanity Guardrails (2)
Domain: Content Safety · LLM moderation + NeuralSeek-native filter

35. **Filter Mode** — LLM moderation / NeuralSeek filter / off.
36. **Blocked Reply Text** — Custom response when content is blocked.

### 7. Attribute Protection Guardrails (1)
Domain: Brand Safety · Misinformation tolerance

37. **Misinformation Tolerance slider** — Rigid ↔ Standard slider for brand-protected attributes.

### 8. Intent & Routing Guardrails (7)
Domain: Orchestration · Intent classification and multi-agent routing

38. **Match Type** — Exact / Vector Similarity / Fuzzy / Keyword / Fuzzy Keyword.
39. **Intent Match Threshold %** — Threshold for intent classification.
40. **Edit Cache** — Cache TTL for edited answers.
41. **Normal Cache** — Cache TTL for auto-generated answers.
42. **Multi-Agent routing** — Route across specialized sub-agents.
43. **Cache Context** — Bind cache hits to conversational context.
44. **Cache KB** — Bind cache hits to the exact knowledge base.

### 9. Hybrid Search Guardrails (4)
Domain: Grounding · ELSER + KNN + Re-Sort

45. **Query Type** — Lucene · Vector · Hybrid.
46. **ELSER** — Elastic Sparse Encoder toggle + model ID + embedding field.
47. **KNN Vector query** — Custom KNN vector query JSON.
48. **Re-Sort priority values** — Priority values applied after retrieval.

### 10. LLM Control Guardrails (12)
Domain: Orchestration · Per-call, per-model behavior

49. **Temperature** — Randomness floor/ceiling per call.
50. **Top-P** — Nucleus sampling cap.
51. **Frequency Penalty** — Discourage token repetition.
52. **Max Tokens** — Hard cap on generated tokens.
53. **Min Tokens** — Floor on generated tokens.
54. **Streaming** — Streaming on/off override per node.
55. **Per-Call model selection** — Model selection at the node level.
56. **Model selection** — Per-platform default LLM.
57. **Cache** — Per-call response cache.
58. **Prepend** — System-prompt prepend.
59. **Images (multimodal)** — Multimodal image attach controls.
60. **Timeout** — Per-call timeout in milliseconds.

### 11. Memory Guardrails (6)
Domain: Session Governance · Per-tenant isolated

61. **LG Timeout** — Language-generation timeout.
62. **Context Turns** — Conversational depth window.
63. **Session TTL** — Session lifetime.
64. **User TTL** — Per-tenant user-isolated lifetime.
65. **Context Detect** — Auto-detect when context is required.
66. **Force Context** — Force conversational context to be carried.

### 12. Multi-Language Guardrails (2)
Domain: Localization · Auto-detect any language

67. **Cross Language toggle** — Auto-translate cross-language queries.
68. **Default Language** — Per-tenant default language.

### 13. Output Rendering Guardrails (8)
Domain: Channel Delivery · Chat-widget, voice, telephony-ready

69. **Relax Filters** — Conditionally relax retrieval filters.
70. **Stream Plan** — Surface multi-step plans during streaming.
71. **Log Alt** — Log alternate generations.
72. **VA Format** — Voice-agent / telephony output format.
73. **Embed Links** — Inline source links in responses.
74. **Unique Links** — Dedupe repeated source links.
75. **Stopwords** — Stopword stripping at output time.
76. **HTML Clean** — Sanitise HTML before delivery.

### 14. Audit & Compliance Guardrails (10)
Domain: Governance · Every change versioned, attributed, exportable

77. **Corp Filter** — Per-tenant corporate document filter.
78. **Corp Logging** — Enterprise logging master toggle.
79. **Logger Type** — S3 / Splunk / Datadog / SIEM destination.
80. **Endpoint** — Configurable logger endpoint.
81. **Prompt Logging** — Full prompt + response capture.
82. **Hide Keys** — Auto-redaction of sensitive keys in logs.
83. **Configuration Version Control** — Git-style versioning of every configuration change. Diffable, attributable to a named user with timestamp.
84. **Configuration Diff & Rollback** — Visual redline diffs and point-in-time rollback for any config version.
85. **Cache Savings Tracking & ROI Reporting** — Quantifies cache-prevented spend in dollars, every day.
86. **ISO 42001 / NIST AI RMF Compliance Mapping** — Out-of-the-box mapping to ISO/IEC 42001 and the NIST AI Risk Management Framework.

### 15. Prompt Engineering Guardrails (3)
Domain: Authoring · Template-level, per-intent, per-agent

87. **Custom Prompt builder** — Prompt builder with secrets, variables, and system vars.
88. **Instructions** — Free-text system-prompt directives.
89. **Regex Rules** — Find/replace at the input AND output boundary.

### 16. Secrets & Credential Guardrails (2)
Domain: Security · 6 vault back-ends, BYOK/HYOK

90. **Secret Name** — Named secret slot referenced in flows.
91. **Secret Value** — Vault-backed runtime resolution. 6 vault back-ends, BYOK / HYOK.

### 17. Model-Agnostic Guardrails (13)
Domain: Orchestration · API / Workflow / Platform-level swap + bake-off

92. **API-level model swap** — Single parameter, no code refactor.
93. **Workflow-node-level model selection** — Per-node model selection in the AI-IDE.
94. **Platform-level default LLM** — Global default cascades to every agent.
95. **Built-in LLM bake-off** — Side-by-side benchmark across any number of LLMs.
96. **Accuracy comparison metric** — Bake-off accuracy.
97. **Latency comparison metric** — Bake-off latency.
98. **Cost-per-call comparison metric** — Bake-off cost-per-call.
99. **Hallucination rate comparison metric** — Bake-off hallucination rate.
100. **Confidence comparison metric** — Bake-off confidence distribution.
101. **Token usage comparison metric** — Bake-off token usage.
102. **Workflow A/B comparison** — Run two workflow variants head-to-head.
103. **Cost projection** — Per-call, per-flow, per-tenant cost capture and savings quantification.
104. **Exportable comparison reports** — Procurement-ready exports.

### 18. Red Team & Rogue AI Guardrails (14)
Domain: Adversarial Defense · Built-in suite, continuously updated

105. **Built-in adversarial test suite** — Ships in the product.
106. **Prompt Injection test bucket** — Direct and indirect.
107. **Data Exfiltration test bucket** — PII leaks, training-data extraction, credential leaks.
108. **SQL Injection test bucket** — Adversarial inputs targeting back-end queries.
109. **Unauthorized Access test bucket** — Identity spoofing, privilege escalation.
110. **Service Disruption test bucket** — Rate-limit / abuse / DDoS scenarios.
111. **Continuous threat-intel updates** — New attack patterns added as they emerge.
112. **Self-serve on-demand execution** — Customers run the full suite against their own deployment.
113. **Pass/fail scoring report** — Exportable scoring per agent.
114. **AI-generated remediation guidance** — An LLM reads the test results and writes the remediation report.
115. **Runtime attack detection** — Live attack detection at request time.
116. **Rate limiting** — Per-tenant / per-agent rate limiting.
117. **Abuse detection** — Abuse-pattern flagging.
118. **DDoS protection** — DDoS mitigation at the agent / API level.

---

## 4-Layer Hallucination Defense

Four enforced perimeters; every layer logs separately. Low-confidence answers route to fallback agents — never silently shipped.

1. **Perimeter — Force KB.** The LLM literally cannot answer outside the knowledge base.
2. **Hallucination Prevention (11).** Re-rank · Coverage Weight · Source Jump · Hallucination KW removal · Hallucinated Term Allowlist. Sentence-level removal when proper nouns aren't in source.
3. **Answer Confidence (7).** Min % · URL % · Warning % · custom fallback. Sliding-scale thresholds on every gate.
4. **Agentic Fallback.** Custom workflow in the AI-IDE. Route low-confidence answers to human review, fallback flow, or rewrite.

---

## Model-Agnostic — Swap Any LLM

### 3 Switching Levels

- **Level 1 · Platform** — Global default LLM cascades to all agents.
- **Level 2 · Workflow / Agent** — Per-node model selection (Send-to-LLM).
- **Level 3 · API** — Single-parameter model swap, no code refactor.

### 9 Providers · 120+ Models

Amazon Bedrock (29) · watsonx.ai (28) · together.ai (14) · Google Vertex AI (13) · OpenAI (11) · Azure Cognitive Services (10) · HuggingFace (10) · xAI Grok 4.x (8) · Cloudflare (7) · OpenAI-compatible (∞).

### Bake-Off Metrics

Accuracy · Latency · Cost / Call · Hallucination Rate · Confidence · Token Usage.

---

## Red Team & Rogue AI

In-product. Self-serve. Continuously updated. 14 guardrails grouped into 5 attack buckets:

- **Prompt Injection** — direct + indirect (malicious content hidden in retrieved docs, URLs, tool outputs).
- **Data Exfiltration** — PII leaks, training-data extraction, credential leaks.
- **SQL Injection** — adversarial inputs targeting back-end queries.
- **Unauthorized Access** — identity spoofing, privilege escalation.
- **Service Disruption** — rate limiting, abuse detection, DDoS mitigation at the agent / API level.

3 pillars:

- **Built-In Suite** — ships in the product.
- **Continuously Updated** — threat-intel feed; new attack patterns added as they emerge.
- **Self-Serve** — on-demand. Customers run the full suite against their own deployment.

---

## PII & Sensitive Data — 13 detectors × 5 actions

### 13 Detector Categories (OOTB)
Name · Credit Card · Street Address · Zipcode · US Phone · UK Phone · IP Address · US SSN · Email · Username · Password · Credentials · Phone (global).

### 5 Enforcement Actions
Mask · Flag · No Action · Hide · Delete.

Pre-LLM regex pass + LLM-contextual detection. Allow-list overrides for known-safe terms.

---

## Compliance & Audit

### 9 Frameworks
HIPAA · GDPR · PCI-DSS · CCPA · SOC 2 · ISO 27001 · FedRAMP · ISO 42001 · NIST AI RMF.

### Audit Capabilities
- **Full attribution** — every guardrail change is versioned (who, what, when).
- **Auto-redaction** — sensitive data hidden from logs by default (Hide Keys guardrail).
- **Exportable** — S3, Splunk, Datadog, customer SIEM (syslog / CEF / JSON).
- **Out of the box** — no bolt-on logging stack required.
- **Git-style versioning** — every configuration change versioned, diffable, attributable, rewindable.
- **Cache ROI** — cache-prevented spend quantified in dollars.

### Sample Audit Trail
```
+0.000s  admin@tenant   tuned retrieval guardrail            [Score Range]
+0.318s  user@tenant    asked about claim status             [Intent · Vector match]
+0.642s  platform       masked credit-card data              [PII · Mask]
+1.014s  platform       routed low-confidence answer         [Confidence · Fallback]
+1.388s  siem           exported audit batch                 [Corp Logging]
```

---

## Secrets & Credentials — 6 Vault Back-Ends

- HashiCorp Vault — Open / self-hosted
- CyberArk Conjur — Enterprise
- AWS Secrets Manager — Cloud-native
- Azure Key Vault — Cloud-native
- Google Secret Manager — Cloud-native
- Customer Enterprise Vault — BYOK / HYOK

Features:
- AES-256, FIPS-validated.
- BYOK / HYOK supported.
- Automated rotation (90-day default).
- Cryptographic erasure on offboarding.

Zero secrets stored on the platform.

---

## Built-In vs You Build

| Capability | Others | NeuralSeek |
|---|---|---|
| Anti-hallucination | "Use a better prompt" | 4-layer Hallucination Prevention stack |
| Multi-LLM swap | Rewrite your integration | Single-parameter Model-Agnostic Guardrail |
| Per-node model selection | Build your own router | Built into the workflow IDE |
| Red teaming | Hire a consultancy | 14 Red Team Guardrails, self-serve, on-demand |
| PII detection | Add a third-party tool | 13 detectors + LLM-contextual, in the box |
| Audit logging | Wire SIEM yourself | Native S3 / Splunk / Datadog / SIEM export |
| Compliance | Self-certify | Built on 9 frameworks since day one |
| Prompt library | Maintain your own | Marketplace with hundreds of agentic workflows |
| Secrets management | Build vault integration | 6 vault back-ends, BYOK / HYOK |
| Configuration version control | Build it on top | Git-style versioning, diffs, rollback in the platform |
| Cache ROI tracking | Estimate it | Live dollar quantification of prevented spend |

---

## The 16-Step Guardrail Pipeline

Every prompt walks this path. Every step auditable.

1. **User Question** — inbound.
2. **Profanity** — LLM moderation or NeuralSeek filter.
3. **Prompt Injection** — managed + custom word list, ML threshold, indirect-injection scan.
4. **PII** — regex + LLM contextual, 13 detectors, 5 actions.
5. **Intent & Routing** — exact / vector / fuzzy / keyword match.
6. **Hybrid Search** — ELSER + KNN + Re-Sort.
7. **Retrieval Grounding** — score range, date penalty, max docs.
8. **LLM Control** — model selection, temperature, max tokens, multimodal.
9. **Hallucination Prev.** — re-rank, coverage, hallucination KW removal, term allowlist.
10. **Answer Confidence** — min %, URL %, force KB.
11. **Attribute Protection** — misinformation tolerance.
12. **Multi-Language** — auto-detect, cross-language.
13. **Output Rendering** — HTML clean, embed links, VA voice format.
14. **Memory** — session / user TTL, context turns, tenant isolation.
15. **Audit & Compliance** — every step logged, redacted, exportable. Config diffs + cache-ROI quantified.
16. **Answer Out** — returned.

---

## What changed from the prior 112 count

Six guardrails were broken out as line items in this revision — they were implicit in earlier work but never enumerated:

| # | New Line Item | Category |
|---:|---|---|
| 17 | Hallucinated Term Allowlist — closed-loop remediation | Hallucination Prevention |
| 22 | Indirect Prompt Injection Protection | Prompt Injection |
| 83 | Configuration Version Control | Audit & Compliance |
| 84 | Configuration Diff & Rollback | Audit & Compliance |
| 85 | Cache Savings Tracking & ROI Reporting | Audit & Compliance |
| 86 | ISO 42001 / NIST AI RMF Compliance Mapping | Audit & Compliance |

Total: 112 + 6 = 118.

---

## Related Resources

- HTML page: https://neuralseek.com/guardrails
- LLM Governance (runtime view, 9 modules): https://neuralseek.com/llm-governance
- Agent Governance (agent-layer APM, 9 modules): https://neuralseek.com/agent-governance
- Platform overview: https://neuralseek.com/
- Documentation: https://documentation.neuralseek.com/
- Trust Center: https://neuralseek.com/trust-center
- Pricing: https://neuralseek.com/pricing
- Contact us: https://neuralseek.com/contact