NeuralTrust | Platform for Agent Security.

Fastly provides CDN caching, DDoS protection, and WAF services in front of websites and APIs. Compute runs your code at the edge before forwarding a request to its declared backend. This integration evaluates inbound requests to AI endpoints served through the Compute service without changing application code. It does not inspect model responses, individual tool calls, direct provider traffic that bypasses Fastly, or employee access to third-party AI.

Integration capabilities

Product	What it does in Fastly	What you can enforce
TrustGuard	Runs inside your Compute service, evaluating the request body against the assigned policy before the request is forwarded to the `origin` backend	Monitor · Block

Before you start

Requirement	Notes
A Fastly collector, API key, and assigned policy	Go to Runtime → Collectors → Catalog → Edge / WAF → Fastly. Create the collector, create the `tgk_…` key on its Auth tab, and assign an Input-phase policy on the Policies tab. The key is shown once and identifies the collector.
Egress from the Compute service to `{TRUSTGUARD_URL}`	The console shows the URL for your workspace. Configure it as a declared backend, as described in step 3.
A Fastly service already fronting the AI endpoints	The handler runs only on requests Fastly terminates. Traffic that bypasses the service is not evaluated.
Rights to edit that service’s backend configuration	Configure the `trustguard` and `origin` backends in step 3.
A Fastly Secret Store	Where the collector key lives, so it is not a literal in the service source.
Node and npm	`npm create @fastly/compute` scaffolds the service. See step 2.
The Fastly CLI	Used to publish (`fastly compute publish`).

Start with the policy in Observe mode. Findings appear in Activity without affecting traffic. Switch to Enforce after reviewing the results. See Policies.

1. Create a collector API key

On the Fastly collector, open Auth and create a key. It is shown once. The key identifies the collector and its assigned policy; the request body does not need a collector ID.

2. Scaffold the Compute service

npm create @fastly/compute

Put the handler in src/index.js. Configure the remaining settings on the service backends.

3. Declare the backends and store the key

A Compute service can fetch only declared backends. Declare two:

Backend name	Points at
`trustguard`	The `{TRUSTGUARD_URL}` evaluate host shown in the console
`origin`	Your application, the one this service already fronts

The handler passes these names as backend. If a name is wrong or undeclared, the corresponding fetch does not leave the edge. Put the tgk_… key in a Fastly Secret Store and read it from there in the handler. The snippet uses the literal <collector-api-key> for clarity. Replace it with a Secret Store lookup.

4. Evaluate the request body

The handler clones the request, sends the body to POST /v1/evaluate over the trustguard backend with the collector key as a bearer token, and forwards to origin only if the verdict is not block:

addEventListener("fetch", (event) => event.respondWith(handler(event)));

async function handler(event) {
  const req = event.request;

  if (req.method === "POST") {
    const text = await req.clone().text();
    const result = await fetch("{TRUSTGUARD_URL}/v1/evaluate", {
      method: "POST",
      backend: "trustguard",
      headers: {
        Authorization: "Bearer <collector-api-key>",
        "Content-Type": "application/json",
      },
      body: JSON.stringify({
        protocol: "llm",
        direction: "input",
        payload: { input: text },
        consumer_id: req.headers.get("x-user-id") ?? "",
        session_id: req.headers.get("x-session-id") ?? "",
      }),
    }).then((r) => r.json());

    if (result.status === "block") {
      return new Response("Blocked by TrustGuard", { status: 403 });
    }
  }

  return fetch(req, { backend: "origin" });
}

The following details determine what the handler evaluates:

req.clone(): read the clone, not the request. Consuming the original body stream leaves nothing to forward, and the origin receives an empty body.
req.method === "POST": other methods pass through without evaluation. Update the condition if an endpoint accepts prompts through another method.
payload.input is the complete body: the raw POST body as a string, JSON scaffolding, model name and message roles included. Detectors see one blob with no role boundaries: retrieved text, your system prompt and the user’s turn are indistinct. payload also accepts a complete OpenAI, Anthropic, or Gemini provider body, so parse and send that object if you need the distinction.

block returns 403 with Blocked by TrustGuard, and the origin is not called. The finding is available in Activity. allow, report, and ask all pass through to origin. Use a block gate for enforcement.

This sample does not implement redaction. A transform verdict contains TrustGuard’s { "input": … } payload rather than your origin’s request schema. Applying it requires custom, schema-aware code that inserts the rewritten text into the original body. Use Block rules unless you have implemented and tested that conversion.

The sample omits error handling around the request to TrustGuard. Catch failures and choose whether to return fetch(req, { backend: "origin" }) (fail open) or a 403 (fail closed). Without a catch, the request fails at the edge.

5. Publish the service

fastly compute publish

The integration covers traffic handled by this service. AI endpoints served by another service or reached without Fastly are not evaluated. The Next-Gen WAF runs first. Requests it rejects do not reach the handler or trigger a TrustGuard evaluation.

6. Verify

Put the policy in Enforce and POST a prompt to a guarded endpoint that trips a rule.
Confirm that the caller receives 403 with the body Blocked by TrustGuard.
Confirm the event in TrustGuard Activity, under the consumer_id you sent as x-user-id.
Send a clean POST and confirm that the origin receives the original body. This verifies that the handler reads the clone rather than consuming the request stream.

Reference

Coverage

Surface	Monitor	Block	Redact
LLM input	✅	✅	❌
LLM output	❌	❌	❌
Tool-level	➖	➖	➖

The handler evaluates POST bodies before forwarding them to the origin. It does not inspect model responses, expose individual tool calls, or support redaction. Each evaluated request adds one round trip to {TRUSTGUARD_URL}.

What is evaluated

Where in the service	TrustGuard	What you can stop	Enforcement
The `POST` body, before `fetch(req, { backend: "origin" })`	`protocol: llm`, `direction: input`; `payload.input` contains the raw body as text	Jailbreaks (Prompt Guard); secrets and PII in prompts (DLP)	Block returns `403` and prevents the origin call
Non-`POST` requests	Not evaluated	Not evaluated	Forwarded
The origin’s response	Not evaluated	Not evaluated	Not evaluated
Tool calls and tool results	Not available. The edge sees one request body, not the agent loop	Not evaluated	Not evaluated

The call is POST /v1/evaluate with the collector tgk_… key as a bearer token, and the policy’s detectors decide the verdict. direction selects which detector phase runs; this handler only ever sends input.

Verdict handling

Verdict	What the handler does
`allow`	Forwards to `origin` untouched.
`report`	Forwards untouched. The finding is in Activity, not in the response.
`block`	Returns `403` with the body `Blocked by TrustGuard`.
`transform`	Records the verdict and forwards the original request. Redaction requires a custom schema-aware implementation.
`ask`	Forwards. The edge cannot prompt a user, so `ask` is allowed and recorded. Use a block gate.

Configuration

Configure the integration in the Fastly service:

What	Where	Notes
`trustguard` backend	Service backend configuration	The `{TRUSTGUARD_URL}` host. See step 3.
`origin` backend	Service backend configuration	Your application. The pass-through `fetch` names it.
Collector API key	Fastly Secret Store	Sent as `Authorization: Bearer …`. The snippet’s literal is a placeholder for that lookup.
Evaluate URL	`src/index.js`	`{TRUSTGUARD_URL}/v1/evaluate`, including the full endpoint path.
Which requests are evaluated	`src/index.js`	The sample evaluates POST. Update the condition for any other method that carries prompts.
Fail-open or fail-closed	`src/index.js`	The sample omits error handling. Add `try`/`catch` and return either the origin response or an error.

Attributes

consumer_id: read from the x-user-id request header, "" when absent. It is what per-consumer policy routing keys on, so without it every caller shares the collector’s default policy.
session_id: read from x-session-id. The sample sends "" when the header is absent. Send a stable, verified conversation ID if you need reliable grouping in Activity.
Both are client-supplied headers. The edge does not derive either one, and a caller can set either value. Replace them with values from an authenticated identity if policy decisions have to be trustworthy.
The sample sends no attributes block, so gates matching on model, source.application or collector.type have nothing to match. Add the dimensions you gate on to the evaluate body.

Troubleshooting

Symptom	Cause
Requests fail at the edge and no events appear in Activity	The `trustguard` backend is missing or its name does not match the handler configuration
Requests fail instead of reaching the origin	The evaluation request failed and the sample has no error handling. Configure failure behavior as described in Configuration
The origin receives an empty body	The body was read without `clone()`, consuming the stream that was going to be forwarded
A blocking prompt still reaches the origin	The policy is in Observe rather than Enforce, or the request was not a `POST` and skipped the guard entirely
A masking policy records but does not mask	Expected. The sample does not apply `transformed_payload`. Use a Block rule unless you implement schema-aware reconstruction
An `ask` gate does not block	Expected. The edge cannot prompt a user, so `ask` is allowed and recorded
The response was not evaluated	This collector has no response pass
Events share one session or have no consumer	The client did not send `x-user-id` / `x-session-id`, and the sample defaults both to `""`
The request never reached the handler at all	The Next-Gen WAF runs first and rejected it

Evaluate API: request and response contract for the endpoint the handler calls
Policies: Observe and Enforce modes, including gate configuration
Collectors: collector keys and policy resolution
Other edge collectors: Cloudflare · CloudFront · Akamai
Fastly documentation: Compute services, backends, and the Secret Store

Start here

AI coding agents

AI gateways

Agent frameworks

Edge / WAF

Build your own

Fastly

Integration capabilities

Before you start

1. Create a collector API key

2. Scaffold the Compute service

3. Declare the backends and store the key

4. Evaluate the request body

5. Publish the service

6. Verify

Reference

Coverage

What is evaluated

Verdict handling

Configuration

Attributes

Troubleshooting

​Integration capabilities

​Before you start

​1. Create a collector API key

​2. Scaffold the Compute service

​3. Declare the backends and store the key

​4. Evaluate the request body

​5. Publish the service

​6. Verify

​Reference

​Coverage

​What is evaluated

​Verdict handling

​Configuration

​Attributes

​Troubleshooting

​Related

Integration capabilities

Before you start

1. Create a collector API key

2. Scaffold the Compute service

3. Declare the backends and store the key

4. Evaluate the request body

5. Publish the service

6. Verify

Reference

Coverage

What is evaluated

Verdict handling

Configuration

Attributes

Troubleshooting

Related