All of them are detection-only. The action — Monitor, Block — and the
phase — Input, Output — are set on the
policy rule that references the detector, not on
the detector itself.
Protection Sensitivity
Most content-security detectors have exactly one setting, and it is the same control everywhere: three preset cards. You pick one; there is no number to type.
Balanced is applied by default. Start there, watch Activity, and move to
Strict only if real threats are getting through — not preemptively.
The firewall provider and its credentials are not part of this form. They are
configured globally for the workspace and keep their defaults per detector.
Create a detector
The same four steps for every detector on this page:- Open Detectors and click New detector — or open the Catalog tab and click Add detector on the card you want.
- On Basics, give it a Name. Use one that says how it is tuned, not what it is: Jailbreak — strict beats Prompt Guard 2, because the type is already shown next to it.
- On Configuration, set what that detector exposes (below).
- Click Create detector, then add it to a policy rule with an action.
Prompt Guard
What it protects against
Someone talking the model out of its instructions — “ignore your rules”, role-play framing, encoded or obfuscated attempts. This is the risk people mean by prompt injection, and it comes from whoever is typing.Configure
Protection Sensitivity only. Pick a preset and save.Toxicity Detection
What it protects against
Abusive, hateful or unsafe language — reaching your agent on the input side, or reaching a person on the output side. The two directions answer different questions: one is abuse of the service, the other is what your agent is willing to say. Findings name the category that scored highest — hate, violence, harassment, self-harm, or sexual — so Activity tells you which kind of problem you have, not just that you have one.Configure
Protection Sensitivity only.Moderation
What it protects against
Your agent being pulled outside what it exists for — answering about a competitor, a regulated subject, or anything you have decided is not its job. Scope control, not safety.Configure
Choose from Topics, a fixed list of thirteen:
Select at least one — the console will not save the detector otherwise. Then set
Protection Sensitivity, which applies to every topic you selected rather than
per topic.
Need a subject that is not on that list? That is Custom Moderation, below.
Custom Moderation
Beta.What it protects against
A subject specific to your business that no built-in topic describes — a competitor’s product line, an internal project name, a regulated matter particular to your sector. Where Moderation asks is this off-topic, this asks is this the topic I described.Configure
Every topic here is yours, up to 128 of them. That is the whole difference from Moderation: there the thirteen subjects are fixed and their definitions live in the product, so you can only switch them on and off. Here you own the definition. To save you starting from a blank page, the console pre-loads those same thirteen as editable drafts. Add one and Customize it, or Add new topic and write your own. Either way, what gets saved is your version. Each topic opens a form in three parts:
The examples matter more than the definition: they are what the topic guard
actually scores against, so two or three realistic ones beat a carefully worded
description.
Then set Protection Sensitivity. As with
Moderation it applies to every topic you defined, not per topic.
URL Analyzer
What it protects against
An instruction hidden in a page the agent is asked to read. The link looks harmless; the payload is on the other side of it. It reads URLs out of the request body and messages — not out of attachments — fetches each page under an SSRF guard, and screens the text that comes back. Up to ten URLs per request, input side only.Configure
This detector does not carry its own sensitivity or entity list. Instead you point it at two detectors you have already created:
If you have neither yet, the console offers Create a Prompt Guard detector and
Create a Data Loss Prevention detector inline.
Optionally restrict Domains with an allow list, a block list, or both. An empty
allow list permits every domain that is not blocked.
Document Analyzer
What it protects against
An instruction hidden inside a file someone uploads — including one rendered as an image, which is why OCR is part of it. This is content risk, not malware scanning: a clean file can carry a hostile sentence. It extracts text from attachments — PDF, Office documents, images via OCR, plain text — and screens it. Input side only.Configure
The same linked-detector model as URL Analyzer: select an existing Prompt Guard detector for injection screening and an existing Data Loss Prevention detector for PII. The warning above applies here too. There is nothing else to set. OCR and injection screening are always on for this detector — there is no switch to forget, and no file-size or language list to tune.When to use
- Prompt Guard is the baseline for any chat traffic. If you deploy one detector, deploy this one.
- Toxicity Detection on output when your agent talks to the public; on input when abuse of the service is the concern.
- Moderation for scope control — “only answer about X”. Custom Moderation when the subject is specific to your business.
- URL Analyzer and Document Analyzer for RAG and agent flows that ingest links or files.
- Tool results are a different detector: Indirect Prompt Injection.