How it works

TrustGuard returns a verdict. The collector applies it with whatever the host can actually do — a gateway can forward a masked payload; a provider hook limited to allow or deny cannot.

TrustGuard evaluates content against a policy and returns a verdict. Each collector applies that verdict using the capabilities of its host platform. TrustGate appears here through its native collector, which evaluates traffic routed through the gateway. The tables below describe TrustGuard coverage, not the full capabilities of each host platform. For request processing and response fields, see the Evaluate API.

​

Policy actions

One request can trip several rules. TrustGuard reduces them to a single outcome and hands the host that one answer, worst first: Block → Ask → Transform → Monitor → Allow. Redaction requires the host to own and modify the payload. Integrations that return only a yes-or-no verdict cannot mask anything. Ask applies only to input. Interactive development tools may show an approval prompt; noninteractive integrations must map the status to allow or block:

​

Collectors

Collectors cover different traffic paths. A gateway collector covers your AI services, while a coding-agent collector covers developer and agent activity on local machines. Neither sees the other’s traffic.

​

LLM interactions

Legend: ✅ supported; ⚠️ conditional; ❌ not supported; ➖ the collector does not expose this surface. Input is the request sent to the model provider, including prompts, tool definitions, tool-call arguments, and tool results. Output is the model’s response.

​

Input

​

Output

Streaming responses: TrustGate and LiteLLM inspect a streamed response after it has been delivered to the client, so findings on streamed output are monitor-only. The other gateway integrations cover only non-streaming responses. Azure APIM output: It can mask on the way in, but not on the way back — covering responses at all requires adding the outbound policy. Copilot prompts: Copilot ignores what the hook returns on a submitted prompt, so prompts are recorded but cannot be stopped at that point. Enforcement happens at the tool events. Copilot Studio prompts: Microsoft hosts inference and exposes no hook for it, so the model response is never seen and the model in use is never sent — a rule targeting a specific model cannot be written on this path at all. The user’s message is evaluated, but only at the moment a tool is about to run, so a conversation that never calls a tool is never inspected. Write every rule for this collector in the Input direction; an Output rule saves but is never reached.

​

Tool-level interactions

These collectors apply policy between an agent and tools such as MCP servers, shell commands, and patches. A call is the action the agent is about to take. A result is the content returned by the tool.

​

Tool call

​

Tool result

Tool-result hooks run after the tool call and cannot undo it. Claude Code and Codex can return a block decision and reason as post-tool feedback, but they do not replace the result content. Cursor adds the finding as an untrusted-content warning and does not return a permission decision. GitHub Copilot support is conditional because result replacement works only with its native payload. Middleware collectors see HTTP routes rather than model or tool calls, so they do not expose tool-level coverage. SDK integrations can send tool events explicitly. Catching a poisoned tool description needs an integration that reports which tools the agent was offered, not just which one it called. That rules out the developer-machine plugins: they send tool calls and results, but never the list. It is available from TrustGate on MCP, from LangChain for bound tools, and from the Inference Hooks transcript — where the only available response is to deny the whole inference.

​

Choose an integration

Every integration page states what that host can actually enforce, in the capability row at the top — Monitor, Block, and whether redaction is supported at all. Read that row before committing to an integration: a host that lists only Monitor and Block cannot mask, whatever the policy says. Create the policy in Observe mode. Observe records decisions in Activity without enforcing them. Review the results, then switch the policy to Enforce.