The limit under each entry is written in the same voice as the control, because a control believed to do more than it does is worse than no control. Every entry is a fact from the threat model that ships with the binary, and where this page and that one disagree, this page is the one that changes.
In the content
Text a person, a record or a tool's reply put into the request. The detectors read it inside the process holding the connection, before the provider sees it.
Personal data leaves
- asset
- a customer's identifiers
- who writes it
- your users, your records, a tool's reply
- where it arrives
- request body, response stream
Pattern and model detectors, six operators, and restore lists for the tools you dial.
limitThe shapes it knows. No paraphrase, no encoding, no coreference.
Prompt injection
- asset
- the instructions the assistant follows
- who writes it
- an outsider, in a user turn or in a page a tool fetched
- where it arrives
- user and tool_result segments, by default
A classifier or an llm judge, denying or annotating, run in shadow until the false-positive rate has been read.
limitReduces rather than prevents. A judge reads exactly the text the attacker wrote.
A guard blind in your language
- asset
- the deny rule's false-positive rate
- who writes it
- ordinary customers, in a script the checkpoint never saw
- where it arrives
- every inspected segment
Invariance measured across languages before a checkpoint is pinned, and both checkpoints kept selectable per rule.
limitArabic recall is unmeasured beyond eight turns, and most languages are unrun.
A secret in the prompt
- asset
- API keys and tokens
- who writes it
- your users, pasting
- where it arrives
- body; header and query when named
19 credential recognizers on by default. Headers and the query string are inspectable and deliberately read-only.
limitA placeholder wearing a key's shape matches. A format nobody published does not.
At the tool call
The model wrote this text, prompted by whatever it read on the way. The rule runs at the hop the call leaves by, before anything is dialled.
A tool call the agent should not make
- asset
- what a tool does with the argument it is handed
- who writes it
- the model, prompted by whatever it read on the way
- where it arrives
- tool name and arguments at the MCP hop; message parts at the A2A hop
An access rule at that hop over the caller and the call, and guardrails over the arguments and the result.
limitA tool the gateway does not dial. An agent that reaches a server directly is ungoverned.
An upstream that sees the gateway rather than the person
- asset
- the upstream's own idea of what each person may read
- who writes it
- the caller, under a token their identity provider issued
- where it arrives
- the credential the gateway sends at the MCP hop
Token exchange with the issuer, so the upstream is handed a token minted for that person and that target.
limitMCP servers only, one hop, and no chain of agents acting for each other.
A server nobody approved
- asset
- which servers agents connect to
- who writes it
- a team, publishing
- where it arrives
- the registry a host takes a URL for
The gateway serves the registry, and every connect URL in it is the gateway's own door.
limitNot a package index. A package a host installs and runs itself has no endpoint to put policy in front of.
On the route
No text arrives here. What is at risk is what the deployment was measured with, when the endpoint that answers preserves less than the provider name suggests. The decision is made during resolution, before the request is forwarded.
A route that quietly preserves less
- asset
- the behaviour you validated, and the capabilities it rested on
- who writes it
- nobody; a compatibility endpoint, a failover candidate, a pool member
- where it arrives
- resolution, before the request leaves
Resolution per channel rather than per provider. A profile pins the capabilities the validated behaviour needed, and a candidate missing one is passed over and counted.
limitA capability claim is a fact about somebody else's service, read on a day and dated. Nothing announces the day it stopped being true.
On the account
No text arrives here. What is at risk is the provider account the gateway holds credentials for, and the claim that every call on it went through the gateway.
Traffic around the gateway
- asset
- the claim that everything goes through it
- who writes it
- a colleague with the same key, a key minted in the same organisation
- where it arrives
- the provider's account, outside the gateway
A second ledger from the provider's usage API, judged against the gateway's own per day and per token class.
limitProviders that publish a usage API, daily, with no attribution to a key, a model or a route. Nothing in a browser.
Credential sprawl
- asset
- the provider's API key
- who writes it
- your own clients
- where it arrives
- client configuration
Clients hold gateway-issued keys. The provider key is swapped in after every mutation and never sent downstream.
limitA compromised gateway host is over.
Unbounded spend
- asset
- the bill
- who writes it
- your own clients, concurrently
- where it arrives
- every forwarded request
Cost is reserved before the request is forwarded and settled against real usage after it.
limitTraffic on the same provider key that never traverses pistra.
What it does not defend against
Stated plainly, and kept honest by the build: a limit named here that the threat model no longer names fails the build rather than shipping.
- A determined exfiltrator. Pattern detection finds structured data in the shapes it knows. Paraphrase, base64, an unusual encoding or a description of a secret pass. Treat guardrails as compliance and accident prevention rather than as an adversary-resistant filter.
- Prompt injection and jailbreaks. Two detectors cover them and both reduce rather than prevent. A classifier catches the phrasings it was trained on and fires on prose about security. A judge reads exactly the text the attacker wrote, and a model that follows instructions can be told what to answer.
- Anything the gateway never sees. Traffic on the same provider key that does not traverse pistra is ungoverned. The coverage audit exists to detect that, on providers that publish a usage API. Nothing prevents it.
- A compromised gateway host. Provider credentials are in memory. A host with an attacker on it is over.
- Model output correctness. Not a security control and not claimed as one.
- Bodies it could not read. Over max_body_bytes, unparseable, or a response whose content type is neither JSON nor SSE. Each is counted in pistra_guardrail_uninspected_total, never assumed clean. Alert on it.
- Entities split across frames of an unknown streaming API. On a route the segmenter has no dialect for, each SSE frame is read on its own. A match spanning two frames is missed. Assembling them would invent entities spanning two unrelated messages, which is the worse error.
What is never written down
Prompt content is not retained, and the four ways to check that claim rather than believe it are in the threat model: what no log statement carries, what traces omit, what the store schema has no column for, and the two honest exceptions. Prompt content is not retained.
The full model
The assets table, the trust boundaries in configuration, the failure behaviour of every detector and every rule, and what each deployment shape changes about all of it: Threat model. What the process needs and what it refuses to start without is in Deployment requirements.