OmniGuardInspect before acting.
Layered request inspection for governed AI applications. Screen every request, evaluate tool policy, score session risk, and return governance headers the calling system can act on.
What the gateway checks,
in order.
Each layer is a separate detector with its own failure mode. A request must pass the sequence before it reaches a tool or a model.
-
01
Injection detection
Pattern-based detection of instruction override, role reassignment and exfiltration attempts across prompt and payload.
Regex + heuristics -
02
Trust boundary
Marks every input segment as trusted or untrusted, so downstream code never has to guess whether a string came from a user.
Segment labelling -
03
Vault lookup
Resolves which scoped credentials a request may touch. Unscoped or expired credentials are not returned.
Scoped resolution -
04
Policy engine
Evaluates declarative rules from configuration. Tool calls outside the allowlist are blocked or escalated, never silently permitted.
YAML + defaults -
05
Session risk
Tracks cumulative risk across a session rather than per request, so a slow escalation across many calls still trips the threshold.
Cross-request state -
06
Governance headers
Returns the decision, the reason and the trace identifiers as response headers the calling system can assert on.
Machine-readable
A decision you can inspect,
in one response.
A governed system should be able to explain a single decision without asking a human to reconstruct it. This is the shape of that response.
Interactive illustration only. Scenario values are examples, not captured gateway responses. No request, model call, or tool execution occurs.
What is verified,
and what is not.
Stated plainly so a security review starts from the real position rather than the marketing one.
Reported development checks
- Dashboard build completes
- Docker startup reaches a healthy state
- Gateway health endpoint responds
- Security regression tests pass
- Bounded benchmark dataset runs end to end
- Live SDK contract tests cover authentication, rejected requests and gateway availability
These checks are reported on the current public page and have not been rerun for this design preview. Passing checks is evidence of internal correctness. It is not a production security certification and no third party has audited it.
Still required for production
- Configured credentials and secret rotation procedure
- Independent integration validation against target systems
- Dependency review and vulnerability scanning
- Operational hardening: rate limiting, failover, alerting
- Threat model sign-off for the deployment context
Until these are addressed, treat OmniGuard as a development preview.
One gateway in front
of the portfolio.
The gateway ships with adapters for each system in this portfolio, so inspection is added once rather than per project.
Delegates tool-call policy evaluation to the existing policy engine.
Forwards inspection outcomes into evaluation traces and metrics.
Validates retrieved context before it enters a prompt.
Resolves scoped credentials through the vault rather than the gateway.
Supplies approval state for governed orchestration steps.
Routes cases requiring qualified human verification.
Source and access
Development is maintained in the WeDoCareGlobal organization. The repository is private; GitHub access is required. Public visitors can request a technical walkthrough.
Place in the portfolio
OmniGuard complements the six published systems and sits in front of them. Ecosystem-wide integration remains subject to project-specific tests; a passing adapter test is not a deployment.