Rules that only run in a pipeline cannot see what an application does when it is live. Guard is Safeguard's product for that gap, and it is in early access.
What it is
Guard runs inside your application as middleware and library hooks. It checks incoming requests, SQL queries, shell commands, file paths, outbound calls, LLM client calls and MCP tool calls against guardrails you write in Safeguard. Rules cover requests, paths, methods, payloads, rate limits and egress allow lists. It also lists detection of prompt injection, jailbreaks and secrets in LLM prompts, and redaction of secrets and personal data.
How it deploys
The page lists one middleware line for Express, FastAPI, Django, Spring Boot, ASP.NET or Go. Node, Python or Java apps can start through Guard's runner without code changes. A proxy or sidecar (Docker, Kubernetes with Helm, Envoy) covers services you cannot modify. Install only from registry.safeguard.sh and verify signatures with cosign before you run it.
Monitor, then enforce
Guard has two modes. Monitor records what a guardrail would have blocked, without blocking. Enforce requires explicit confirmation to switch on, and you can switch back at any time. Every decision is logged and exportable, and every mode change is recorded.
- Turn on monitor mode for one service.
- Read what it would have blocked for a week.
- Fix rules that are too broad.
- Switch that service to enforce, then move to the next.
Each service reports the policy version it holds and when it last synced, which tells you if a rule has actually arrived.
Quick check
Which mode blocks nothing?
Monitor mode. It only records what would have been blocked.
