--- title: "AI Guard for Security | Datadog" description: "Discover your agents, set custom policies, and block harmful actions inline, across any model provider and framework, so you can safely scale agents in production." locale: en canonical_path: "products/security/ai-guard/" --- # Scale AI agents without scaling risk _AI Guard_ Discover your agents, set custom policies, and block harmful actions inline, so you can safely scale agents in production. [Scale AI agents without scaling risk](https://web-assets.dd-static.net/42588/1793331356-hero_front.mp4) ![Scale AI agents without scaling risk](https://web-assets.dd-static.net/42588/1793232271-ai-guard-hero_back.png) Start free trial ## Works out-of-the-box with the models, frameworks, and languages your agents already run on - ![OpenAI Logo](https://web-assets.dd-static.net/42588/1781099461-h_openai_logo.svg) OpenAI - ![Anthropic Logo](https://web-assets.dd-static.net/42588/1781099461-h_anthropic_logo.svg) Anthropic - ![Bedrock Logo](https://web-assets.dd-static.net/42588/1781099461-h_bedrock_logo.svg) Bedrock - ![Vertex Logo](https://web-assets.dd-static.net/42588/1781099461-h_vertexai_logo.svg) Vertex - ![LangChain Logo](https://web-assets.dd-static.net/42588/1781099461-h_langchain_logo.svg) LangChain - ![Vercel Logo](https://web-assets.dd-static.net/42588/1781099461-h_vercel_logo.svg) Vercel - ![Strands Agents Logo](https://web-assets.dd-static.net/42588/1781099461-h_strandsagent_logo.svg) Strands - ![LiteLLM](https://web-assets.dd-static.net/42588/1793324574-h_lite-llm_logo-01.svg) LiteLLM ## Runtime security for AI agents Prevent prompt injection, tool misuse, data exfiltration and other runtime threats. - **Discover agent risk** — See every agent, what resources it can reach, and whether they are exposed. - **Catch multi-step attacks** — Evaluate every prompt, tool, and MCP call against session history, normal agent behavior, and your policies. - **Block attacks inline** — Stop unsafe actions and redact sensitive data mid-loop, in real time. - **Protect with one click** — Enforce using the Datadog tracer you already use, on any model, provider, or framework. ## Protect your agents from inside the application AI Guard sits inline between orchestrators and LLMs, intercepting every interaction in real-time. Turn on protection for a single agent, or cover all of them through your AI gateway. ![Protect your agents from inside the application](https://web-assets.dd-static.net/42588/1793333693-ai-guard_diagram2.png) ### One platform for every team responsible for your agents Get the visibility and control you need, whether you’re shipping agents, protecting them at runtime, responding to attacks, or governing what they can do. ##### Security Leaders: Scale AI safely Understand your risk exposure and keep your agents behaving as intended. Demonstrate what was evaluated, what was blocked, and why. * Discover agents from live telemetry and map the data and systems they touch * Enforce enterprise policies for tool use, custom rules, sensitive data management, and data retention * Export audit evidence tied to a specific agent and session * Map protections to the OWASP Agentic Top 10 and MITRE ATLAS ![Scale AI safely](https://web-assets.dd-static.net/42588/1793233148-ai-guard-persona-1_security-leaders.png) ##### Security Practitioners: Stop attacks before they become incidents Catch real attacks with fewer false positives. Stop agents from taking unsafe actions mid-session, and mask sensitive data in real time. * Block prompt injection, tool misuse, and data exfiltration inline * Triage prioritized signals grouped by agent, session, and attack category * Restrict which tools each agent can call * Investigate signals from wherever you work: AI Guard, Could SIEM, or a third-party SIEM ![Stop attacks before they become incidents](https://web-assets.dd-static.net/42588/1793233159-ai-guard-persona-2_security-practitioners.png) ##### Platform / DevOps: Give dev teams a safe path to production Enforce guardrails using the Datadog SDK you already run. Give development, platform, and security teams shared trace context for investigations. * Turn on enforcement with no new deploy * Protect multiple agents through the AI Gateway * Set global policies to govern all enterprise agents, with customization per service and environment * Follow the trace from AI Guard to Agent Observability and APM ![Give dev teams a safe path to production](https://web-assets.dd-static.net/42588/1793233169-ai-guard-persona-3_platform-devops.png) ##### AI Engineers: Ship secure agents, without slowing releases Turn enforcement on with a single click, and keep agents connected to the content and data they need to do their job. * Protect agents across any model provider and framework * Integrate with your AI Gateways to secure all your model usage * Test policies against real prompts and tool calls before deploying * Investigate a blocked call to its root cause within their full Agent Observability or APM trace ![Ship secure agents, without slowing releases ](https://web-assets.dd-static.net/42588/1793233183-ai-guard-persona4_ai-engineers.png) ## A single solution for every team responsible for your agents ### Understand risk exposure: Discover agents with no code changes ![Discover agents with no code changes](https://web-assets.dd-static.net/42588/1793234838-ai-guard-feature-1_understand-risk.png) - **Discover agents with no code changes** — If you already run the Datadog tracer, visibility is immediate and enforcement is one click away. Instrument per agent or hook into your AI gateway for one integration point. - **Map agents to connected services and datastores** — Find your first-party agents and the model endpoints, upstream and downstream services, and datastores they reach, including the security posture of each, for any model or provider. - **Detect sensitive data in prompts and tools** — Identify PII, financial data and secrets moving through prompts, responses, tool calls, and tool results. Know which agents touch sensitive data before you decide what to block. ### Evaluate and customize ![Evaluate and customize](https://web-assets.dd-static.net/42588/1793234851-ai-guard-feature-2_evaluate-customize.png) - **Set sensitivity thresholds per environment and service** — Choose the minimum confidence score needed to flag a threat. Lower the threshold to surface more attacks, raise it to cut noise, and set different thresholds for production and staging. - **Inspect prompts, tool calls, and MCP interactions** — Inspect every prompt, response, tool call, and tool result as it happens, including content translated into another language or hidden with substitution encoding. - **Analyze the full conversation context** — Evaluate each action against the agent’s behavioral baseline, session history, and your enterprise policies to catch slow-build attacks. ### Enforce everywhere ![Enforce everywhere](https://web-assets.dd-static.net/42588/1793234871-ai-guard-feature-3_enforce-everywhere.png) - **Test and enforce policies** — Set tool blocklists to bound what an agent can do. Preview AI Guard’s verdict on any policy change in the Policy Simulator before it reaches production. - **Block unsafe interactions in the request path** — Stop malicious prompts, responses, tool calls, and tool results inline. Catch attacks while the agent is still iterating, before anything is compromised. - **Mask PII, financial data, and secrets** — Redact 400+ types of secrets and credentials in user prompts, responses, tool calls, and tool results, including email addresses, phone numbers, banking data, API keys, and tokens. ### Investigate and respond ![Investigate and respond](https://web-assets.dd-static.net/42588/1793234882-ai-guard-feature-4_investigate-respond.png) - **Focus on the findings that matter** — Signals are tagged by their severity, attack categories, tools involved, and any sensitive data found. See a step-by-step record of the attack path, and investigate the trace in Agent Observability and APM. - **Tighten your guardrails and close the loop** — Block attacking IPs and users, create a security case, or run a SOAR workflow. Push the signal to Jira or your SIEM, or automate response. - **Generate audit evidence** — Export audit records, including evaluation detail and access logs. Every verdict is recorded with the context it was based on. _Documenation_ ### Read the technical documentation [View Docs ](https://docs.datadoghq.com/security/ai_guard/) ## Priced to scale with your agents Choose from annual, monthly, or on-demand plans. ### AI Guard Runtime guardrails for your custom AI agents $0.8 / per 1M input tokens scanned, per month key features - Discover your agents and map their upstream and downstream dependencies - Detect sensitive data, catch behavioral anomalies, and deliver prioritized security signals - Block prompt injection, tool misuse, data exfiltration, and other runtime attacks - Customize policies and guardrails to your use case and risk tolerance Start free trial [See more pricing details ](https://www.datadoghq.com/pricing/?product=ai-guard#products) ### Security and engineering teams scale agents in production Organizations across industries trust AI Guard to secure their agents at runtime. #### Washington Post — Joey Marburger, VP of Content Intelligence ![Washington Post](https://web-assets.dd-static.net/42588/1793305396-h_black_wp_logo-01.svg) > Our customers are news publishers, and the AI features we ship carry their brand and their readers' trust. Prompt injection isn't an abstract risk for us. A single bad output can damage credibility that took years to build. AI Guard gives us the visibility and real-time controls to ship AI without that risk hanging over every release. #### Whoop — Viraj Patel, Senior Software Engineer ![Whoop](https://web-assets.dd-static.net/42588/1793305473-h_black_whoop_logo-01.svg) > Datadog gives us the end-to-end visibility we need to move fast without compromising on security. AI Guard detects threats as our agent runs, and the connection to Agent Observability lets us go from spotting a flagged trace to understanding exactly what went wrong. That runtime awareness gives us the confidence to know we'll see issues before they become real problems. #### DUST Black — Zeïd Marouf, Security Engineer ![DUST Black](https://web-assets.dd-static.net/42588/1793305830-h_black_dust_logo-01.svg) > As an agent platform, security is paramount to address the nuances of agentic AI, like exfiltration risk, authentication, and real-time policy control. Datadog has been a phenomenal partner, and AI Guard gets this right. It goes beyond just scanning prompts in isolation to identify and secure the full risk profile of our customers' agents. ## Frequently asked about AI Guard ### What is Datadog AI Guard? AI Guard is an AI agent security product that protects your homegrown, custom agents against prompt injection, tool misuse, data exfiltration, and other threats at runtime. It evaluates every prompt, response, tool call, MCP call, and API interaction against each agent's behavioral baseline, session history, and the data and tools it can reach. AI Guard runs inline with your agents, blocking malicious activity and redacting sensitive data in real time before anything is compromised. ### What threats does AI Guard protect against? AI Guard protects against prompt injection, jailbreaking, tool misuse, sensitive data exfiltration, and other threats in the OWASP Agentic Top 10. ### What is the "agentic lethal trifecta," and how does AI Guard address it? The lethal trifecta describes three capabilities that make agents vulnerable to attacks. These are access to private data, exposure to untrusted content, and the ability to externally communicate. AI Guard addresses the lethal trifecta by enforcing agent security guardrails at runtime. It evaluates all prompts, responses and tool calls and blocks unsafe behavior in real time, so attempts to manipulate agents are unsuccessful. ### How does AI Guard decide whether to block an action? AI Guard sits inline between orchestrators and LLMs, intercepting every prompt, response, tool call, and tool result in real-time. An evaluator model (LLM-as-a-judge) reviews each one against the full context: the system prompt, running session history, the agent’s behavioral baseline and your custom policies. Each decision comes with reason tags such as data-exfiltration, jailbreak and indirect-prompt-injection. ### How does protection work for agents that call tools or MCP servers? AI Guard evaluates each tool call's intent, arguments, relationship to earlier steps and output. It allows benign intermediate steps to proceed if they align with your organization’s intent for that agent. If intent diverges, AI Guard stops the chain of behavior immediately. ### Can AI Guard detect PII and secrets? Yes. With sensitive data scanning enabled for a service, AI Guard scans LLM inputs, tool calls and outputs. It redacts financial data, secrets, and PII (such as email addresses, phone numbers and Social Security numbers) in real time. ### Which AI models and providers does it support? AI Guard is model and framework agnostic. It works with OpenAI, Anthropic, Bedrock, VertexAI, Azure, and more. ### How do I set up AI Guard? If you already run the Datadog tracer SDK, visibility is immediate and enforcement is one click away. Instrument per agent or hook into your AI gateway for one integration point. [See the documentation](https://docs.datadoghq.com/security/ai_guard/setup/) for full setup instructions. ### Can I test policies in advance? Yes. The AI Guard Policy Simulator lets you submit user input, assistant output and tool calls and see the action and reason in real time. You can also tune the sensitivity threshold and test sensitive data scanning there. ### How do I see which of my agents are unprotected? The Discover page shows your protected and unprotected agents. It maps the model endpoints, datastores, and connected services each agent touches, so you can understand your risk exposure. ### What happens when AI Guard detects an attack? When AI Guard detects and attack, it generates a security signal in theSignals explorer. Each signal carries the attack category, the evaluation result, a severity level and related AI Guard spans, so teams can see the entire session that led to a blocked action and correlate all the agent interactions together for deeper investigation and response. From the Signal, you can block attacking users or IPs, open security cases, or trigger remediation workflows. You can also push a case to Jira or your SIEM and handle it in your security team’s existing systems. ### Who can use AI Guard, and what is the availability? AI Guard is generally available to protect custom agents at runtime. Sign up for a free trial here. Protection for coding agents (such as Claude Code, Cursor, and Codex) is in Preview. [Sign up for a free preview.](https://www.datadoghq.com/product-preview/coding-agent-security-guardrails/) ## Resources and learning - [AI Guard](https://docs.datadoghq.com/security/ai_guard/) — Learn how to enable AI Guard and write your first policy. - [Protect agentic AI applications with Datadog AI Guard](https://www.datadoghq.com/blog/ai-guard/) — See what AI Guard evaluates at each step of an agent run. - [Securing AI agents: Why guardrail placement is a key design decision](https://www.datadoghq.com/blog/securing-ai-agents-guardrail-placement/) — Read why guardrail placement in the request path changes what you can stop. - [What we learned about AI agent security by monitoring our agents](https://www.datadoghq.com/blog/ai-agent-security-lessons/) — Explore what we found running AI Guard detections against our own agents. - [Protect AWS Strands Agents with Datadog AI Guard](https://www.datadoghq.com/blog/ai-guard-aws-strands-agents/) — Understand how AI Guard works with AWS Strands agents. _Get started _ ## Try AI Guard for yourself Start free trial