Protection Overview

Evaluation catches vulnerabilities you know to test for. Attackers will also try techniques you did not expect, such as new prompt injections, encoding tricks, and social engineering patterns that emerge after your last evaluation. Dome protects Agents at runtime. Its content Guardrails scan data before and after Agent execution. Direct Dome calls return a ScanResult; your application or framework integration decides how to apply the result, such as stopping execution or returning blocked or sanitized content. For tool-using Agents, Trust Runtime adds trust controls when you configure them. These controls include SPIFFE workload identity, Console or local constraints, tool-level mandatory access control, signed tool manifest support, tool attestation, structured audit events, and optional enforcement heartbeats. Use secure_agent() with LangGraph, Google ADK, or Strands, or use TrustRuntime directly for a custom integration.

​

Choose a Protection Interface

​

How Dome Works

A Guardrail contains one or more Guards, and each Guard invokes one or more Detectors. Input and output Guardrails run on opposite sides of Agent execution:

​

Protection Types

Dome supports six Guard categories. The following table shows representative registered Detectors rather than the complete catalog:

​

Default Guardrails

Dome() creates input and output Guardrails with the following default checks: The default prompt injection and moderation models require the local extra when you run them locally, and Presidio PII detection requires the pii extra. You can instead set DOME_INFERENCE_URL to route supported Detectors, including the default model and PII Detectors, to an inference service.

​

Configuration Sources

Choose a configuration source that matches how you operate Dome:

​

Scan Results

Every input or output scan returns a ScanResult with these key members:

​

Framework Integrations

You can call Dome.guard_input() and Dome.guard_output() from any Agent framework. For the complete trust stack, secure_agent() provides built-in adapters for LangGraph, Google ADK, and Strands. Tool enforcement depends on the integration points exposed by each framework. LangGraph tool access control is best-effort because the compiled graph must expose tool functions that the adapter can discover and wrap. LangGraph checks streaming output only after it yields the chunks, so an output Guard cannot retract delivered chunks.

​

Execution and Failure Options

Early exit and parallel execution are independent options at both the Guardrail and Guard levels: By default, Guards and Guardrails use early exit and do not use parallel execution. Disable early exit to run every configured check. You can also combine early exit with parallel execution; Dome cancels pending checks after one flags content. When configuration omits on-error settings, Dome(enforce=True) defaults to fail_closed, while Dome(enforce=False) defaults to fail_open. Explicit Guardrail-level or Guard-level on-error values override the inherited default. Failed methods remain available in errored_methods for inspection.

​

Next Steps