Choosing Your Protection Posture
Before configuring a custom policy for Agent Harness Security, consider the following:- Start with visibility: Add detection rules to your policy’s Detect list and watch the findings from your coding agents in the console before enforcing anything.
- Enforce where it counts: Move rules to the Block list to stop prompt injection, secrets exfiltration, or dangerous tool use at the pre-execution gates (prompt submission, tool calls, shell execution).
- Redact, don’t break: At gates that support redaction (tool calls and tool results), your policy’s Redact list sanitizes sensitive entities — the agent keeps working, minus the sensitive data.
- Audit everything: Post-execution and turn-completion gates give you a complete record of agent activity, even where no enforcement is possible.
Automatic Detections
HiddenLayer’s Agent Harness Security has five prompt-injection attack patterns automatically assigned to detect and enforce inline from day one.Rules, Policies and Projects
- A detection rule evaluates AI agent activity and includes a threat level (Critical, High, Medium, or Low). Rules identify risky behavior. Rules do not decide what happens next.
- A policy is an enforcement decision built from detection rules. A policy has a Block list, a Detect list, and a Redact list. When a rule in a Block list matches, traffic is blocked. When a rule in the Detect list matches, the activity is flagged without interrupting execution. See Policy to set up a policy.
- A project connects your traffic to a policy. Every request identifies into a project, and the project determines which policy is enforced. See Project to set up a project.