# Agentic Runtime Security Agentic Runtime Security provides real-time detection and enforcement for modern, agentic AI. It protects not just a single prompt and response, but multi-turn sessions that call tools, span multiple models and providers, and may have an autonomous agent as the requester. Recommended Agentic Runtime Security is the recommended way to protect AI applications. The prior version of AI Runtime Security remains fully supported; see [What's different](#whats-different) below for a comparison. Requesting access Agentic Runtime Security is being rolled out and may not be enabled for your tenant yet. To request access, contact your HiddenLayer Account Representative or HiddenLayer Support to enable it for your tenant and get started. ## What it protects against Agentic Runtime Security inspects what goes into and comes out of your AI models: the prompts and tool inputs sent to a model, and the responses and tool results it returns. It surfaces outcomes such as: - **Prompt injection**: attempts to override instructions or hijack the model. - **Sensitive data / PII**: personal or regulated data in inputs or outputs. - **Code**: source code in messages, which may indicate exfiltration or unsafe generation. - **URLs**: links that may be used for data exfiltration or phishing. - **Denial of service**: oversized or abusive inputs. - **Off-policy language**: content in languages outside your allowed set. - **Model guardrails / refusals**: the model declining to answer or being blocked. ## Key concepts Agentic Runtime Security is built from a few core concepts that the rest of these docs build on: - **Evaluation**: you call the evaluation endpoints (directly, with the HiddenLayer SDK) to check a model request, response, or a whole interaction, and HiddenLayer returns the findings and an action to take. See [Get Started](/docs/products/runtime/agentic/get_started) and [Evaluation Endpoints](/docs/products/runtime/agentic/evaluation_endpoints). - **Session**: the related calls of one agent run, reconstructed into a single, replayable conversation you can investigate and govern as a whole. See [Agentic Sessions](/docs/products/runtime/agentic/sessions). - **Policy**: CEL detection rules with **Block**, **Detect**, and **Redact** actions, authored in the Console, that decide what is flagged and what happens. See [Policy](/docs/products/runtime/agentic/policy). - **Integration**: a pre-built connector that makes the evaluation calls for you, at an AI gateway or proxy, or inside an agent framework as a guardrail, instead of wiring them by hand. See [Integrations](/docs/products/runtime/agentic/integrations). Results appear in the Console as sessions and detections, governed by the policies you control. ## Where it fits in an agent workflow Agentic Runtime Security fits into the points where your application, agent framework, or gateway exchanges data with a model: it can evaluate a model request before the model runs, and evaluate a model response before your application returns it or acts on a tool call. ```mermaid flowchart TD U["User or agent input"] --> REQ["Evaluate request (request-evaluations)"] REQ -->|"block"| B1["Return block message"] REQ -->|"allow or redact"| M["Model / provider"] M --> RESP["Evaluate response (response-evaluations)"] RESP -->|"block"| B2["Block or stop tool"] RESP -->|"assistant response"| OUT["Return response to user"] RESP -->|"tool call"| TOOL["Run tool"] TOOL --> TR["Tool result"] TR -->|"next turn"| REQ ``` How tool use is screened: - Tool calls (the model deciding to call a tool) are model outputs, so `response-evaluations` screens them before your application runs the tool. - Tool results become model inputs on the next turn, so `request-evaluations` screens them before the model sees them. - `interaction-evaluations` can represent tool calls and results directly in a submitted interaction and returns structured findings. ## Complete agentic sessions An agent doesn't make one model call. It loops across many turns and tool steps, often spanning multiple models and providers, until it produces a final answer. Evaluated in isolation, those calls are disconnected events with no shared context, hard to investigate and hard to govern. The standout value of Agentic Runtime Security is that it stitches those individual request and response evaluations back into one coherent, replayable **session**. You investigate incidents and write policy in the context of the whole agent run, not one event at a time. | | Isolated events | Reconstructed session | | --- | --- | --- | | **What you see** | One event at a time, unconnected | The whole conversation, in order | | **Correlation** | None | Every call correlated back to the workflow it belongs to | | **Request + response** | Separate, unlinked | Paired together per turn | Conceptually, each call is correlated back to the workflow it belongs to, the whole conversation is grouped together, and each turn's request and response are paired. To see which identifiers carry this correlation and how to instrument it, read [Agentic Sessions](/docs/products/runtime/agentic/sessions). ## What's different The prior version of AI Runtime Security is still fully supported. Agentic Runtime Security is recommended for new work because it is designed around how modern agents actually behave: many turns, tool calls, and multiple providers within a single unit of work. - **Complete agentic sessions.** Many individual evaluations are reconstructed into one ordered, replayable session, rather than isolated interactions and detections. See [Agentic Sessions](/docs/products/runtime/agentic/sessions). - **Built for agents.** Tool calls (`tool_use` / `tool_result`), multi-turn sessions, and agent requesters are first-class, rather than a single prompt-and-response framing. - **Provider-native input.** It accepts common LLM wire formats directly (OpenAI Chat Completions, OpenAI Responses, and Anthropic Messages), plus an explicitly described interaction format. See [Evaluation Endpoints](/docs/products/runtime/agentic/evaluation_endpoints). - **Expressive policy.** Policies are built from CEL-based detection rules with **Block**, **Detect**, and **Redact** actions, authored in the Console, rather than fixed category toggles. See [Policy](/docs/products/runtime/agentic/policy). ## Next Get Started Make your first evaluation with the SDK.