Skip to main content

Inbound Rules

Where DLP guards what an agent sends out, Inbound Rules guard what comes back in. They are the inbound response gate: rules that evaluate tool responses before they reach the agent — stripping prompt injection, capping oversized payloads, and gating untrusted content. Open Policies → Inbound Rules.

Inbound Rules Inbound Rules — the response gate, its scope filter, and the catalog templates for common inbound protections.

Why this layer exists​

A tool response is untrusted input. A malicious or compromised MCP server (or a poisoned document) can return text that tries to hijack the agent — the classic indirect prompt injection. Inbound Rules intercept that response and clean or block it before the model ever sees it. This is AOC-1: Inbound Injection in the agentic-security model.

Scope and stats​

Rules can be scoped Tenant-wide, Per-agent, or Per-tool (the scope filter, top-right). The stat cards track Rules Active, Inbound Responses Scanned (24h), Modifications (transformations applied), and Pass-throughs (responses left unchanged).

The catalog​

Start from a ready-made template rather than authoring from scratch:

TemplateWhat it does
Strip prompt injectionMarkdown / hidden instructions in tool responses are stripped before reaching agents.
Block oversized payloadCap inbound responses (e.g. at 256 KB) to prevent context-window flooding.
Quarantine image contentSuspicious image inclusions are held in quarantine for review.

Use Create rule to author a custom inbound rule, or install and scope a template. Every fire is recorded in the Matched events audit trail on this tab.

Managing rules​

  1. Pick a scope (tenant / agent / tool) for the protection.
  2. Install a catalog template or Create rule for a custom transformation.
  3. Watch Modifications vs Pass-throughs to see how often the gate is acting.
  4. Check the Matched events trail (and the Decision Trace) to see exactly what was stripped or blocked.

See Inbound Rules for the detection model and Outbound Injection Scanner for the complementary outbound direction.