Runtime security for AI agents

Put the decision where the action is

Block prompt injection, stop PII leaks, add guardrails to tools, APIs, and database calls, and block bots. Security & governance for AI agents.

Start with code

1. Run: npx skills add arcjet/skills
2. Add Arcjet protection to my app

Native SDKs and AI agent framework integrations

Securing production workflows at

Works with Claude Code, Codex, Copilot and many others

01 – the problem

Identity tells you who is asking.It cannot tell you what happens next.

How do I stop an AI agent from taking an unsafe or unauthorized action? You can't just ask this at the door, it has to be answered at every step.

Action 1

Read inbound support email – from a known address with a new cc email

Allow

Action 2

Query the customer database – returns names, emails, bank account...

Allow

Action 3

Send a reply – to the address in the original message, and the new one cc'd

DenyorHoldfor review

Arcjet applies security policies across the sequence

Result

Unexpected personal data is emailed

without Arcjet

Risks in a single step are amplified across a workflow.

What your other controls miss

A prompt scanner sees tokens.
A gateway sees a packet.
A dashboard sees yesterday.
The action that actually makes the call is the new boundary.

Unauthorized tool calls

The request looks clean. Then the workflow issues a refund, opens a file share, or hits an internal API that was never in scope for this user. Arcjet enforces at the action boundary, inputs and outputs.

Data exfiltration

Sensitive data, including PII, slips out through prompts, tool outputs and third party calls. It rarely looks like theft at the moment it happens. Check inputs to stop leaking PII into the LLM context, and outputs before they're sent out.

Cost explosion

A runaway loop can burn a month of token budget in an afternoon. Without enforcement in the path, the first anyone hears about it is the invoice. Arcjet holds the quota in the loop itself.

Sequence drift

An agent that started a session reading records ends it writing to production. No single step crossed a line. Arcjet is judging the shape of each run over time, so the drift itself is the thing that trips the rule.

02 – how it works

Observe. Enforce. Audit.

Find everything, enforce policies, and prove you did.

IObserve
Every action an agent takes is captured and linked to sequences and session runs. Context is preserved throughout.
Sees: user, session, route, actor, tool label, typed arguments, prior steps
IIEnforce
Enforce policies at the action boundary. Deterministic checks executed in real-time and implemented in OPA/Rego. Checks: prompt injection, sensitive info, tool guards, MCP allowlists, bot signals, action policy, run history.
Returns: allow, block, redact, hold for review
IIIAudit
Every decision and the context behind it is kept as evidence, and available for auditing at any time. Pipe everything into your SIEM for detection and alerting.
Keeps: decisions, policy version, actor, inputs, run history

03 – the controls

What Arcjet enforces

Stop coding agents from making unsafe or unintended actions.
Return typed decisions to custom agents for handling before execution.
Protect web applications from abuse.

Prompt injection detection

Catch hostile instructions in user input, API responses, and tool output, before either reaches the model.

1
const arcjet = launchArcjet({
2
  key: process.env.ARCJET_KEY!,
3
});
4
const injection =
5
  detectPromptInjection();
6

7
// What the user typed, and
8
// what the agent's tool
9
// fetched
10
const page =
11
  await fetchPage(url);
12
const decision =
13
  await arcjet.guard({
14
    label: "agent.research",
15
    rules: [
16
      injection(userMessage),
17
      injection(page.text),
18
    ],
19
  });
20

21
// Your call
22
if (
23
  decision.conclusion === "DENY"
24
) {
25
  return;
26
}

Agent tool controls

Scope what every agent may do by identity, role, route and typed input, then enforce it at the moment the tool is called rather than in the prompt that asks for it.

1
const arcjet = launchArcjet({
2
  key: process.env.ARCJET_KEY!,
3
});
4

5
// Wrap your agent tool call
6
const refund = guardTool(
7
  arcjet,
8
  refundTool,
9
  {
10
    action: "order.refunded",
11
    actor: user.id,
12
    inputs: ({ amount }) => ({
13
      amount: policyInput.server
14
        .number(amount),
15
      role: policyInput.server
16
        .string(user.role),
17
    }),
18
  },
19
);
20
// on DENY, refundTool never runs

Sensitive information and Data Loss Prevention (DLP)

Strip names, addresses, national IDs, bank and card numbers before they reach model context, logs, or a third party tool.

1
const arcjet = launchArcjet({
2
  key: process.env.ARCJET_KEY!,
3
});
4
// rampart() detects on device:
5
// names, addresses, IDs, banking
6
const pii =
7
  localDetectSensitiveInfo({
8
    backend: rampart(),
9
  });
10

11
// Screen the record before it
12
// becomes context or a tool call
13
const decision =
14
  await arcjet.guard({
15
    label: "agent.support",
16
    rules: [pii(ticket.notes)],
17
  });
18

19
if (
20
  decision.conclusion === "DENY"
21
) {
22
  return strip(ticket.notes);
23
}

Token and spend budgets

Cap tokens and calls per user, per org, and per agent. The budget belongs to the run, so a loop cannot spend it four times over by touching four different endpoints.

1
const arcjet = launchArcjet({
2
  key: process.env.ARCJET_KEY!,
3
});
4
const budget = tokenBucket({
5
  refillRate: 2_000,
6
  intervalSeconds: 3600,
7
  maxTokens: 5_000,
8
});
9

10
// One budget per user, org,
11
// or agent run — not per
12
// endpoint
13
const decision =
14
  await arcjet.guard({
15
    label: "agent.run",
16
    actor: user.id,
17
    rules: [budget({
18
      key: user.id,
19
      requested: estimatedTokens,
20
    })],
21
  });
22
// DENY when it is spent,
23
// before the model call

Bots and the classic surface

The AI stack still runs on HTTP. Shield WAF, bot detection with real time threat feeds across 25 tracked categories, email validation and signup protection, all from the same client and the same decision object.

1
const aj = arcjet({
2
  rules: [
3
    shield({ mode: "LIVE" }),
4
    detectBot({
5
      mode: "LIVE",
6
      allow: [],
7
    }),
8
    validateEmail({
9
      mode: "LIVE",
10
      deny: ["DISPOSABLE"],
11
    }),
12
  ],
13
});
14

15
// Same decision object as
16
// the agent guards
17
const decision =
18
  await aj.protect(req, {
19
    email,
20
  });
21
// Your call
22
if (decision.isDenied()) return;

04 – policy

Two routes to policy. Use both.

Engineers want rules in the repo, reviewed and tested like everything else. Security teams need to change policy without waiting for a release. Arcjet splits the policy from the inputs so both are true at once.

I – Owned by engineering

Rules in code

Rules live next to the handler they protect. They go through review, they are covered by tests, and they ship on your normal release path.

20 native SDKs & framework integrations
Version controlled and diffable
Unit testable with helpers for captured actions
Dry run mode before anything blocks

II – Owned by security

Remote policies

Policy is managed in the cloud and takes effect immediately. Engineering supplies the inputs and handles the result. Nobody has to open a pull request to tighten a rule.

Change policy in real time, no code deploy
Consistent across every service and workflow
Model the blast radius before you turn it on
Every decision recorded, audit ready

05 – position

An import you ship this afternoonNot a control plane to roll out

No gateway, no proxy, no migration to get there – let your coding agent set it up. Arcjet runs in the code you already deploy, so your failure domain doesn't grow and coverage rolls out service by service.

Context is the thing you lose on the way out.

Anything in front of your application sees traffic. It does not see the function that moves the money, the arguments about to be passed to it, or the three steps that made this one risky.

Arcjet sees the arguments
A refund of $12,000 and a refund of $12 look the same from the network.
Arcjet works everywhere
Coding agents, queue consumers, scheduled jobs, and workflow steps. They all take actions.
Nothing new to keep alive
No sidecars or containers to run. Nothing to try to scale at 3am. Arcjet works through Coding agent hooks and SDK integrations in-code.

Network edgeSees packets
GatewayAllow/Deny
DashboardsAfter the fact
ArcjetSees the action

Enforcement shipped today.Not in a month, or in a quarter.

06 – proof

Ready for your stackwhatever and wherever you run.

LLM and framework agnostic. Deploy through coding agent hooks, OTel, provider integration, AI framework integrations, and native SDKs.

SOC 2
Type II, unqualified opinion.Security, availability and confidentiality.
< 1ms
Local decision overhead.20 to 30ms when the cloud API is needed.
20 SDKs
Claude Code, Codex, Copilot, JavaScript, Python and Go, across AI frameworks and runtimes.
600+
Bot types detected across 25 categories, without serving a CAPTCHA.

Evidence stored in Arcjet cloud, single tenant, private VPC, or your own storage.

Full detail on the trust page

07 – FAQ

Frequently Asked Questions

Position and rollout. A control plane or gateway is adopted by the organization and sits outside your applications, which means the decision is made without the arguments about to be passed to the tool. Arcjet is a package you add to the code that takes the action, so the decision has the user, the input and the run history, and one engineer can ship the first one the same day.
They are not mutually exclusive. Plenty of teams run a gateway for discovery and routing and use Arcjet for the enforcement that has to happen inside the app.
Every decision is kept with the context that produced it, including the policy version, the actor, the inputs and the run it belonged to, so a security review or an audit gets evidence rather than a reconstruction. Sensitive checks run in your process, so the raw data never leaves your environment even though the record of what happened does. Keep that evidence in Arcjet cloud, in a single tenant or private VPC deployment, or in storage you manage yourself.