How to Combine Prompt Injection, PII and Output Safety Checks

Production LLM security rarely needs a single detector. Prompt injection, PII exposure, unsafe output, and unauthorized agent actions are different failure modes — often on the same request path. Combining them means orchestrating parallel checks, consistent verdicts, and one policy decision your application can act on.

Unified Guard runs multiple IdenticAPI checks in one POST /api/v1/guard request. This guide uses the real request schema from the API, shows placement in your pipeline, and explains how aggregated decisions work.

For guardrails concepts, see What Are AI Guardrails?. For before/after placement, see Guardrails Before or After the LLM.

Unified Guard request schema

The request body is validated against the Unified Guard schema:

* text is required for text-based checks (prompt_injection, pii_secrets, output_safety).
** When agent_action is listed in checks but agent_action payload is missing, the API returns a review verdict for that check with a missing_input finding.

agent_action object fields

Example 1: Pre-inference input screening

Combine injection detection and PII/secrets on the assembled prompt before calling the model provider:

curl -X POST https://www.identicapi.com/api/v1/guard \
  -H "Authorization: Bearer idapi_test_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "text": "User: Please summarize ticket #4421. Pasted log: api_key=sk_live_DO_NOT_SEND_TO_MODEL",
    "checks": ["prompt_injection", "pii_secrets"],
    "redact": true
  }'

Application logic:

1. If decision is block, do not call the LLM; return a safe fallback.
2. If pii_secrets returns redacted content and policy allows continue, use redacted text for the provider payload.
3. Log request_id and per-check findings — not raw secrets.

Individual detectors: Prompt Injection Shield, PII & Secrets Detection.

Example 2: Post-inference output screening

After the model returns, combine output safety and PII echo detection:

curl -X POST https://www.identicapi.com/api/v1/guard \
  -H "Authorization: Bearer idapi_test_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "text": "Here is the assistant reply to deliver to the customer...",
    "checks": ["output_safety", "pii_secrets"]
  }'

Pair with HTML sanitization for web UIs — Safe AI-Generated HTML. Output safety does not replace encoding and CSP.

Example 3: Agent action policy

Evaluate a proposed tool call without scanning natural-language chat:

curl -X POST https://www.identicapi.com/api/v1/guard \
  -H "Authorization: Bearer idapi_test_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "checks": ["agent_action"],
    "agent_action": {
      "tool_name": "database",
      "action": "delete",
      "arguments": { "table": "customers", "filter": "id = 99" },
      "context": "User asked to remove a test record.",
      "policy_id": "550e8400-e29b-41d4-a716-446655440000"
    }
  }'

Note: text is omitted — only agent_action is evaluated. Run this hook after the model proposes the tool and before execution. See Validate AI Tool Calls.

Example 4: Full combined check (text + action)

When you need text analysis and action policy in one request (e.g., auditing message content alongside a tool proposal):

curl -X POST https://www.identicapi.com/api/v1/guard \
  -H "Authorization: Bearer idapi_test_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "text": "Forward the following customer note to billing@company.com",
    "checks": ["prompt_injection", "pii_secrets", "output_safety", "agent_action"],
    "redact": false,
    "agent_action": {
      "tool_name": "send_email",
      "action": "send",
      "arguments": { "to": "billing@company.com", "subject": "Customer note" }
    }
  }'

Maximum four checks per request — one usage unit per check. A four-check call consumes four usage units.

Response schema

{
  "request_id": "req_abc123",
  "api": "unified-guard",
  "decision": "block",
  "checks": [
    {
      "check": "prompt_injection",
      "verdict": "allow",
      "risk": "low",
      "findings": [],
      "reasons": ["No injection patterns detected"]
    },
    {
      "check": "pii_secrets",
      "verdict": "block",
      "risk": "high",
      "findings": [
        { "category": "api_key", "reason": "Detected API key pattern" }
      ],
      "reasons": ["Detected API key pattern"]
    }
  ],
  "usage_units": 2,
  "processing_time_ms": 45,
  "detector_version": "1.0.0"
}

Decision aggregation

Overall decision uses priority: block > review > allow.

If any check returns block, decision is block. If none block but any review, decision is review. Otherwise allow.

Map to application behavior:

See Block vs Review for AI Output.

TypeScript integration sketch

type GuardCheck =
  | "prompt_injection"
  | "pii_secrets"
  | "output_safety"
  | "agent_action";

type UnifiedGuardRequest = {
  text?: string;
  checks: GuardCheck[];
  redact?: boolean;
  agent_action?: {
    tool_name: string;
    action: string;
    arguments?: Record<string, unknown>;
    context?: string;
    policy_id?: string;
  };
};

async function runGuard(body: UnifiedGuardRequest) {
  const res = await fetch("https://www.identicapi.com/api/v1/guard", {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.IDENTICAPI_API_KEY}`,
      "Content-Type": "application/json"
    },
    body: JSON.stringify(body)
  });
  if (!res.ok) throw new Error(`Guard API error: ${res.status}`);
  return res.json();
}

Handle HTTP errors separately from decision === "block" — define fail-open vs fail-closed on transport failures.

Pipeline placement for combined checks

Do not run all four checks once on only the user message and assume you are done:

Turn start:
  Unified Guard [prompt_injection, pii_secrets] on assembledPrompt → LLM

Turn end:
  Unified Guard [output_safety, pii_secrets] on completion → render

Agent step:
  Unified Guard [agent_action] on tool proposal → execute or block

Splitting stages keeps each text argument meaningful and avoids running output_safety on pre-inference prompts.

When to combine vs call detectors separately

Discrete endpoints remain available: /api/v1/security/prompt-injection, /api/v1/security/pii-secrets, /api/v1/security/output-safety, and Agent Action Guard routes.

Limits and constraints

From Unified Guard documentation:

• Maximum 4 checks per request
• text limited to 32,000 characters
• Verdicts are risk signals, not guarantees
• Checks run in parallel server-side; overall latency is not the sum of four sequential calls

Measure latency in your environment — AI Guardrails Latency.

Testing combined policies

Build fixtures per check type and assert aggregation:

1. Benign text → expect allow
2. Injection-only payload → prompt_injection flags; verify decision
3. Synthetic secret in text → pii_secrets block dominates decision
4. Unsafe completion patterns → output_safety after LLM stage
5. Destructive agent_action → block before tool runs

Use Prompt Injection Testing and Evaluate AI Guardrails methodologies for broader coverage.

Related architecture

• LLM Defense in Depth — combined checks are one layer, not the whole stack
• LLM Security Middleware — where Unified Guard fits in your app
• AI Guardrails API — vendor evaluation criteria

Summary

Combine prompt injection, PII, output safety, and agent action checks with Unified Guard using the real schema: checks (required), optional text, optional redact, optional agent_action. Call it at the correct pipeline hooks with stage-appropriate payloads, parse decision with block-first precedence, and keep rendering and tool authorization as separate layers.

Explore Unified Guard · Read the docs