SOLUTIONS · 06
A response is data leaving the building.
A model can copy an IBAN from its context into the answer, or make a commitment on the company’s behalf that nobody approved. Wardline inspects the response before it reaches the user. For streaming responses it does this in small windows, without making the user wait for the whole answer.
THE PROBLEM
Streaming makes inspection harder
In a streamed response text arrives in fragments. An IBAN can be split across two of them, and catching the second half after the first has already been shown is useless. Waiting for the full answer, on the other hand, breaks the chat experience.
Output risk is not only about leaks. A bank assistant can recommend a competitor’s product, promise an interest rate or write at length about something it was never meant to discuss. Those are checked against the organisation’s own lists and scope definition.
HOW IT WORKS
Step by step
Windowing
The stream is cut into windows of roughly forty-eight tokens. The first window is flushed quickly; later ones are gathered with a short wait limit.
Hold-back
The last ninety-six characters of each window are held and inspected together with the next one, so an IBAN or a key split across two windows is never sent half-way.
Outbound inspection
Each window is inspected as outbound traffic: personal data, secrets, toxic content, competitor and brand lists, confidential project names.
Scope signal
Embedding similarity is computed against the topics in a signed scope document. A banking assistant drifting off topic becomes a signal for policy.
Enforcement
MASK rewrites the window and the stream continues. DENY or REQUIRE_APPROVAL cuts the stream and the user sees that the answer was stopped at that point. Non-streaming responses go through the same checks in one pass.
DECISIONS
Which decision you get, and when
| Decision | When | Example reason code |
|---|---|---|
| ALLOW | Nothing found in the window: it goes to the user. | POLICY.DEFAULT_ACTION |
| MASK | Personal data in the response: the value is masked in the window and the stream continues. | OUT.PII_LEAK |
| DENY | A secret in the response: the stream is cut and the rest is not sent. | OUT.SECRET_LEAK |
| DENY | A brand claim or commitment the policy forbids: the stream is cut. | BRAND.FORBIDDEN_CLAIM |
EXAMPLE
Another customer’s IBAN in the answer
A customer assistant quotes from a transaction statement that was added to its context by mistake and starts writing an IBAN. The IBAN falls on the boundary between two windows. The hold-back keeps the first half back, both halves are inspected together and the mod-97 check passes. Policy says MASK; the user gets the rest of the answer with a mask where the IBAN was.
| Decision | MASK |
|---|---|
| Direction | outbound · streamed |
| Location | windows 7–8 · bytes 412–437 |
| Validation | iban · mod-97 valid |
| Stream | continued · 1 mask |
| Reason codes |
|
| Flags | none |
| Risk score | 0.97 |
CONFIGURATION
What administrators control
Entity lists
Competitor names, brand names and confidential project names, each with its own outcome.
Forbidden claims
The kinds of commitments and claims the assistant must not make.
Scope document
The topics the assistant may discuss, distributed with the signed policy version.
Window settings
Window size and hold-back are set per application; the balance between latency and inspection depth is yours to choose.
RELATED
Capabilities that work alongside
See it on your own traffic.
In a demo session we walk through this flow with examples your security team picks, in the console’s evidence viewer.
Request a demo