Persona Guardrail: A Production-Grade Defense Framework for Agentic Systems
Persona Guardrail enforces semantic allowlist/blocklist functional boundaries on LLM agents, raising guardrail accuracy from 85.7% to 95.9% in production deployment.
Persona Guardrail is a runtime defense framework for customer-facing agentic AI systems that enforces explicit functional boundaries through synchronous input and output validation driven by semantic allowlist and blocklist specifications. It ships with PAGE (Persona-Aware Guardrail Evaluation), a benchmark covering benign, adversarial, and out-of-domain interactions on both user and agent turns. Compared with a generic LLM-based guardrail, it improves overall accuracy from 85.7% to 95.9%, raises out-of-domain detection from 57.3% to 93.5%, and cuts the false-approved rate from 25.0% to 4.7%. The framework is deployed in production and meets latency budgets while sustaining low false-block and false-allow rates.
- Runtime guardrail enforces explicit functional boundaries via semantic allowlists and blocklists
- PAGE benchmark evaluates function-specific guardrails across benign, adversarial, out-of-domain turns
- Overall accuracy rises from 85.7% to 95.9%; out-of-domain detection from 57.3% to 93.5%
- False-approved rate drops from 25.0% to 4.7%; deployed in production within latency budget
Full article196 words · extracted from arxiv.org · click to collapse
Large language model-based agents are increasingly deployed to perform domain-specific tasks by interacting with enterprise knowledge, tools, and external services. Existing runtime guardrails primarily target prompt injection and other attack-specific behaviors under a black-box threat model, but provide limited guarantees that agents operate within their intended functionality. As a result, production agents remain vulnerable to malicious requests and out-of-domain queries that existing defenses often fail to distinguish. We present Persona Guardrail, a production-grade runtime defense framework that enforces explicit functional boundaries for customer-facing agentic AI systems through synchronous input and output validation driven by semantic allowlist and blocklist specifications. We also introduce PAGE (Persona-Aware Guardrail Evaluation), a benchmark for evaluating function-specific guardrails across benign, adversarial, and out-of-domain interactions on both user and agent turns. Compared with a generic LLM-based guardrail, Persona Guardrail improves overall accuracy from 85.7% to 95.9%, increases out-of-domain detection from 57.3% to 93.5%, and reduces the false-approved rate from 25.0% to 4.7%. Currently deployed in production, Persona Guardrail meets its latency budget while sustaining a very low false-block and false-allow rate under realistic production workloads. These results demonstrate that Persona Guardrail provides a practical, scalable, and production-ready foundation for securing agentic AI systems.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2610.03434