Skip to main content

VCAL Security Guard

VCAL Security Guard is an optional commercial module for applying deterministic security checks to text entering and leaving AI Cost Firewall.

It can allow, warn, block, or escalate requests and responses. Request-side blocks stop processing before Privacy Guard, cache lookup, or upstream delivery. Response-side blocks occur before Privacy Guard restore.

Security Guard returns explicit decision fields to AI Cost Firewall, so the firewall does not need to infer enforcement from risk scores or finding severity.

Integration point​

Client
  -> AI Cost Firewall
  -> VCAL Security Guard request scan
  -> VCAL Privacy Guard (optional)
  -> cache / upstream LLM
  -> VCAL Security Guard response scan
  -> VCAL Privacy Guard restore (optional)
  -> Client

Typical AI Firewall configuration:

security_guard_enabled true;
security_guard_url http://vcal-security-guard:8091;
security_guard_api_key your-security-guard-key;
security_guard_timeout_seconds 3;
guard_fail_open false;

For production-style enforcement, Security Guard is typically configured to use enforce mode. The requested scan mode must also be permitted by the active Security Guard license.

Security Guard may return controlled service-level errors such as:

401 Unauthorized for missing or invalid authentication;
403 Forbidden when the requested scan mode is not licensed;
429 Too Many Requests when a licensed scan-rate limit is exceeded;
503 Service Unavailable when the service is not ready to accept new work.

AI Cost Firewall handles Security Guard availability and service failures according to guard_fail_open.

Service health​

Basic service checks:

curl http://localhost:8091/healthz
curl http://localhost:8091/readyz
curl http://localhost:8091/metrics

/healthz reports process liveness. /readyz reports whether Security Guard is ready to accept scan requests and becomes unavailable during graceful shutdown or when the active license is no longer valid.

Matched finding examples are omitted by default to reduce accidental disclosure of sensitive prompt or response content.

See Configuration for AI Firewall directives or Troubleshooting for common failures.

note

This page intentionally covers only the AI Cost Firewall integration boundary. Full Security Guard documentation will be maintained separately.