Skip to main content

AI Cost Firewall v0.3.0

AI Cost Firewall v0.3.0 adds modular enterprise guard orchestration while keeping the default open-source deployment focused on LLM caching, cost control, and observability.

Added​

  • VCAL Security Guard orchestration.
  • Request-side Security Guard scan before Privacy Guard, cache lookup, or upstream forwarding.
  • Response-side Security Guard scan before Privacy Guard restore.
  • Combined Security Guard + Privacy Guard enterprise flow.
  • Structured guard errors for request blocks, response blocks, guard unavailability, guard timeouts, and guard contract violations.
  • Guard orchestration metrics:
    • aif_guard_requests_total
    • aif_guard_latency_seconds
    • aif_security_blocks_total
    • aif_privacy_restore_skipped_total
  • Security Guard configuration directives.
  • Full enterprise profile examples in configuration documentation.

Changed​

AI Firewall can now run in four modes:

AI Firewall only
AI Firewall + VCAL Security Guard
AI Firewall + VCAL Privacy Guard
AI Firewall + VCAL Security Guard + VCAL Privacy Guard

Recommended full enterprise order:

Security Guard request scan
→ Privacy Guard anonymize/redact
→ exact/semantic cache lookup or upstream LLM
→ Security Guard response scan
→ Privacy Guard restore

Streaming requests are rejected when guard modules are enabled because streaming-safe response scanning and Privacy Guard restoration are not implemented in the current guard contract.

Validation​

v0.3.0 was validated on a testing VM with:

  • AI Firewall
  • VCAL Privacy Guard
  • VCAL Security Guard
  • local OpenAI-compatible mock upstream
  • Redis
  • Qdrant
  • Prometheus
  • Grafana

The mixed-traffic simulation validated:

  • safe traffic allowed through AI Firewall;
  • malicious request-side prompts blocked with HTTP 403;
  • Privacy Guard anonymization and restoration for allowed sensitive traffic;
  • cache bypass requests still passed through guard orchestration;
  • guarded streaming requests rejected with HTTP 422;
  • Prometheus metrics emitted across AI Firewall, Privacy Guard, and Security Guard;
  • no unexpected HTTP failures during the simulation.

Notes​

VCAL Security Guard and VCAL Privacy Guard are optional commercial add-ons. AI Cost Firewall remains usable as a standalone open-source caching and cost-control gateway.

The current guard modules inspect text content. Non-text content such as images, audio, video, and binary payloads is preserved where possible but is not scanned, anonymized, or classified by AI Firewall guard modules.