Hipocap

Hipocap checks a function call before it executes, so threats are stopped rather than logged after the damage. The shield runs three stages: a fast prompt guard for obvious patterns, an LLM analysis pass for structured threats, and a quarantine stage that simulates what a suspicious document would do if an agent processed it. That third stage targets indirect injections hidden inside emails or web pages, which are the hardest to catch.

Access control here works at the level of individual functions, not the whole app. You map roles to allowed tool calls, so an admin can send and delete email while a guest can only read. The check runs in the shield's RBAC engine before the function body executes, which means an unauthorized call never reaches your code. It's the difference between a permission that's only logged and one that's actually enforced.

Shields are prompt-based rules for blocking direct prompt injection. You describe in plain language what the shield should watch for, what to block and what to allow, and give it a key your code references. That makes it possible to target specific cases, like a jailbreak attempt or a system prompt leak, without writing detection logic yourself. Each shield is created in the dashboard and called from your app.

Some risks come from the order of calls, not any single one. Hipocap lets you restrict which functions may run together, blocking sequences such as read email followed by send email that would quietly forward data out. Chaining rules sit alongside the role checks, so a chain is evaluated as a whole before the agent proceeds. According to Hipocap, this catches unauthorized workflows that pass every individual permission.

The observability layer traces agent runs and works with common stacks. It auto-instruments OpenAI, Anthropic, LangChain and others, stores traces you can query with SQL, and ties security decisions to the same trace as the call. You can filter, search and build custom dashboards on top of the data. The tracing core comes from Laminar, so much of the tooling and structure will feel familiar to teams already using that platform.

The platform can redact sensitive values in logs so engineers can debug without reading customer secrets. Because the security layer and the observability layer share one path, masking applies to what gets recorded, not just what gets shown. That keeps personal data out of trace storage, which matters for teams under privacy rules. It runs as a mode you turn on rather than something you code per project.