Skip to main content
Every other guard in the BeyondGuard stack focuses on what goes into your model — but what comes out matters just as much. Output Guard is the last line of defense before a model response reaches your end users. It inspects every generated response in real time, evaluating it for sensitive data, harmful content, intellectual property violations, dangerous code, and brand integrity issues. A response that passes all upstream controls can still cause harm if the model inadvertently — or deliberately, under adversarial influence — produces output it should not. Output Guard ensures that even in those cases, nothing damaging is delivered.

​
What Output Guard Detects

Output Guard evaluates model responses across five threat categories.
  • Data Leakage / PII: Sensitive personal or business data included in a model response — names, email addresses, phone numbers, financial identifiers, healthcare data, or internal business information — that should not be surfaced to the requesting user or logged in plaintext.
  • IP Violation: Model outputs that reproduce copyrighted text, trademarked content, or licensed code verbatim, exposing your organization to intellectual property liability.
  • Toxic and Harmful Output: Offensive, harassing, discriminatory, or otherwise harmful content — including content that is harmful in the specific context of your application even if it would not be universally classified as toxic.
  • Dangerous Code: Generated code that contains malicious behavior (backdoors, data exfiltration, destructive operations) or serious security vulnerabilities (SQL injection, command injection, hardcoded credentials) that would put users or systems at risk if executed.
  • Brand Integrity: Responses that contradict your brand guidelines, make unauthorized claims about your products or services, misrepresent your organization’s positions, or otherwise violate your defined business rules for model behavior.

​
How Output Guard Works

Output Guard intercepts model responses after generation and before delivery, running them through a post-generation inspection pipeline.
1

Response Capture

After your model generates a response, Output Guard captures it before it is returned to the user or consumed by the next step in your pipeline. For streaming responses, Output Guard buffers the stream and evaluates the complete response prior to final delivery.
2

Multi-Category Evaluation

The response is evaluated across all enabled threat categories simultaneously. PII detection uses entity recognition and pattern matching. IP violation detection compares response content against reference fingerprints. Toxicity evaluation uses content classifiers tuned to your configured policy. Code analysis uses static analysis to identify dangerous patterns. Brand integrity checks compare the response against your registered brand rules.
3

Enforcement Action

Based on evaluation results and your configured thresholds, Output Guard takes the appropriate enforcement action: deliver (no issues detected), redact (mask identified sensitive content and deliver the modified response), or block (reject the entire response and return a safe fallback). See the next section for guidance on choosing between redaction and blocking.
4

Audit Logging

Every evaluated response — whether delivered, redacted, or blocked — is recorded in the BeyondGuard audit log with its evaluation scores, matched patterns, enforcement action, and (for redacted responses) the original and modified versions. This log supports compliance reporting and incident investigation.

​
Configuring Output Guard

Enable and configure Output Guard from the BeyondGuard Control Plane.
1

Open Your Project

Navigate to the Control Plane and select the project you want to protect.
2

Open the Guards Tab

Inside your project, select the Guards tab from the left navigation panel.
3

Enable Output Guard

Locate Output Guard in the guard list and toggle it to Enabled.
4

Configure PII Detection

Under PII Settings, select the PII categories you want Output Guard to detect and act on. Categories include personal identifiers (name, email, phone, address), financial data (account numbers, card numbers), healthcare identifiers, and custom patterns you define via regex or named entity rules.
5

Set Content Policy Thresholds

Under Content Policy, configure the sensitivity thresholds for toxicity, IP violation, and brand integrity checks. Each category can be tuned independently. Review the Observation Mode detections from your application before finalizing thresholds for Enforcement Mode.
6

Configure Code Analysis

Under Code Analysis, enable dangerous code detection and select the vulnerability categories you want flagged: malicious behavior, injection vulnerabilities, hardcoded secrets, and insecure patterns. You can scope code analysis to specific programming languages if your application generates code in a known set of languages.
7

Register Brand Rules

Under Brand Integrity, enter the business rules, prohibited claims, and brand guidelines that model responses must comply with. Rules can be entered as natural-language statements or as structured policy documents.
8

Choose Enforcement Actions per Category

For each threat category, configure whether violations should trigger Redaction or Blocking (see the next section). You can set different enforcement actions for different categories and different severity levels.
9

Save and Deploy

Click Save Configuration. Output Guard begins inspecting all model responses on this project immediately.

​
Operating Modes

Output Guard supports two operating modes. You can switch between them at any time from the Control Plane without downtime.
Start in Observation Mode to understand the baseline violation rate for your application. Review the logged detections before configuring enforcement actions — some categories such as brand integrity are highly application-specific and require careful threshold tuning before enforcement to avoid blocking legitimate responses.

​
Redaction vs. Blocking

When Output Guard detects a policy violation, it can respond in one of two ways. Choosing the right enforcement action for each threat category balances security with user experience.
Redaction masks the violating content within the response while preserving the rest of the model’s output. The user receives a modified but still useful response.How it works: Identified sensitive content — a PII value, a flagged phrase — is replaced with a token such as [REDACTED], [PII REMOVED], or a custom placeholder you configure. The rest of the response is delivered unchanged.Best for:
  • PII and sensitive data: the user’s question can still be answered without exposing the specific sensitive value
  • Minor brand integrity issues: a response that is mostly correct but contains a single non-compliant claim can be corrected rather than discarded
Example: A response that includes a customer’s email address retrieved from context is delivered with the email replaced by [REDACTED] — the user still receives a complete, coherent answer.
Use Redaction for PII so your users still receive a complete, useful response — masking a phone number or email address does not reduce the value of most answers. Use Blocking for toxic content and dangerous code, where delivering even a portion of the flagged response creates unacceptable risk. When in doubt, review your Observation Mode logs to understand the nature of the violations your application produces before committing to an enforcement strategy.