AGT — prompt-injection detector

The AGT provider wraps the platform's baseline prompt-injection detector (Microsoft agent-governance-toolkit). It runs in process — no services to deploy, no network hop, sub-millisecond evaluation — and is the only provider that works out of the box on every instance.

The migration seeds one row, prompt-guard-agt, serving pre_call in enforce mode. Deleting it re-enables the built-in fallback screen; setting Default On = Off on an existing row disables the detector entirely — absence of a row is not an admin decision, but a disabled row is.

Configuration

{
  "allowed_categories": ["direct_override", "encoding"]
}

Blocks vs observations

The detector's strength on a turn decides the verdict: a single self-sufficient signal (an unambiguous override, a blocklist hit) is block-capable, while softer multi-signal findings are recorded as observations. On top of that, the legacy Admin → System → Security mode still applies: in audit mode the AGT row logs findings but cannot block regardless of its Enforce switch; only in enforce mode can an enforcing row actually refuse a turn.