Safety & Oversight Overview

Seclai provides four distinct layers that protect your AI pipelines from different categories of risk. The first three are automated guards — fast, scalable, always on or always cheap. The fourth is human oversight, used selectively for the cases automation can't (or shouldn't) decide on its own: irreversible actions, low-confidence outputs, and change-management gates that demand a real signature.

Together they form a defense-in-depth posture: automation catches the high-volume / well-defined risks; humans handle the judgment calls.

Four Layers of Protection

Prompt Scanning — Blocks prompt injection and jailbreaking attacks before content reaches any LLM.
Governance Policies — Screens content against your safety, privacy, and compliance rules, flagging or blocking violations.
Agent Evaluations — Validates that agent outputs meet your quality criteria, with optional auto-retry.
Human-in-the-Loop — Pauses the run for a human approval, denial, or labeled decision when automation isn't enough.

These layers are complementary. Prompt scanning prevents malicious inputs from entering the system. Governance ensures content complies with your policies. Agent evaluations confirm the output is useful and correct. Human-in-the-loop adds an explicit human signature where one is required by policy, by risk, or by the workflow itself (e.g. an irreversible side effect like sending an external email).

Prompt Scanning

Problem it solves: Adversarial users or compromised data sources attempt to hijack your agents via prompt injection or jailbreaking techniques.

How it works: A dedicated ML classifier (not an LLM) analyzes all incoming text at every platform ingress point, and also scans the outputs of steps that fetch data from external sources (Web Fetch, Web Search, Webhook Call, and the cloud-drive read/list steps). Malicious content is blocked instantly — before it is forwarded to any LLM, indexed for retrieval, or returned to users.

Key characteristics:

Always on, no configuration required
Sub-second latency, zero LLM cost
Runs before any other processing
Binary outcome: safe or blocked

→ Full documentation: Prompt Scanner

Governance Policies

Problem it solves: Agent outputs or ingested content may contain harmful, sensitive, or non-compliant material that violates your organization's policies — even when the input was perfectly benign.

How it works: You define natural-language policies describing what content is acceptable. An LLM evaluates content against these policies at configured screening points (agent input, step output, source content). Violations are flagged for review or blocked outright depending on your settings.

Key characteristics:

Configurable policies with natural-language descriptions
LLM-based evaluation (uses credits)
Screens both inputs and outputs
Three verdicts: pass, flag, or block
Configurable blocking mode (sync gate vs async audit)
Scoping hierarchy: account → agent → step → source

→ Full documentation: Governance

Agent Evaluations

Problem it solves: An agent's output may be technically "safe" according to governance policies but still low-quality, off-topic, incomplete, or unhelpful for the user's actual needs.

How it works: You define evaluation criteria that describe what "good output" looks like for specific agent steps. After a step produces output, an LLM scores it against your criteria. Depending on the evaluation mode, failing outputs can trigger automatic retries or be flagged for human review.

Key characteristics:

Custom quality criteria per agent step
Three modes: manual scoring, eval-and-retry, sample-and-flag
Targets specific steps (typically terminal output steps)
Scores on a 0–1 scale with configurable pass thresholds
Optional auto-retry when criteria aren't met

→ Full documentation: Agent Evaluations

Human-in-the-Loop

Problem it solves: Some decisions can't (or shouldn't) be made by an automated layer — irreversible side effects need a real signature, change-management gates need M-of-N sign-offs, low-confidence outputs need a human judgment call, and compliance audits need a recorded human decision alongside the automated one.

How it works: A human_in_the_loop step pauses the agent run, emails one or more recipients a signed deep link, and waits for them to vote with one of the configured choices (default: approve / deny). Once the required number of votes for the same choice arrives — or every recipient has voted, or the timeout fires — the step emits the aggregate decision as its output and the run resumes. Downstream if_else / switch / gate steps route on the chosen outcome.

Key characteristics:

Pauses the run durably (minutes, hours, or days) with zero runtime credit cost while parked
Configurable recipient pool (owner, owner + admins, or hand-picked members)
Custom labeled choices or default approve / deny
M-of-N quorum (first-responder-wins by default)
Optional timeout with emit_timeout or fail_run outcomes; optional reminder cadence
Per-recipient email throttling so high-volume agents don't spam reviewers
Billed per outgoing notification, not per parked second
Full audit ledger: every vote (user, choice, comment, timestamp) and the resolved outcome

A useful composition is conditional HITL: pair an evaluate_step (LLM-as-judge scoring) with an if_else so high-confidence outputs auto-approve and only borderline ones park for a human. Most production runs never touch a person; only the cases automation flagged do.

→ Full documentation: Human-in-the-Loop

Comparison Table

Aspect	Prompt Scanning	Governance Policies	Agent Evaluations	Human-in-the-Loop
Purpose	Block injection attacks	Enforce content compliance	Validate output quality	Capture human judgment / signature
Decider	ML classifier	LLM	LLM-as-judge	Human
What it checks	Inputs and external-source step outputs	Inputs and outputs	Step outputs only	Whatever you ask the recipient (prompt is templated)
When it runs	Before any processing; after external-source steps	At configured screening points	After step execution	When the agent reaches a `human_in_the_loop` step
Configuration	None (always on)	Policy definitions, thresholds, scoping	Criteria descriptions, thresholds, modes	Prompt, recipients, choices, quorum, timeout, reminders
Outcomes	Block or pass	Pass, flag, or block	Pass, fail, retry, or flag	Any configured choice, plus `__timeout__` / `__no_quorum__` / `__cancelled__` sentinels
Latency	Minimal (~200ms)	Depends on tier and blocking mode	Depends on mode (sync or sampled)	Minutes to days — the wait is durable and excluded from runtime metrics
Cost	Zero per check	Per evaluation	Per evaluation	Per outgoing email notification
Scope	Platform-wide	Account → Agent → Step → Source	Per agent, per step	Per `human_in_the_loop` step

How They Work Together

In a typical agent run, the four layers activate in sequence:

Input arrives → Prompt scanner checks for injection attacks. If unsafe, the run is blocked immediately.
Agent executes → Each step processes its input and produces output. Steps that fetch external data (Web Fetch, Web Search, Webhook Call, and the cloud-drive read/list steps) have their outputs automatically scanned for prompt injection before downstream steps can consume them.
Output is screened → Governance policies evaluate step outputs against your compliance rules. Violations are flagged or blocked.
Quality is assessed → Agent evaluations score the output against your quality criteria. Failures may trigger retries.
Human in the loop, if configured → On agents that include a human_in_the_loop step (typically gating an irreversible action or routing low-confidence cases), the run parks, recipients are notified, and the workflow resumes once the configured number of votes arrives.

This layered approach means:

A jailbreak attempt is caught at step 1 (prompt scanner) before any LLM call happens.
A prompt injection hidden in a fetched web page is caught at step 2 (output scanning) before it reaches downstream LLM steps.
A compliant but policy-violating output (e.g., containing PII) is caught at step 3 (governance).
A safe, compliant, but low-quality answer is caught at step 4 (evaluations) — and re-tried automatically if you've enabled it.
A high-stakes side effect (sending the email, publishing the content, calling the webhook) waits for an explicit human approval at step 5 (HITL).

The first four are automated and run on every applicable step. The fifth is selective — only the agents that need a human signature pay the cost of waiting for one.

When to Use What

Prompt Scanning is always active — you don't need to do anything. It protects against adversarial inputs automatically.

Governance Policies are recommended when:

You need to enforce content rules (safety, PII, legal, brand guidelines)
You want to screen source content before it enters knowledge bases
You need an audit trail of policy evaluations
Different agents or sources need different policy sets

Agent Evaluations are recommended when:

You want to validate that outputs meet domain-specific quality standards
You want automatic retries when output quality is poor
You want to monitor production quality via sampling
Your quality criteria go beyond "safe/unsafe" into "helpful/accurate/complete"

Human-in-the-Loop is recommended when:

The agent is about to take an irreversible action (send an external email, publish content, call a webhook, deploy) and a human should sign off first
A change-management policy requires N people to approve before the action proceeds (M-of-N quorum)
Automated evaluations score the output low and you want a human to make the final call rather than auto-retry indefinitely
You need a recorded human decision alongside the automated one for regulatory / compliance traceability
The decision is fundamentally human (a triage label, a brand-voice judgment, a policy exception) and no automated layer can decide it correctly

A common pattern is to chain layers: governance + evaluations handle the volume; HITL handles only the cases the automated layers flag (low score, ambiguous content, or any step deliberately gated for human sign-off). Most production deployments use all four layers, but only a small fraction of runs actually pause for a human.