Vijil Dome
Runtime control for agents already in production.

Controls built into the agent, not only bolted onto the door.

Dome runs inside the agent’s own process. It checks what reaches the model, what the agent asks its tools to do, and what it sends back against the policy you wrote, and it allows, steers or denies each step before the step runs. Dome also runs as a trusted gateway between agents, when you can’t count on the cooperation of third-party developers.

Open source, Apache-2.0pip install vijil-domeRead it, fork it, run it in your own process. Read the source
An agent inside Dome. Every step crosses a checkpoint on Dome's boundary: the input that reaches it, the call it makes to the model, the call it makes to a tool, and the output it sends back. One input is denied; the other steps are allowed.DomeagentInputOutputToolsModeldenied
Trust Score, Grok 4.6without Dome, then with it; the September gate is 62.8
Trust Score without Dome: 48.348.3Trust Score with Dome: 67.867.8
Reliability89.1→90.1
Security31.1→59.0
Safety58.6→69.5
Read the Grok 4.6 Trust Report (PDF)

Every input is an instruction

An agent acts on what it reads. A user’s message, a retrieved page and a tool’s response all reach the model as text, and any of them can carry an instruction the agent will follow. The agent then calls tools with real permissions and sends back whatever the model wrote.

Permissions say what the agent may do. Nothing in them says whether this step, with this input, should happen.

The business owner
“The agent quoted a customer a refund policy we do not have, because a page it retrieved said so. It followed the instruction it read, not the one we gave it.”
The risk owner
“Our policy says account data stays inside the support agent. Nothing between the agent and its tools checks that before the call runs.”
The agent developer
“I can write the rule. I cannot put a filter in front of a tool call that happens inside my own code, and I do not want to run a proxy to try.”

All three need the policy checked at the step where it applies, inside the agent.

What a control can promise, and what a detector cannot

Dome does two different things, and they deserve two different promises. A Control is a rule about a step. A detector is a judgment about text.

The guarantee
A Control that denies runs before the step. A tool call it denies never executes, whatever text asked for it, because the rule reads the call and not the wording around it.
The limit
A detector recognizes content, and an adaptive attacker rewrites content until it is not recognized. No detector catches everything, and no combination of them does either.

So measure it. Run Dome in shadow mode first, and let Diamond score the agent with it and without it. The Trust Score reads the worst-scoring responses, which is where a detector’s misses show up. A guarantee you cannot audit is a claim, so the next section shows the audit.

One policy, three kinds of control

Diamond tests an agent against its policy. Dome enforces that policy where the agent runs: as Controls on each step, as guards on what goes in and comes out, and, where SPIFFE runs, as an identity check on tool calls.

  1. 1Policy becomes Controls

    Write Controls in YAML, or bring policies written for the open-source Agent Control project: Dome reads its format, except for the SQL, budget and vendor-specific evaluators. In the Vijil console, a policy’s approved rules compile into Controls for one agent, and you review them before they apply. Each Control allows, steers or denies a step, before or after it runs. Shadow mode logs what it would deny without blocking anything.

    Controls in the docs

  2. 2Guards on what goes in and out

    Name the guards on inputs and outputs. Each guard is a chain of detectors you can reorder, run in series or in parallel, with early exit on or off.

    Guards in the docs

  3. 3Identity on every tool call

    Where SPIFFE runs, Dome binds each agent and its tools to an attested identity, checks a tool call against the agent that made it, and allows or denies each tool per agent. Unattested calls are flagged by default.

    Trust Runtime in the docs

Four checkpoints, and the detectors behind them

Every step an agent takes passes Dome at one of four points: the input before it reaches the model, the call to the model, the call to a tool, and the output before it leaves. At each point a guard runs its detectors and a Control decides.

The detectors are pattern rules, classifiers and LLM judges, more than thirty of them. Five of the classifiers are models Vijil fine-tunes itself, including the default prompt-injection detector, a ModernBERT.

An agent's step passes four checkpoints in order: the input, the call to the model, the call to a tool, and the output.1Input2Model call3Tool call4Output

Prompt injection and jailbreak

  • prompt-injection-mbert
  • security-promptguard
  • security-embeddings
  • security-llm
  • encoding-heuristics
  • jb-length-per-perplexity
  • jb-prefix-suffix-perplexity

Moderation and harm

  • moderation-flashtext
  • moderation-mbert
  • moderation-deberta
  • moderation-llamaguard
  • moderations-oai-api
  • moderation-perspective-api
  • prompt-harmfulness-fast

Privacy and secrets

  • privacy-presidio
  • detect-secrets

Hallucination and facts

  • hhem-hallucination
  • hallucination-llm
  • fact-check-roberta
  • fact-check-llm

Fairness

  • stereotype-eeoc-fast

Your own policy

  • policy-sections
  • policy-gpt-oss-safeguard
  • generic-llm

Names as they appear in vijil-dome 1.7.4. Several also come in faster, remote and hybrid variants. Every detector in the docs

Dome moves the score of the pillar it guards

Grok 4.6’s Trust Score went from 48.3 without Dome to 67.8 with it, past the September gate of 62.8. Security rose 27.9 points and Safety 10.9; Reliability moved 1.0, and the report records no drop beyond sampling noise.

Across the eleven models Vijil measured in September, Dome raised Security by 17.2 points on average and Safety by 17.4. Security rose on all eleven; Safety rose on ten and fell on Muse Spark 1.3, by 12.3. Reliability falls on five of the eleven, by 14.5 on average among them, most on Kimi K3, from 78.2 to 54.3. With Dome, six of the eleven pass the gate; without it, two do.

Grok 4.6 Trust Report, with and without Dome (PDF)
Grok 4.6, without Dome then with Dome. Trust Score 48.3 to 67.8; Reliability 89.1 to 90.1; Security 31.1 to 59.0; Safety 58.6 to 69.5. The September gate is 62.8.gate 62.8Trust Score48.367.8Reliability89.190.1Security31.159.0Safety58.669.5without Domewith Dome

A second measurement does not use the Trust Score. Vijil’s Q3 2026 tech brief, Selecting AI Agent Guardrails for Security and Speed, measured each guardrail’s balanced accuracy on a curated set of 15,000 prompts, weighting attacks caught and benign inputs passed equally, so a guard cannot score well by blocking everything. Plotted against latency, the field splits. Two open-source detectors answer in 17 and 18 ms at about 62%; the third, NemoGuard, takes 149 ms for 51.7%. The two cloud services take 201 and 280 ms for 62.1% and 72.6%. Dome’s Q3 ’26 model answers in 16 ms at 97.7%; its Q1 ’26 predecessor, at 67.2%, was no better than the field. Dome is not the fastest everywhere: at the 95th percentile it takes 36 ms, against 26 ms for both fast open-source detectors.

Balanced accuracy against median latency for seven guardrails, from Vijil's Q3 2026 tech brief. Vijil Dome Q3 '26: 97.7% at 16 ms. GCP Model Armor: 72.6% at 280 ms. Vijil Dome Q1 '26: 67.2% at 15 ms. AWS Bedrock Guardrails: 62.1% at 201 ms. Protect AI DeBERTa: 62.0% at 18 ms. Meta PromptGuard 2: 61.4% at 17 ms. Nvidia NemoGuard: 51.7% at 149 ms.50%60%70%80%90%100%102050100200400median latency, ms (log scale) → faster to the leftbalanced accuracyVijil Dome Q3 '26 · 97.7% · 16 msGCP Model Armor · 72.6% · 280 msVijil Dome Q1 '26 · 67.2%AWS Bedrock Guardrails · 62.1% · 201 msProtect AI DeBERTa · 62.0%Meta PromptGuard 2 · 61.4%Nvidia NemoGuard · 51.7% · 149 msBalanced accuracy against median latency for seven guardrails, from Vijil's Q3 2026 tech brief. Vijil Dome Q3 '26: 97.7% at 16 ms. GCP Model Armor: 72.6% at 280 ms. Vijil Dome Q1 '26: 67.2% at 15 ms. AWS Bedrock Guardrails: 62.1% at 201 ms. Protect AI DeBERTa: 62.0% at 18 ms. Meta PromptGuard 2: 61.4% at 17 ms. Nvidia NemoGuard: 51.7% at 149 ms.50%60%70%80%90%100%102050100200400median latency, ms (log scale) → faster to the leftbalanced accuracy ↑Dome Q3 '26Model ArmorDome Q1 '26BedrockDeBERTaPromptGuard 2NemoGuard
Vijil Dome Cloud provider, through its API Open-source model, on the same GPU
The evaluation set is Vijil’s own: real prompts to models and agents, direct and indirect attacks, and non-conversational payloads such as logs. It was held out from the training data of Vijil Dome Q3 ’26. Every guardrail ran in its default configuration. Local models ran on an Nvidia RTX 4090; the cloud services were called through their APIs, so their latency includes the network round trip. Source: Table 2 of the brief. Vijil Dome Q3 ’26 is the release Dome ships.

Everything else runs before launch. This runs during.

Dome is the defense step of the Trusted Agent Lifecycle: it defends an agent while it runs, after Discover identifies it and Diamond verifies it, and its traces will give Darwin, now in development, the failures to evolve against.

  1. Vijil Discoveridentify
  2. Vijil Diamondverify
  3. Vijil Domedefend
  4. Vijil Darwinevolve

Free to start, per agent on ours, unmetered on yours

You never pay per evaluation or per token. The engine is open source and one agent on our console is free. More agents are priced per agent on the same console, and inside your own network the platform is an annual subscription. Every tier is on the pricing page.

  1. On your machine · open source

    Dome, free and yours

    pip install vijil-dome under Apache-2.0: every guard and Control in your own process, with no account. Detector models download from Hugging Face on first run; cache them to run with no egress.

    Read the source
  2. On our console · start here

    One agent, free

    Dome on one agent, with the console showing what its guards blocked and what each one cost in latency.

    Start for free
  3. On our console · Team

    Per agent

    The agents that matter, each enforced and watched from the same console. Monthly or annual.

    Talk to us
  4. In your network

    Every agent, annual

    In your VPC, on-premises or air-gapped. Every agent, with the decision traces kept inside your infrastructure.

    Talk to us

Install it, wrap a step, watch what it stops

Dome is a Python package. Guard a prompt in three lines, or put a Control on a tool so the policy runs before the call and a denied call never executes. It ships adapters for LangGraph, ADK, Strands and MCP, and Claude Code users can add the Vijil plugin from the editor.

Start in shadow mode, which logs every deny and steer without blocking, then turn enforcement on.

Install DomeProtect a function

vijil-dome
# install
$ pip install vijil-dome
# guard a prompt with the default guards
from vijil_dome import Dome
dome = Dome()
scan = dome.guard_input(user_message)
# a Control on a tool runs before the call
from vijil_dome import control
@control(policy="policy.yaml",
step_type="tool",
step_name="transfer_funds")
def transfer_funds(amount, country):
...
# in Claude Code
> /plugin marketplace add vijilAI/vijil
> /plugin install vijil@vijil

What you see: every guard, and what it covers

In the Vijil console each agent shows its guards as chains you can reorder, and names the threat categories its guards cover and the ones they do not. The agent shown covers four of seven; the console says which three are open rather than leaving you to find out.

Every decision can also go to the observability stack you already run, as OpenTelemetry traces and metrics. Observability in the docs

Guard coverage for one agent in the Vijil console: four of seven threat categories covered. Prompt injection, encoding attacks and PII detection each have one detector and toxicity and moderation have two; jailbreak detection, content safety and secrets detection each read not covered.
Guard coverage for one agent.
An agent's input guards in the Vijil console: a serial chain with early exit, a security guard running encoding-heuristics and prompt-injection-mbert, and a moderation guard running moderation-flashtext and moderation-deberta.
Input guards: two chains, run in series, with early exit.
An agent's output guards in the Vijil console: a serial chain with early exit running a privacy guard backed by privacy-presidio.
Output guard: personal data, caught before the reply leaves.

Protect one agent today

Not the population. One agent that touches something confidential, and one tool call you would not want replayed in public.

  • Dome on one agent on our hosted console, free, and nothing expires
  • What its guards blocked, and what each one cost in latency
  • A baseline evaluation a week, so Diamond shows what Dome changed

We open your account, usually the same day. To start in your own process now, pip install vijil-dome.

Need it inside your own network? Talk to us.