Guardrails for Claude: PII Redaction and Prompt-Injection Defense

No. Model safety governs the content Claude generates; it doesn’t stop your application from sending PII into the prompt or reliably catch an injection hidden in a retrieved document. Those are data-flow controls you add at the gateway.

Run a PII guardrail on the LLM input (and MCP post-tool) hook in mutate mode to redact sensitive fields before the request reaches the model, or validate mode to block the request outright where a leak must hard-stop.

By scanning the user prompt and the retrieved context separately. Indirect injection hides in documents or tool results your app pulled in, so a detector that only reads the user message misses it; dual scanning catches an attack in either location.

All four — LLM input and output, plus MCP pre-tool and post-tool. For agents the tool hooks are as important as the prompt, because the agent reads files and calls APIs on its own.

Roll out in stages: audit mode to baseline what would be caught, enforce-but-ignore-on-error for protection without a single point of failure, then strict enforce only where required — reviewing decisions in request traces