Skip to content
Arcjet Docs

AI data loss prevention for Microsoft Agent Framework

Users paste sensitive data into AI prompts – card numbers, phone numbers, home addresses, and whole résumés – often without realizing the risk. Once that data reaches your AI provider it can end up in logs, training pipelines, or model outputs, well outside your control.

Arcjet sensitive info detection scans prompt content inside your application, before it reaches the AI provider. Detection runs locally in your own environment, so the raw text never leaves your app: only the decision – whether sensitive data was found – is reported to Arcjet. When something is detected you choose what happens next: block the request, strip the data, or warn the user.

Get started

Section titled “Get started”
main.go
package main


import (
  "context"


  "github.com/arcjet/arcjet-go"
  "github.com/arcjet/arcjet-go/agentframework"
  "github.com/microsoft/agent-framework-go/tool"
  "github.com/microsoft/agent-framework-go/tool/functool"
)


type noteArgs struct {
  OrderID string `json:"order_id"`
  Note    string `json:"note"`
}


func saveNote(_ context.Context, in noteArgs) (map[string]string, error) {
  return map[string]string{"order_id": in.OrderID, "note": in.Note}, nil
}


func guardedSaveNote(guard *arcjet.GuardClient) (tool.FuncTool, error) {
  detectPII := must(arcjet.GuardSensitiveInfo(arcjet.GuardSensitiveInfoOptions{
    Mode: arcjet.ModeLive,
    Deny: []arcjet.EntityType{
      arcjet.SensitiveInfoEmail,
      arcjet.SensitiveInfoPhoneNumber,
      arcjet.SensitiveInfoIPAddress,
      arcjet.SensitiveInfoCreditCardNumber,
    },
  }))
  fn := functool.MustNew(
    functool.Config{Name: "save_note", Description: "Save a free-text note on an order"},
    saveNote,
  )
  return agentframework.GuardTool(guard, fn, agentframework.ToolPolicy{
    Action: "note.saved",
    Rules: agentframework.Args(func(_ context.Context, in noteArgs) ([]arcjet.GuardRuleInput, error) {
      return []arcjet.GuardRuleInput{detectPII.Text(in.Note)}, nil
    }),
  })
}


func must[T any](v T, err error) T {
  if err != nil {
    panic(err)
  }
  return v
}

How detection works

Section titled “How detection works”

Sensitive info detection runs through a detection backend – the engine that scans the text and identifies entities. There are two:

  • Built-in engine (default). A WebAssembly engine bundled with the SDK. It detects four structured types – card numbers, email addresses, phone numbers, and IP addresses – runs anywhere the SDK runs (including edge runtimes), and needs no extra dependencies.
  • Rampart backend (optional). An on-device named-entity-recognition (NER) model that adds the free-form PII people actually paste into prompts – names, street addresses, and government or financial identifiers. This is often the more valuable engine for AI data loss prevention, because that is exactly the data a structured-pattern matcher can’t catch.

Both engines run entirely on your own infrastructure. Nothing is sent to a third party for analysis, which is what makes this safe to put in front of an AI provider in the first place.

Configure detection

Section titled “Configure detection”

Choose which PII to block

Section titled “Choose which PII to block”

Use deny to list the entity types to block, or allow to block everything except the types you list (the two are mutually exclusive). Tune the list to your app – for a support bot that legitimately collects phone numbers, leave PHONE_NUMBER out of deny:

arcjet.GuardSensitiveInfo(arcjet.GuardSensitiveInfoOptions{
  Mode: arcjet.ModeLive, // Blocks the tool. Use ModeDryRun to log only.
  Deny: []arcjet.EntityType{
    arcjet.SensitiveInfoCreditCardNumber,
    arcjet.SensitiveInfoEmail,
  },
})

The built-in engine detects CREDIT_CARD_NUMBER, PHONE_NUMBER, EMAIL, and IP_ADDRESS. See the entity detection table for every type each backend supports, and for defining your own custom detectors.

Detect names, addresses, and IDs

Section titled “Detect names, addresses, and IDs”

The built-in types cover structured data. For names, addresses, and government or financial identifiers, create a Rampart backend once and pass it as Backend on GuardSensitiveInfo. Listing GIVEN_NAME or SURNAME without a backend is a configuration error.

Terminal window
go get github.com/arcjet/arcjet-go/sensitiveinfo/rampart
backend, err := rampart.New(rampart.Options{})
if err != nil {
  log.Fatal(err)
}
detectPII, err := arcjet.GuardSensitiveInfo(arcjet.GuardSensitiveInfoOptions{
  Mode: arcjet.ModeLive,
  Deny: []arcjet.EntityType{
    arcjet.SensitiveInfoEmail,
    arcjet.SensitiveInfoGivenName,
    arcjet.SensitiveInfoSurname,
  },
  Backend: backend,
})

Choose what text to scan

Section titled “Choose what text to scan”

Pass the text to scan as sensitiveInfoValue (JS) / sensitive_info_value (Python) / WithSensitiveInfoValue (Go). For a chat endpoint this is usually the user’s most recent message. Pass the full conversation history instead if you want to scan every message, not only the most recent one – PII can appear earlier in the exchange.

Test before you block

Section titled “Test before you block”

Set mode to "DRY_RUN" (JS) / Mode.DRY_RUN (Python) / ModeDryRun (Go) to log detections without blocking any requests. Run this in production for a while to audit what PII actually shows up in your prompts, then switch to live mode once you’re confident in the entity list.

Combine with other protections

Section titled “Combine with other protections”

Sensitive info detection controls what data reaches your AI provider. Pair it with the other AI protection layers for full coverage:

Learn more

Section titled “Learn more”