Guardian is the core of the Aiceberg platform. It is the engine that evaluates your AI traffic, classifying prompts and responses against the signals a profile is configured to detect and acting on or recording what it finds. The monitoring, analysis, and testing surfaces across the platform all work from waht Guardian produces.

What Guardian Does

Guardian inspects the traffic flowing between your AI tool and the LLM it calls. For each prompt and response, it detects the signals defined in the governing profile, such as toxicity, sensitive data, adversarial inputs, intent, and others, and determines what action to take based on the profile's settings. Depending on how the profile is configured, Guardian can block content, modify it, or allow it through, and it records the results of every evaluation.

Because Guardian evaluates traffic as it happens, it can operate in real time when set up to sit in the path of your traffic. The results it produces are what populate the monitoring and analysis views, so the activity you review across the platform reflects what Guardian detected and did.

How Guardian is Configured

A profile defines how Guardian behaves. The profile determines which signals Guardian detects, how it responds when a signal fires, and what actions it takes on inputs and outputs. One profile can govern many use cases, and the same profile can be applied where you need consistent handling of AI traffic.

A profile runs in one of two modes, which determines whether Guardian acts on traffic or only observes it:

• Enforce places Guardian in-line, in the path between your AI tool and the LLM, where it can block or modify content before it reaches its destination.
• Listen places Guardian in parallel, evaluating a copy of the traffic without sitting in its path, so it records what it finds and reports a recommended action without changing the traffic.

For the full explanation of the two modes, see Listen vs Enforce.

Working With Guardian

The platform's other surfaces are built around what Guardian evaluates:

• Monitoring surfaces live and recent activity, letting you review the events Guardian processed and the actions it took.
• Use Case Analysis breaks down the activity of a single deployment so you can understand what is driving its numbers.
• Cannon runs collections of prompts through a profile in bulk, so you can validate how Guardian responds across a defined set of inputs before real traffic flows.
• Trace explains individual classifications, showing what Guardian detected, where in the text it was found, and why it was classified that way.

Together these let you configure how Guardian governs your AI traffic, confirm it behaves the way you expect, and review what it detects and does once it is in place.