Introduction
The mass adoption of AI agents and LLMs in corporate environments has opened an attack vector that many organizations underestimate: the communication channel between users and models itself. Prompt injection, jailbreaks, data exfiltration through responses, tool abuse, memory poisoning... the attack surface grows exponentially with every agent we deploy.
Bulwark Gateway is an open-source security proxy that sits between users/applications and LLM backends (OpenAI, Ollama, vLLM, Azure OpenAI, etc.), applying real-time defense in depth to every request. Its core principle: fail-closed — if anything fails, cannot be verified, or produces an uncontrolled error, the request is blocked. Trust is never assumed.
This is the English version of the article. Bulwark Gateway has evolved from a "6-layer" proxy into a security platform for AI agents: alongside the regex hot path there is now an extensible scanner framework (ML, multilingual, multimodal, output validation, RAG), a semantic enrichment pipeline, a library-mode SDK, a sandboxed plugin hub, a red teaming framework, agent/Shadow AI discovery and GDPR compliance. All environment variables now use the
BULWARK_prefix.
What sets Bulwark Gateway apart from other proxies:
- Pure regex hot path: zero LLM calls during request processing, zero inference latency on the critical path. Target overhead p95 < 40 ms.
- Fail-closed by default: any error, timeout or uncertainty results in a block, never a bypass.
- Multi-tenant and multi-backend: one gateway protecting many teams and many model providers.
Architecture at a glance
Every request crosses several security layers before reaching the model: authentication (JWT / API key), input guardrail (prompt injection, jailbreak, encoding evasion), IOC checks against threat-intel feeds, per-tenant tool RBAC policy, output filtering (secret/PII redaction and indirect injection), and Redis-based rate limiting.
The gateway ships with a full web Admin Portal, exports to multiple SIEM platforms (Wazuh, Splunk, Elastic, QRadar, Datadog...), notifies several channels (Slack, Teams, Discord, PagerDuty, Telegram...), and supports hot-reload of policies, IOCs and the agent registry without restarts.
Quick start
Generate the secrets, bring up the development environment and check the proxy:
./secrets/init.sh
docker compose up -d
curl http://localhost:8080/healthFor Kubernetes, the project provides complete manifests (NetworkPolicies, HPA, PDB, Pod Security) and a Helm chart under helm/bulwark-gateway.
Conclusion
Bulwark Gateway turns the user↔LLM channel into an enforceable control point without adding another model's latency on the critical path. If you expose AI agents with tool access, treating the user as a potential adversary is not paranoia — it is the baseline. Fail-closed, observable and cloud-native from day one.
Comments