Check Point's AI Agent Security

Overview

Bifrost Enterprise supports Check Point’s AI Agent Security as a third-party guardrail provider for screening LLM conversations. Check Point owns the project policy and detector decision. Bifrost owns when the policy runs and what happens next: it can block the interaction, record the detection without intervening, or redact supported matches before content continues through the gateway. Bifrost calls Check Point’s POST /v2/guard endpoint with an OpenAI Chat Completions-style messages array. Chat Completions already use this shape; Bifrost normalizes Responses API and ordinary Anthropic Messages text into the same message format before screening.

Streaming output: For output and both rules, Bifrost holds the response until the stream is complete, screens the complete output once, and then blocks, redacts, or releases it. Check Point does not inspect individual response chunks in this integration.

Prerequisites

Bifrost Enterprise with guardrails enabled
A Check Point API key
A Check Point project with a policy assigned to it
Bifrost must be able to connect to the Check Point API over HTTPS. If your deployment restricts outbound connections, allow the configured Check Point API host.

Set Up Check Point’s AI Agent Security

Sign in to the Check Point AI Guardrails Dashboard.
Open Policies and create or select the policy you want Bifrost to enforce.
Configure the policy’s detectors and sensitivity.
Open Projects, create or select a project, and assign the policy to it.
Copy the project ID. Bifrost sends this value as project_id on every screening request.
Open API Access and create an API key for Bifrost.

Check Point policies page showing policies, detector coverage, sensitivity, and assigned projects

Use a separate Check Point project for each application and environment. The project selects the assigned policy, so sharing one project can unintentionally couple policy changes across workloads.

Check Point’s default policy is intentionally strict. Review its enabled detectors and sensitivity before attaching it to production traffic.

How It Works

Create a provider configuration for Check Point’s AI Agent Security in Bifrost.
Attach the configuration to a guardrail rule.
Set the rule to run on input, output, or both.
When the rule matches, Bifrost converts the retained conversation into Check Point’s OpenAI-style messages format.
Bifrost sends the messages, Check Point project ID, breakdown request, and Bifrost request metadata to POST /v2/guard.
Check Point evaluates the latest interaction using the earlier messages as context and returns a flagged decision.
Bifrost applies the provider’s configured action.
Bifrost records detector summaries and Check Point’s request UUID in guardrail diagnostics when available.

When action is redact, Bifrost also sends payload: true so Check Point can return supported finding locations:

{
  "messages": [
    {
      "role": "system",
      "content": "You are a support assistant."
    },
    {
      "role": "user",
      "content": "Email me at [email protected]"
    }
  ],
  "project_id": "project-1234567890",
  "payload": true,
  "breakdown": true,
  "metadata": {
    "bifrost_source": "input",
    "bifrost_provider": "openai",
    "bifrost_model": "gpt-5.4"
  }
}

Both runtime screening and Verify use POST /v2/guard. Verification checks that Bifrost can make a normal screening request with the configured credentials and project, so it can appear in Check Point request logs. There is no separate no-event health-check call.

Configuration Fields

Field	Type	Required	Default	Description
`api_key`	string	Yes	-	Check Point API key. Supports `env.LAKERA_GUARD_API_KEY`.
`project_id`	string	Yes	-	Check Point project ID. The policy assigned to this project controls screening behavior.
`base_url`	string	No	`https://api.lakera.ai`	Check Point API base. Use a regional or enterprise base when required. Bifrost accepts the API root, `/v2`, or the full `/v2/guard` endpoint and normalizes it.
`action`	enum	No	`block`	`block`, `detect_only`, or `redact`.
`redaction_strategy`	enum	No	`replace`	Replacement strategy for non-reversible runtime redaction: `replace`, `mask`, or `hash`.
`redaction_mode`	enum	No	`runtime`	`runtime`, `logs_only`, or `runtime_reversible`. See Redaction Modes.
`timeout`	integer	No	`30`	Provider execution timeout in seconds.

Configure Bifrost

Web UI
API
config.json
Helm

Check Point's AI Agent Security configuration in Bifrost showing required credentials and redaction controls

Go to Guardrails > Providers.
Select Check Point’s AI Agent Security and click Add Configuration.
Enter a descriptive Name.
Enter the required API Key and Project ID.
Choose the Bifrost enforcement Action.
For redact, choose the Redaction mode and Redaction strategy.
Leave Base URL blank to use https://api.lakera.ai, or enter your Check Point regional or enterprise API base.
Set the timeout, enable the configuration, and click Verify.
Save the configuration and attach it to a rule under Guardrails > Configuration.

Create the provider configuration with the Bifrost management API:

curl -X POST http://localhost:8080/api/guardrails/lakera \
  -H "Content-Type: application/json" \
  -d '{
    "name": "ai-agent-security-production",
    "enabled": true,
    "config": {
      "api_key": "env.LAKERA_GUARD_API_KEY",
      "project_id": "project-1234567890",
      "action": "block",
      "base_url": "https://api.lakera.ai",
      "timeout": 30
    }
  }'

Fetch the generated configuration ID:

curl -X GET http://localhost:8080/api/guardrails/lakera \
  -H "Content-Type: application/json"

Attach it to a rule by referencing lakera:<id> in selectedGuardrailProfiles:

curl -X POST http://localhost:8080/api/guardrails/rules \
  -H "Content-Type: application/json" \
  -d '{
    "name": "ai-agent-security-all-model-input",
    "description": "Screen all prompts with Check Point's AI Agent Security",
    "enabled": true,
    "celExpression": "true",
    "applyTo": "input",
    "samplingRate": 100,
    "timeout": 60,
    "selectedGuardrailProfiles": ["lakera:25"]
  }'

{
  "guardrails_config": {
    "guardrail_providers": [
      {
        "id": 25,
        "provider_name": "lakera",
        "policy_name": "ai-agent-security-production",
        "enabled": true,
        "timeout": 30,
        "config": {
          "api_key": "env.LAKERA_GUARD_API_KEY",
          "project_id": "project-1234567890",
          "base_url": "https://api.lakera.ai",
          "action": "block"
        }
      }
    ],
    "guardrail_rules": [
      {
        "id": 251,
        "name": "ai-agent-security-all-model-input",
        "description": "Screen all prompts with Check Point's AI Agent Security",
        "enabled": true,
        "cel_expression": "true",
        "apply_to": "input",
        "sampling_rate": 100,
        "timeout": 60,
        "provider_config_ids": [25]
      }
    ]
  }
}

bifrost:
  guardrails:
    providers:
      - id: 25
        provider_name: "lakera"
        policy_name: "ai-agent-security-production"
        enabled: true
        timeout: 30
        config:
          api_key: "env.LAKERA_GUARD_API_KEY"
          project_id: "project-1234567890"
          base_url: "https://api.lakera.ai"
          action: "block"

    rules:
      - id: 251
        name: "ai-agent-security-all-model-input"
        description: "Screen all prompts with Check Point's AI Agent Security"
        enabled: true
        cel_expression: "true"
        apply_to: "input"
        sampling_rate: 100
        timeout: 60
        provider_config_ids: [25]

Actions And Outcomes

Bifrost action	Check Point result	Bifrost behavior
`block`	`flagged: false`	Allows the original content unchanged.
`block`	`flagged: true`	Returns HTTP `400` with `GUARDRAIL_INTERVENED`.
`detect_only`	Either decision	Allows traffic and records Check Point’s decision and detector diagnostics.
`redact`	`flagged: true` with valid maskable payload spans	Applies the configured Bifrost redaction strategy and mode.
`redact`	`flagged: true` without safely mappable payload spans	Fails closed with `GUARDRAIL_INTERVENED`.
Any action	Timeout, non-2xx response, missing decision, or malformed response	Treats the provider call as failed. The rule’s failure behavior determines whether traffic continues.

For a blocked request, Bifrost includes the detector summary when Check Point returns one. In LLM Logs, the request is marked Error and shows a message such as Blocked by Check Point's AI Agent Security: Prompt attack detected (confidence: very likely).

{
  "type": "guardrail_intervention",
  "status_code": 400,
  "error": {
    "type": "guardrail_intervention",
    "message": "Blocked by Check Point's AI Agent Security: Pii email detected (confidence: confident)"
  }
}

Redaction Behavior

Check Point does not return a complete transformed prompt or response. For supported detectors, it returns finding locations in the optional payload. Bifrost maps those spans back to the original message text and performs the rewrite using the selected redaction strategy and mode. Check Point documents payload locations for PII, profanity, and custom detector regular-expression matches. Other flagged detectors, such as prompt attack, can produce a policy decision without a maskable payload. In redact mode, Bifrost blocks those findings because allowing the original unsafe content would defeat the rule. Bifrost also fails closed if a returned span is missing, malformed, crosses text boundaries, or cannot be mapped safely. This preserves existing block behavior for findings that cannot be transformed correctly.

Check Point’s masking of PII in the Check Point dashboard is separate from Bifrost redaction. Dashboard masking controls how request details are displayed or stored in Check Point; it does not provide transformed content for Bifrost to forward.

For Chat Completions and Text Completions with multiple output choices, Bifrost screens each choice independently. A blocking or unmaskable violation in any choice blocks the complete response. Maskable findings stay aligned with the choice that produced them.

Request Compatibility

Bifrost request surface	Supported	Behavior
Chat Completions	Yes	Sends the retained OpenAI-style message history directly.
Responses API	Yes	Normalizes ordinary text and standard function calls into Check Point’s message format.
Anthropic Messages	Yes	Normalizes ordinary message text and standard client tool use/result content into Check Point’s message format.
Streaming requests	Yes	Screens input before the LLM call; screens output after the complete stream is buffered.
Direct MCP or A2A traffic	No	These proxy surfaces are not converted into Check Point guard requests.

The earlier retained messages provide conversation context; Check Point evaluates the latest interaction rather than independently reclassifying every old turn. Set a rule’s send_all_conversation_turns to false, then use max_turns_to_send to include the current input plus a chosen number of preceding turns. For output rules, Bifrost sends the retained request conversation together with the selected model output. Earlier history is context only and is not rewritten during the output pass.

Streaming Behavior

Input screening happens before Bifrost calls the model, including when the client requested streaming output. For output screening, the Check Point provider requires the complete normalized conversation. Bifrost therefore buffers the full model response, calls Check Point once, and then:

returns a guardrail intervention if Check Point blocks it;
releases the transformed response if Bifrost can redact all findings; or
releases the original response when the policy allows it.

This adds end-of-stream guardrail latency and means the client does not receive incremental chunks before the Check Point decision. See Streaming Output Guardrails.

Observability

When available, Bifrost records Check Point diagnostics such as:

flagged
detected count and detector types
policy IDs
Check Point request_uuid
number of Check Point screening requests, including per-choice output checks

Assessment summaries do not include the original matched text. Use Check Point’s request UUID to correlate Bifrost diagnostics with Check Point logs.

Troubleshooting

Symptom	What to check
`401` or `403` from Check Point	Confirm the API key is current and available to the Bifrost process.
Verification fails	Confirm both required fields, network access, API base, and that the project exists and is accessible to the API key. Verification makes a normal `/v2/guard` request.
Unexpected detections	Review the policy assigned to the configured project, detector sensitivity, and the retained conversation history.
`redact` blocks instead of rewriting	Check whether the flagged detector returns payload spans. Prompt attacks and other non-maskable findings intentionally fail closed.
Streaming response arrives only after generation completes	This is expected for Check Point output rules because Bifrost screens the full buffered output.
No content can be screened	Confirm the request contains ordinary text, a standard assistant function call, or a standard tool result. Images, files, and direct MCP/A2A traffic are not included.

Getting Started

Moving from OSS

Release Cadence

Migration Guides

Features

Security

Check Point's AI Agent Security

Overview

Prerequisites

Set Up Check Point’s AI Agent Security

How It Works

Configuration Fields

Configure Bifrost

Actions And Outcomes

Redaction Behavior

Request Compatibility

Streaming Behavior

Observability

Troubleshooting

​Overview

​Prerequisites

​Set Up Check Point’s AI Agent Security

​How It Works

​Configuration Fields

​Configure Bifrost

​Actions And Outcomes

​Redaction Behavior

​Request Compatibility

​Streaming Behavior

​Observability

​Troubleshooting

​Related Documentation

Overview

Prerequisites

Set Up Check Point’s AI Agent Security

How It Works

Configuration Fields

Configure Bifrost

Actions And Outcomes

Redaction Behavior

Request Compatibility

Streaming Behavior

Observability

Troubleshooting

Related Documentation