> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getbifrost.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Check Point's AI Agent Security
> Integrate Check Point's AI Agent Security with Bifrost to screen prompts and responses, enforce Check Point policies, and redact supported findings.
## Overview
Bifrost Enterprise supports [**Check Point's AI Agent Security**](https://www.checkpoint.com/ai-security/ai-agent-security/) as a third-party guardrail provider for screening LLM conversations.
Check Point owns the project policy and detector decision. Bifrost owns when the policy runs and what happens next: it can block the interaction, record the detection without intervening, or redact supported matches before content continues through the gateway.
Bifrost calls Check Point's `POST /v2/guard` endpoint with an OpenAI Chat Completions-style `messages` array. Chat Completions already use this shape; Bifrost normalizes Responses API and ordinary Anthropic Messages text into the same message format before screening.
**Streaming output:** For `output` and `both` rules, Bifrost holds the response until the stream is complete, screens the complete output once, and then blocks, redacts, or releases it. Check Point does not inspect individual response chunks in this integration.
## Prerequisites
* Bifrost Enterprise with guardrails enabled
* A Check Point API key
* A Check Point project with a policy assigned to it
* Bifrost must be able to connect to the Check Point API over HTTPS. If your deployment restricts outbound connections, allow the configured Check Point API host.
## Set Up Check Point's AI Agent Security
1. Sign in to the [Check Point AI Guardrails Dashboard](https://platform.lakera.ai/).
2. Open **Policies** and create or select the policy you want Bifrost to enforce.
3. Configure the policy's detectors and sensitivity.
4. Open **Projects**, create or select a project, and assign the policy to it.
5. Copy the project ID. Bifrost sends this value as `project_id` on every screening request.
6. Open **API Access** and create an API key for Bifrost.
Use a separate Check Point project for each application and environment. The project selects the assigned policy, so sharing one project can unintentionally couple policy changes across workloads.
Check Point's default policy is intentionally strict. Review its enabled detectors and sensitivity before attaching it to production traffic.
## How It Works
1. Create a provider configuration for Check Point's AI Agent Security in Bifrost.
2. Attach the configuration to a guardrail rule.
3. Set the rule to run on `input`, `output`, or `both`.
4. When the rule matches, Bifrost converts the retained conversation into Check Point's OpenAI-style `messages` format.
5. Bifrost sends the messages, Check Point project ID, breakdown request, and Bifrost request metadata to `POST /v2/guard`.
6. Check Point evaluates the latest interaction using the earlier messages as context and returns a `flagged` decision.
7. Bifrost applies the provider's configured `action`.
8. Bifrost records detector summaries and Check Point's request UUID in guardrail diagnostics when available.
When `action` is `redact`, Bifrost also sends `payload: true` so Check Point can return supported finding locations:
```json theme={null}
{
"messages": [
{
"role": "system",
"content": "You are a support assistant."
},
{
"role": "user",
"content": "Email me at alex@example.com"
}
],
"project_id": "project-1234567890",
"payload": true,
"breakdown": true,
"metadata": {
"bifrost_source": "input",
"bifrost_provider": "openai",
"bifrost_model": "gpt-5.4"
}
}
```
Both runtime screening and **Verify** use `POST /v2/guard`. Verification checks that Bifrost can make a normal screening request with the configured credentials and project, so it can appear in Check Point request logs. There is no separate no-event health-check call.
## Configuration Fields
| Field | Type | Required | Default | Description |
| -------------------- | ------- | -------- | ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `api_key` | string | Yes | - | Check Point API key. Supports `env.LAKERA_GUARD_API_KEY`. |
| `project_id` | string | Yes | - | Check Point project ID. The policy assigned to this project controls screening behavior. |
| `base_url` | string | No | `https://api.lakera.ai` | Check Point API base. Use a regional or enterprise base when required. Bifrost accepts the API root, `/v2`, or the full `/v2/guard` endpoint and normalizes it. |
| `action` | enum | No | `block` | `block`, `detect_only`, or `redact`. |
| `redaction_strategy` | enum | No | `replace` | Replacement strategy for non-reversible runtime redaction: `replace`, `mask`, or `hash`. |
| `redaction_mode` | enum | No | `runtime` | `runtime`, `logs_only`, or `runtime_reversible`. See [Redaction Modes](/enterprise/guardrails/redaction). |
| `timeout` | integer | No | `30` | Provider execution timeout in seconds. |
## Configure Bifrost
1. Go to **Guardrails** > **Providers**.
2. Select **Check Point's AI Agent Security** and click **Add Configuration**.
3. Enter a descriptive **Name**.
4. Enter the required **API Key** and **Project ID**.
5. Choose the Bifrost enforcement **Action**.
6. For `redact`, choose the **Redaction mode** and **Redaction strategy**.
7. Leave **Base URL** blank to use `https://api.lakera.ai`, or enter your Check Point regional or enterprise API base.
8. Set the timeout, enable the configuration, and click **Verify**.
9. Save the configuration and attach it to a rule under **Guardrails** > **Configuration**.
Create the provider configuration with the Bifrost management API:
```bash theme={null}
curl -X POST http://localhost:8080/api/guardrails/lakera \
-H "Content-Type: application/json" \
-d '{
"name": "ai-agent-security-production",
"enabled": true,
"config": {
"api_key": "env.LAKERA_GUARD_API_KEY",
"project_id": "project-1234567890",
"action": "block",
"base_url": "https://api.lakera.ai",
"timeout": 30
}
}'
```
Fetch the generated configuration ID:
```bash theme={null}
curl -X GET http://localhost:8080/api/guardrails/lakera \
-H "Content-Type: application/json"
```
Attach it to a rule by referencing `lakera:` in `selectedGuardrailProfiles`:
```bash theme={null}
curl -X POST http://localhost:8080/api/guardrails/rules \
-H "Content-Type: application/json" \
-d '{
"name": "ai-agent-security-all-model-input",
"description": "Screen all prompts with Check Point's AI Agent Security",
"enabled": true,
"celExpression": "true",
"applyTo": "input",
"samplingRate": 100,
"timeout": 60,
"selectedGuardrailProfiles": ["lakera:25"]
}'
```
```json theme={null}
{
"guardrails_config": {
"guardrail_providers": [
{
"id": 25,
"provider_name": "lakera",
"policy_name": "ai-agent-security-production",
"enabled": true,
"timeout": 30,
"config": {
"api_key": "env.LAKERA_GUARD_API_KEY",
"project_id": "project-1234567890",
"base_url": "https://api.lakera.ai",
"action": "block"
}
}
],
"guardrail_rules": [
{
"id": 251,
"name": "ai-agent-security-all-model-input",
"description": "Screen all prompts with Check Point's AI Agent Security",
"enabled": true,
"cel_expression": "true",
"apply_to": "input",
"sampling_rate": 100,
"timeout": 60,
"provider_config_ids": [25]
}
]
}
}
```
```yaml theme={null}
bifrost:
guardrails:
providers:
- id: 25
provider_name: "lakera"
policy_name: "ai-agent-security-production"
enabled: true
timeout: 30
config:
api_key: "env.LAKERA_GUARD_API_KEY"
project_id: "project-1234567890"
base_url: "https://api.lakera.ai"
action: "block"
rules:
- id: 251
name: "ai-agent-security-all-model-input"
description: "Screen all prompts with Check Point's AI Agent Security"
enabled: true
cel_expression: "true"
apply_to: "input"
sampling_rate: 100
timeout: 60
provider_config_ids: [25]
```
## Actions And Outcomes
| Bifrost action | Check Point result | Bifrost behavior |
| -------------- | ------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------- |
| `block` | `flagged: false` | Allows the original content unchanged. |
| `block` | `flagged: true` | Returns HTTP `400` with `GUARDRAIL_INTERVENED`. |
| `detect_only` | Either decision | Allows traffic and records Check Point's decision and detector diagnostics. |
| `redact` | `flagged: true` with valid maskable payload spans | Applies the configured Bifrost redaction strategy and mode. |
| `redact` | `flagged: true` without safely mappable payload spans | Fails closed with `GUARDRAIL_INTERVENED`. |
| Any action | Timeout, non-2xx response, missing decision, or malformed response | Treats the provider call as failed. The rule's failure behavior determines whether traffic continues. |
For a blocked request, Bifrost includes the detector summary when Check Point returns one. In **LLM Logs**, the request is marked **Error** and shows a message such as `Blocked by Check Point's AI Agent Security: Prompt attack detected (confidence: very likely)`.
```json theme={null}
{
"type": "guardrail_intervention",
"status_code": 400,
"error": {
"type": "guardrail_intervention",
"message": "Blocked by Check Point's AI Agent Security: Pii email detected (confidence: confident)"
}
}
```
## Redaction Behavior
Check Point does not return a complete transformed prompt or response. For supported detectors, it returns finding locations in the optional payload. Bifrost maps those spans back to the original message text and performs the rewrite using the selected [redaction strategy and mode](/enterprise/guardrails/redaction).
Check Point documents payload locations for PII, profanity, and custom detector regular-expression matches. Other flagged detectors, such as prompt attack, can produce a policy decision without a maskable payload. In `redact` mode, Bifrost blocks those findings because allowing the original unsafe content would defeat the rule.
Bifrost also fails closed if a returned span is missing, malformed, crosses text boundaries, or cannot be mapped safely. This preserves existing block behavior for findings that cannot be transformed correctly.
Check Point's masking of PII in the Check Point dashboard is separate from Bifrost redaction. Dashboard masking controls how request details are displayed or stored in Check Point; it does not provide transformed content for Bifrost to forward.
For Chat Completions and Text Completions with multiple output choices, Bifrost screens each choice independently. A blocking or unmaskable violation in any choice blocks the complete response. Maskable findings stay aligned with the choice that produced them.
## Request Compatibility
| Bifrost request surface | Supported | Behavior |
| ------------------------- | --------- | --------------------------------------------------------------------------------------------------------------- |
| Chat Completions | Yes | Sends the retained OpenAI-style message history directly. |
| Responses API | Yes | Normalizes ordinary text and standard function calls into Check Point's message format. |
| Anthropic Messages | Yes | Normalizes ordinary message text and standard client tool use/result content into Check Point's message format. |
| Streaming requests | Yes | Screens input before the LLM call; screens output after the complete stream is buffered. |
| Direct MCP or A2A traffic | No | These proxy surfaces are not converted into Check Point guard requests. |
The earlier retained messages provide conversation context; Check Point evaluates the latest interaction rather than independently reclassifying every old turn. Set a rule's `send_all_conversation_turns` to `false`, then use `max_turns_to_send` to include the current input plus a chosen number of preceding turns.
For output rules, Bifrost sends the retained request conversation together with the selected model output. Earlier history is context only and is not rewritten during the output pass.
## Streaming Behavior
Input screening happens before Bifrost calls the model, including when the client requested streaming output.
For output screening, the Check Point provider requires the complete normalized conversation. Bifrost therefore buffers the full model response, calls Check Point once, and then:
* returns a guardrail intervention if Check Point blocks it;
* releases the transformed response if Bifrost can redact all findings; or
* releases the original response when the policy allows it.
This adds end-of-stream guardrail latency and means the client does not receive incremental chunks before the Check Point decision. See [Streaming Output Guardrails](/enterprise/guardrails#streaming-output-guardrails).
## Observability
When available, Bifrost records Check Point diagnostics such as:
* `flagged`
* detected count and detector types
* policy IDs
* Check Point `request_uuid`
* number of Check Point screening requests, including per-choice output checks
Assessment summaries do not include the original matched text. Use Check Point's request UUID to correlate Bifrost diagnostics with Check Point logs.
## Troubleshooting
| Symptom | What to check |
| ---------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `401` or `403` from Check Point | Confirm the API key is current and available to the Bifrost process. |
| Verification fails | Confirm both required fields, network access, API base, and that the project exists and is accessible to the API key. Verification makes a normal `/v2/guard` request. |
| Unexpected detections | Review the policy assigned to the configured project, detector sensitivity, and the retained conversation history. |
| `redact` blocks instead of rewriting | Check whether the flagged detector returns payload spans. Prompt attacks and other non-maskable findings intentionally fail closed. |
| Streaming response arrives only after generation completes | This is expected for Check Point output rules because Bifrost screens the full buffered output. |
| No content can be screened | Confirm the request contains ordinary text, a standard assistant function call, or a standard tool result. Images, files, and direct MCP/A2A traffic are not included. |
## Related Documentation
* [Check Point's AI Agent Security guide](https://docs.lakera.ai/guard)
* [Check Point `POST /v2/guard` reference](https://docs.lakera.ai/api-reference/lakera-api/guard/screen-content)
* [Check Point's AI Agent Security overview](https://docs.lakera.ai/docs/agent-security)
* [Bifrost Guardrails](/enterprise/guardrails)
* [Bifrost Guardrail Redaction](/enterprise/guardrails/redaction)