OpsUnity — internal platform · AI engineering
A production LLM assistant built around its guardrails
A customer-facing assistant with retrieval over CMS content, lead capture and human handoff — designed so a fully compromised prompt still cannot trigger an unauthorised action.
- 0
- Credentials exposed to the browser
- 3-tier
- Rate limiting: IP, session, global daily
- 2
- Tools exposed — deliberately minimal
- 100%
- Tool invocations logged for review
The challenge
A public assistant holding an API key and database access is an untrusted client of your own systems: it takes instructions from strangers and turns them into calls. Treating the system prompt as the control is the common failure, and anyone who spends an afternoon with an agent can talk it past its instructions.
Our approach
The model credential lives server-side only — the browser talks to an application route, never to the provider. Retrieval runs over published CMS content so answers stay grounded and citable. Tool calls are authorised in code rather than on the model's assurance, and the destructive surface is deliberately small: the assistant can record a lead or hand off to a human, and nothing else. Layered rate limits bound both abuse and spend.
The design premise was that the prompt will eventually be defeated, so nothing security-relevant may depend on it holding.
The controls that matter
- Same-origin enforcement and a body-size cap before any model call is made
- Per-IP, per-session and global daily limits — the global ceiling bounds the worst case
- Input length and history caps, keeping cost per conversation predictable
- Retrieved context delimited explicitly, so injected instructions in content are not read as commands
- Conversation logging with clear disclosure in the interface
The honest limitation
Prompt injection is not solved, by us or anyone. What is achievable is bounding the consequences: a compromised prompt produces an embarrassing message rather than an unauthorised action, because the authorisation decision was never the model's to make.
Facing something similar?
Tell us where your infrastructure hurts. We'll show you the pipeline out.