Zero-Trust Model
Trappr is built on the principle that no AI agent, workflow, or LLM call should be trusted by default — every request is verified, every response is inspected, and every deviation is flagged.
The problem with AI agents
Traditional network security assumes you can define a perimeter. AI agents break that assumption. An agent with tool access can read internal documents, call external APIs, write to databases, and send messages — all in response to text prompts that may come from untrusted sources.
An agent that has been prompt-injected looks identical to an agent operating normally. An agent whose workflow has been tampered with may continue producing correct-looking results while exfiltrating data in the background. Standard firewalls and WAFs offer no protection here.
Trappr's zero-trust approach
Every LLM call is inspected at the content level, not just the credential level. A valid API key does not mean the request is legitimate — Trappr evaluates what the agent is actually sending to the model.
User input, document content, tool outputs, and external API responses are all potential injection vectors. Trappr treats all non-system content as untrusted and monitors it accordingly.
Rather than trying to prevent every possible attack upfront, Trappr focuses on detecting the signals that indicate something has gone wrong — and surfacing them before damage occurs. Canary tokens are the earliest possible signal.
Agent API keys are scoped to specific apps and model allowlists. A compromised agent key can only call the models and providers its key permits — it cannot escalate to arbitrary providers or exfiltrate credentials from the platform.
Control layers in Trappr
| Layer | What it protects |
|---|---|
| Canary tokens | Detects prompt injection and data exfiltration attempts |
| DLP masking | Prevents sensitive data from leaving the controlled environment |
| Agent fingerprinting | Detects workflow tampering and supply-chain attacks |
| Enforcement mode | Actively blocks violating requests rather than just logging them |
| Scoped credentials | Limits blast radius of a compromised agent key |
| Execution tracking | Full audit trail for forensic investigation after an incident |