Your agent passed on your inputs, on your schedule, in your harness. Production runs on the adversary’s. The prompt that gets through is the one nobody wrote a test for, and it arrives inside a retrieved document or a tool response — well past any perimeter. Evidence gathered before deployment is worth having. It does not defend anything after it.
The test ends at deploy
Everything you proved was proved before the agent met a user. None of it defends the agent afterwards.
The perimeter is inside
Injection arrives in retrieved documents and tool output, not at the network edge. A WAF never sees it.
Safety that costs latency
Controls that add a second to every call get switched off in the first incident review.
HOW IT WORKS
Every call checked, in the execution path
Dome allows, blocks, steers, and logs user inputs, LLM calls, tool calls, and agent outputs — in-process as a library, or as guardian agents routing I/O in a multi-agent system.
Dome mounts either way. Import it and guard your own function — from vijil_dome import Dome then dome.guard_input(query) — or wrap the agent from the outside with the CLI. Start in shadow mode, see what it would have blocked, then enforce guard by guard.
protect
$ pip install vijil-dome# in-agent guards
$ vijil protect my-agent --guards prompt_injection,pii# or from outside
Dome is the enforcement layer of the Trusted Agent Lifecycle: protect mounts controls before deployment, monitor traces every call in production. Diamond certifies what Dome enforces; Darwin learns from what Dome observes.
