AI security often focuses on what a model produces. That is necessary, but it overlooks an earlier question:
What should be allowed to reach the model in the first place?
SAFi’s Phase 0 addresses that boundary. It is the first governance stage in the pipeline, operating before the system invokes its AI reasoning component. Its purpose is to identify suspicious, disallowed, or potentially manipulative requests before they enter the generation process.
This design reflects a practical security principle: reduce exposure before relying on downstream controls.
Phase 0 uses several complementary checks. It can identify known prompt-injection patterns, evaluate configured organization and business-unit restrictions, and apply heuristics for unusual input characteristics, including high-entropy content and embedded instructions. These checks are designed to detect attempts to manipulate system behavior, bypass governance rules, or introduce instructions that conflict with the intended task.
The timing matters. Once a model has processed hostile instructions, distinguishing trusted context from untrusted content can become more difficult. By screening the request before model invocation, SAFi creates a clear separation between the external input boundary and the reasoning layer.
Phase 0 is also deterministic. It does not ask an LLM to decide whether an input is safe. Instead, it applies explicit, inspectable controls that organizations can review, configure, test, and improve. This makes the security decision easier to trace and helps reduce unnecessary dependence on probabilistic judgment at the perimeter.
When Phase 0 identifies a problem, the request does not simply disappear. SAFi routes the result through an explicit governed response. This distinction is important for operational integrity. A blocked request should be recorded as a policy or security decision, not confused with a system failure. Users and administrators should be able to understand whether a request was rejected because it violated a configured boundary or because the platform could not complete its checks.
Phase 0 is not a claim of perfect prompt-injection prevention. Signatures can miss new attack patterns, and heuristics can produce false positives or false negatives. Effective deployment still requires updated threat intelligence, careful policy configuration, testing against realistic attack scenarios, monitoring, and human review.
Its value is more precise and more defensible: Phase 0 establishes a pre-invocation security checkpoint that makes the AI governance boundary explicit.
That is the broader SAFi approach. Security should not be treated as a final filter applied after generation. It should be part of the path from input to outcome, with clear controls at the points where risk enters the system.
Organizations can configure Phase 0 controls in Org Settings or define them as part of a Policy, allowing security requirements to reflect both organization-wide standards and more specific operational needs.
SAFi Phase 0: inspect first, reason second, govern throughout.
