F5 AI Guardrails

The docs index lists proxy integrations that route the OpenAI and Anthropic SDKs, Claude Code, OpenAI Codex and Google Gemini through the platform, along with Slack and Microsoft Teams integrations and a SIEM connection. These route model traffic and send events; no connector lets an agent take authenticated action in an outside system. F5's page says it audits and blocks agents' tool calls, which governs actions that other systems take.

SourceF5 AI Security, docs.aisecurity.f5.com (docs index and integration guides) and /reference/roles-permissions.htmlread 2026-09-25

The platform sits in front of the customer's models and agents and does not run their workflows. Guardrails scan each call inline, and red team campaigns are ordered attack runs against a target, not agent work in several steps that the customer builds. No workflow model is documented.

SourceF5 AI Security, docs.aisecurity.f5.com/api-docs/about-api.html and /red-team/managing-campaigns.htmlread 2026-09-25

Prompts and responses are scanned and the customer's models attacked, but none of the documented API resources, which cover admin, roles, campaigns, license, projects, prompts, scanners, scans, tokens and users, indexes or retrieves the customer's documents for an agent to ground its answers on.

SourceF5 AI Security, docs.aisecurity.f5.com/api-docs/about-api.htmlread 2026-09-25

AI Guardrails runs structured guardrails inline on prompts and responses. Admins build guardrail packages from prebuilt and custom scanners, switch each one on or off and choose block or audit mode; they can also customize the response a blocked user sees and enforce guardrail use across projects. F5's product page adds that it explains and traces why each interaction was blocked or allowed, and audits and blocks unauthorized tool calls and agent actions. These guardrails stop an output outright; no human approval step is documented.

SourceF5 AI Security, docs.aisecurity.f5.com/reference/roles-permissions.html and f5.com/products/ai-guardrailsread 2026-09-25

The AI Security platform, formerly CalypsoAI and now sold by F5 (calypsoai.com redirects to f5.com), documents a deep access surface. Admins create custom roles from granular permissions over the organization, guardrails, model connections and secrets, projects, users, red team campaigns, reports and attack types, down to API access, which is off by default for basic users. MFA and user blocking are there too. Admins can switch data retention and prompt history logging on or off, and an audit endpoint records activity. No SSO or SAML integration is named.

No attestation scoped to these products appears. The F5 Trust Center describes a product certification program (FIPS, NIST, ISO) without naming the AI Security products, and no certificate scoped to AI Guardrails or AI Red Team is shown; F5 owns the product, so a scoped F5 certificate would apply.

SourceF5 AI Security, docs.aisecurity.f5.com/reference/roles-permissions.html and f5.com/company/trust-centerread 2026-09-25

The platform records the agent's own traffic. Prompt history logs, which admins can switch on or off, can be read in the product and through the API. Agent sessions show agent and tool counts and first and last prompt times, along with errors and the peak outcome, and a dashboard shows token use by project and guardrail. A separate audit log records user and configuration activity, and admins can send events to a SIEM.

SourceF5 AI Security, docs.aisecurity.f5.com/operations/get_agent_sessions.html, /guardrails/guardrails-dashboard.html and /reference/roles-permissions.htmlread 2026-09-25

The platform keeps records about the customer's agents, not memory for them. Prompt history, agent sessions and the audit log are read by people and by the scanners' enforcement, and the agent never reads them as context to decide. No memory layer or state the agent carries between runs is documented.

SourceF5 AI Security, docs.aisecurity.f5.com/operations/get_agent_sessions.html and /api-docs/about-api.htmlread 2026-09-25

The platform runs as SaaS, usually at us1.calypsoai.app, or inside the customer's own environment. The CAI-Deploy installer provisions or installs all AI Security products into AWS, Azure or Google Cloud accounts, into Oracle Cloud, or into an existing Kubernetes cluster, with separate guides for Helm, GCP and OpenShift. F5's product page adds private cloud and fully air gapped on premises deployment with full functionality. Hosting it yourself needs your own GPUs, at least 24 GB for Guardrails and 48 GB for Red Team.

SourceF5 AI Security, docs.aisecurity.f5.com/get-started/ai-security-install.html and f5.com/products/ai-guardrailsread 2026-09-25

Security content ships rather than agents or workflows. Monthly attack packs feed red team campaigns, prebuilt scanners go into guardrail packages the customer assembles, and country PII guardrail sets cover core, France, Japan, Korea and Spain, alongside prompt templates. These are libraries the customer assembles into its own guardrails and campaigns, not packaged assets a buyer adopts as working units.

SourceF5 AI Security, docs.aisecurity.f5.com/red-team/managing-campaigns.html, /reference/roles-permissions.html and the docs index (PII guardrail references)read 2026-09-25

AI Red Team campaigns run on a schedule. The campaign schedules API sets the start and end time, frequency and interval, along with the number of occurrences and the target providers, and it can run remediation automatically. So a schedule starts the platform's own adversarial testing with no person present. Guardrails work inline, starting when the customer's application sends a scan or a proxied prompt, so they add no trigger of their own, and blocks and alerts are outputs, not triggers.

SourceF5 AI Security, docs.aisecurity.f5.com/operations/post_campaign_schedules.html and /api-docs/about-api.htmlread 2026-09-25

Admins add model connections with their own stored secrets, set a default provider for each project and switch providers on or off per project. The API sends a prompt to a chosen provider through endpoints compatible with OpenAI, Anthropic and Google, and custom providers can be created too. So admins and users choose the model with their own keys inside the product, and the proxy endpoints do route model traffic.

SourceF5 AI Security, docs.aisecurity.f5.com/api-docs/about-api.html and /reference/roles-permissions.htmlread 2026-09-25

The AI Security API covers almost everything the platform does, including admin backup and import, roles and permissions, red team campaigns, license, projects, prompts and prompt templates, scanners (which can be created and versioned, exported and imported), scans, tokens and users. It is a REST API with bearer tokens and a full endpoint reference. A Python SDK, the calypsoai package, wraps it, and every sample in the docs uses it. No MCP server is documented.

SourceF5 AI Security, docs.aisecurity.f5.com/api-docs/about-api.html and /api-reference/read 2026-09-25

AI Red Team tests the customer's own models, applications and agents. Campaigns bundle attacks of several types, from standard and operational to agentic and custom, each defined by technique, vector and severity, with converters, and drawn from monthly attack packs. They run against the customer's providers, with reports and results the customer reads and compares across runs, and datasets and dataset runs are documented in the API too. Evaluating models is what this module sells, and the model under test is the customer's.

SourceF5 AI Security, docs.aisecurity.f5.com/red-team/managing-campaigns.html and /api-docs/about-api.htmlread 2026-09-25

The platform secures and tests AI models, apps and agents and does not operate a browser or computer itself; no capability of that kind appears on the product page or in the docs index.

SourceF5 AI Security, f5.com/products/ai-guardrails and docs.aisecurity.f5.comread 2026-09-25