Engines

An engine answers a question a policy asks: does this text hold a secret, is this an attempt to take over a model's instructions, is this package known to be malicious. A policy reads the answer in a filter row and acts on it. An engine decides nothing by itself.

The four engines

• PII and secrets — finds personal data and credentials with patterns and checksum validators. A workspace can add its own patterns. Tabs: Overview, Patterns, Exclusions.
• Prompt injection — flags attempts to take over a model's instructions. It can raise an alert but never block. Tabs: Overview, Model.
• AI judge — grades content against rubrics a workspace writes, using an AI model. Tabs: Overview, Model, Judges.
• AI supply chain — matches the AI a machine holds against a registry of malicious, unsafe and use-restricted components. Tabs: Overview, Registry, Dismissed.

Every engine page also has a Runs button in its header, which opens Governance › Runs narrowed to that engine.

On, off, and able to answer

Engines are on in a new workspace. The switch at the top right of an engine's page, On for this workspace, turns it off or back on, and saves as soon as it moves. It needs the engines:configure permission.

The engine's state is shown beside its name, on its page and in the column of engines beside it:

• Off — this workspace switched it off.
• Unavailable — it cannot answer, and the reason is shown with it: for example, No default model is set.
• No policy reads it — it is on, but no policy asks it anything, so it is never run.

The Overview's readiness card walks the same steps in order — switched on, a model where one is needed, in use by a policy — and offers the next action at each one.

What each one needs

• AI judge needs a model: the default model, chosen on its Model tab, or one a judge names for itself. Content it grades is sent to that model's provider. It ships with built-in scanners — Skill Scanner, Agent Definition Scanner, MCP Server Scanner and Hook / Command Scanner — and a built-in Prompt Injection Judge; the Judges tab is where a workspace writes its own.
• Prompt injection runs the model chosen on its Model tab. If that model is not deployed on the server, the engine is Unavailable.
• PII and secrets needs no model. Its Patterns tab holds the built-in rules and the workspace's own; Exclusions holds the values a rule should stop reporting.
• AI supply chain reads no content, only what an artifact is. It is the one engine that runs without a policy: it checks every AI artifact when it is discovered and when its content changes, and records a verdict. A Host policy acts on that verdict through Look at › AI supply chain. It cannot block or redact, because it answers in the background rather than while an action waits.