Caller audio → transcribed text
Input guard
Screens transcribed caller input for prompt-injection patterns before the utterance reaches the rest of the agent runtime.
Security primitive
Security across every voice-agent boundary
VoiceLayer applies a security primitive around caller input, model context, spoken output, and tool execution. The runtime treats model output as untrusted until policy checks pass and does not rely on prompt instructions as the authorization layer.
Runtime context → language model
Prompt guard
Keeps the sealed system instructions separate from caller input and tokenizes detected sensitive data before model processing.
Model output → spoken response
Output guard
Inspects streamed model output before it reaches speech synthesis and can mask sensitive data or block forbidden response patterns.
Model tool request → execution
Action guard
Checks every tool call against declared capabilities and blocks undeclared actions instead of treating model intent as authorization.
The operational principle
Security is always on, contracts are checked before execution, and persistence or analytics work stays off the live audio path. This keeps the security floor consistent without making network-bound policy services part of every conversational turn.
Production teams should layer their own identity verification, disclosures, approval thresholds, retention policies, and incident procedures on top of this floor.
Security questions
Why is voice-agent security different from chatbot security?
A phone call adds audio, transcription, telephony, DTMF, transfer, identity, and real-world tool actions to the normal language-model attack surface. Controls have to operate across the full call path, not only in the system prompt.
Can a VoiceLayer agent bypass the security layer?
No. The security primitive is part of the platform runtime and wraps the other primitives. Agent configuration cannot disable it.
How are tool calls controlled?
Tools declare capabilities. The action guard checks the requested tool and parameters before execution and blocks calls whose capabilities are not in the agent declaration.
Does security replace application-specific compliance work?
No. Platform guardrails provide a structural security floor, but each deployment still needs appropriate consent, disclosure, identity, retention, human-review, and legal controls for its use case and jurisdiction.