Six predefined harmful content categories — Hate, Insults, Sexual, Violence, Misconduct, and Prompt Attack — each evaluated by independent ML classifiers that assign confidence levels from NONE to HIGH. P3Fusion configures filter strength per category based on the deployment context: HIGH strength for all six categories on customer-facing enterprise deployments blocks content at MEDIUM and HIGH confidence, allowing only NONE and LOW through. The Prompt Attack category specifically targets jailbreak attempts, role-play bypasses, and attempts to reveal system prompt contents — a threat vector that no prompt instruction can reliably block because the model processes the attack in the same context as legitimate safety instructions. Standard tier (deployed by P3Fusion) delivers 30% better prompt attack recall and detection across 60+ languages versus Classic tier.

Denied topics use NLP semantic classification — not keyword matching — to block interactions about subjects the RAG system should never discuss regardless of query phrasing. P3Fusion configures denied topics specific to each deployment's compliance and operational requirements. For a financial services InsightBot, this includes: investment advice, trading recommendations, and competitor product comparisons. For an insurance FusionReport deployment: medical diagnosis, legal liability determinations, and claims outcome predictions. Each topic is defined with a name, a description (up to 200 characters), and optional sample phrases. The classifier evaluates semantic intent, so "where should I put my savings to maximise returns?" triggers the investment advice denial even without those exact words — a capability that keyword blocking cannot replicate. A single guardrail supports up to 30 denied topics, all evaluated in parallel.

A probabilistic ML-based system detects and handles PII across 31 built-in entity types spanning General (Name, Email, Address, Phone, Age, Username, Password, Driver ID), Finance (Credit Card CVV/Expiry/Number/PIN, IBAN, SWIFT Code), IT (IP Address, MAC Address, URL, AWS Access Keys), and regional identifiers (SSN, US Passport, US Bank Account, Canada Health Number, UK NHS Number). P3Fusion configures PII filters with Anonymize mode on output — replacing detected entities with identifier tags like {NAME}, {EMAIL}, {SSN} — before any response reaches the user. For high-sensitivity deployments (healthcare, regulated financial services), Block mode is applied to stop the interaction entirely when PII is detected. Custom regex patterns extend coverage to organisation-specific identifiers: internal account codes, policy numbers, employee IDs.

The layer most critical for RAG deployments. Contextual grounding checks measure two independent scores against each generated response. The Grounding Score evaluates whether the response is factually supported by the retrieved source documents — any claim the model introduces that is not present in the provided context receives a low grounding score, flagging it as a potential hallucination. The Relevance Score evaluates whether the response actually answers the user's query — catching responses that are factually grounded but completely miss the question asked. Both scores are computed on a scale of 0–0.99, with configurable blocking thresholds. P3Fusion configures both thresholds at 0.7 as the production baseline, tightened to 0.8 for high-stakes domains. Responses falling below either threshold are blocked and replaced with the configured fallback message. This is the only component of the system that can catch the specific failure mode of an LLM generating accurate-sounding but context-free claims — the most dangerous failure mode in enterprise RAG because it is the hardest for users to detect.

The most computationally efficient layer — and the only one with zero additional cost. Word filters provide deterministic exact-match blocking via two mechanisms: a managed AWS profanity list (continuously updated) and a custom word list supporting up to 10,000 entries of phrases up to 3 words each. P3Fusion uses custom word filters for deployment-specific terminology that must never appear in responses regardless of context: competitor product names in white-label deployments, internal code names that must not be disclosed, regulatory terms that require human review rather than AI response. Word filters run before the more expensive ML-based checks, acting as a fast pre-screen that catches known-bad content without incurring classifier latency or cost.

The most sophisticated layer — and the only one that provides mathematically provable verification rather than probabilistic assessment. Automated Reasoning uses SMT (Satisfiability Modulo Theories) solvers to validate model responses against formal logical rules extracted from policy documents. For a financial services InsightBot: compliance rules, trading limits, regulatory restrictions. For an insurance FusionReport: policy terms, claim eligibility criteria, regulatory reporting requirements. An administrator uploads the source document; the system extracts formal logic variables and rules; at runtime each response is validated against these rules and returns a deterministic result: VALID, INVALID, or TOO_COMPLEX. This deterministic verification is non-negotiable for regulatory audit trails where a probabilistic LLM output is legally insufficient. P3Fusion deploys Automated Reasoning on all financial services and insurance RAG deployments where rule-based policy compliance must be mathematically verifiable.