Skip to main content
Within about a minute, everywhere. When you save a policy, a rule, a guardrail setting or a Suppression, PromptGuard uses it for the very next scan it makes. A Shadow AI device can keep reusing a verdict it already received for an identical request for up to 60 seconds. Nothing learns or adapts in the background, so there is nothing to wait for beyond that.

​
What happens when you save

PromptGuard does not compile your policies into something that has to be rolled out. Every scan builds its decision from your project’s current policies, rules, guardrail settings and Suppressions. So a saved change applies to the next request. Two short caches sit in the path. Neither one can hold a change back for long: The device cache exists because AI apps resend the same content many times a second, such as their tool definitions. It stops one prompt turning into dozens of identical scans.

​
What that means in practice

  • You loosen a policy that was blocking something. The next new request is allowed straight away. Re-sending the exact request that was just blocked, from the same device, can be blocked again for up to a minute.
  • You tighten a policy. New requests are checked against it straight away. A request identical to one allowed in the last minute on that device can be allowed once more until its minute is up.
  • You change a guardrail threshold, add a custom rule, or add a Suppression. All of these work the same way.
  • You edit policies through the API or as code (see Policy-as-Code). They work the same way: the change applies when it is saved.

​
Testing a change

To see a change take effect immediately, send a request that differs from the last one, even by a word. A request PromptGuard has not seen before is never answered from a cache.

​
Self-hosted installs

  • Hybrid: the engine pulls your policies from the cloud once a minute, so a change you save in the dashboard reaches it within about a minute, and then devices within one more. If the cloud can’t be reached, it keeps enforcing the last policies it pulled. See Deployment modes.
  • Air-gapped: the engine never calls us. Policies arrive in a signed bundle you import, and apply as soon as it is imported.