Shield

Gnesi Shield scans a message you did not write before an agent acts on it. It looks for prompt injection, hidden text, and requests that try to make an agent ignore its instructions, forward mail, pay, or change account data.

Shield is on for every account. There is no off switch. Settings, Agents, Shield has two switches. The default keeps a review away from your agent until you release it.

shield@gnesi.io is the role that scans. It is not a mailbox you can claim.

What a verdict means

A scored message carries shield on the message:

• clear means Shield found no attempt to manipulate an agent. That is advice, not a guarantee.
• review means the message may try to manipulate an agent.
• unavailable means Shield could not score it. A sender can cause that with an empty body or with more text than Shield reads, about 256 KB. When the review switch is on, unavailable is held like review.

Shield does not scan the welcome note from hello@gnesi.io, a bounce, or a message you sent.

The two switches

Leave both off and the message stays visible. The verdict is attached. Your agent may read it.

"Keep a review away from my agent until I release it" holds a review or unavailable message away from an agent credential. You still see the body. The conversation stays in Needs you until you release it. A clear message is readable by your agent.

"Also hold a polite request to forward, pay, or change data" uses that same hold, and marks those polite requests as review. Turning it on also turns on the review hold.

Release is POST /v1/conversations/{id}/shield/release with a reason, or the release control on the conversation. A person who is signed in can release. An agent credential cannot. The verdict stays review, and the message records when and why you released it.

The scan finishes before the API returns the message. Rules decide the verdict. When a model is configured it may add a reason. If it is not configured, or it fails, the rules verdict stands.