Intent-Based Access Control

Stop data leaks before the LLM sees the request

Proactive detection of data-access intent with challenge-response verification. Inspired by real-world PII leakage incidents.

< 10ms

Intent detection

5

Built-in categories

10 min

Challenge TTL

How It Works

Detect intent, challenge, then verify.

1

Detect intent

Aho-Corasick pattern matching + confidence scoring analyzes prompts for data-access patterns.

2

Issue challenge

Request blocked before LLM invocation. Client receives challenge ID and verification token.

3

Verify & resume

User authenticates via your app's flow. Verified request bypasses IBAC on retry.

Protected Categories

Five built-in intent categories.

CategoryExamplesDefault Action
Order/Transaction"What is my order status?"challenge_required
Account Information"Show my account details"challenge_required
Payment Data"What's my credit card on file?"challenge_required
Customer Records"Look up user john@example.com"challenge_required
Custom RulesCustomer-defined patternsConfigurable
Verification Modes

Two modes for every security posture.

ModeHow It WorksBest For
trustBastio validates challenge ID, expiry, and non-empty tokenDevelopment / low-risk data
webhookHMAC-SHA256 signed POST to your endpoint; fail-closed on timeoutProduction / sensitive data

What's included

Detection, challenge, and verification — built in

Every request is analyzed for data-access intent with configurable categories and challenge-response verification.

5 built-in intent categories
Custom rule engine for additional patterns
Aho-Corasick pattern matching
Confidence scoring with thresholds
Challenge-response verification
10-minute challenge TTL with expiration
Trust and webhook verification modes
HMAC-SHA256 webhook signing
Fail-closed security model
Works with OpenAI, Anthropic, and Responses API
Streaming and non-streaming support
Dashboard configuration and analytics

Challenge Response

What the client receives when IBAC detects data-access intent.

{
  "challenge_required": true,
  "challenge_id": "ch_abc123",
  "verification_token": "vt_xyz789",
  "intent_category": "payment_data",
  "message": "Authentication required to access payment information."
}

Verified Retry

Retry the request with verification headers after authentication.

curl -X POST https://api.bastio.com/v1/chat/completions \
  -H "Content-Type: application/json" \
  -H "X-API-Key: YOUR_BASTIO_API_KEY" \
  -H "X-Bastio-Challenge-ID: ch_abc123" \
  -H "X-Bastio-Verification-Token: vt_xyz789" \
  -H "X-Bastio-Auth-Context: verified" \
  -d '{
    "model": "gpt-4o-mini",
    "messages": [{
      "role": "user",
      "content": "What is my credit card on file?"
    }]
  }'

Proactive, Not Reactive

Blocks before the LLM processes the request, preventing data exposure at the source.

Customer-Configurable

Define custom intent categories and patterns through the dashboard rules engine.

Zero Latency Impact

Intent detection runs in under 10ms using optimized Aho-Corasick pattern matching.

Stop data leaks at the source

Intent-Based Access Control is included with every plan. Enable it per proxy in your dashboard.

Get started freeRead the docs