Response Inspection scans model output before it renders — the same classifier set that guards prompts, pointed at what comes back. Reconstructed PII, credentials in generated code, and policy-violating content are caught on arrival, not after they've been pasted into a ticket.
When an upstream injection survives to the output stage — a crafted link, an instruction to forward data, a fabricated 'system message' — response inspection is the second tripwire. The payload is stripped or the response blocked, and the session is flagged for review.
Inbound rules live in the same policies as outbound ones, with the same actions — redact, warn, block — and the same evidence trail. Auditors see one coherent control over the full exchange, not two half-measures.
Inspection is incremental and stays within the sub-38ms envelope — streaming UX is preserved.
No tool can adjudicate truth. What it detects is patterns: sensitive-data shapes, credential formats, unsafe instructions, and policy-violating content in output.
The same set as prompts: redact inline, warn the user, block the response, or flag the session — per policy.
Yes — response events carry the same classifier, policy, and verdict metadata, so the audit trail covers the whole exchange.