1.1 Prerequisites

Before starting the lab, you need to obtain API keys for both the AI Guardrails service and the LLM provider.

1.1.1 Prepare Lakera API Key

1. Go to https://www.lakera.ai/
2. Click Log In button (top right corner)
3. Login using your Gmail account
4. In the main menu of Lakera SaaS management, navigate to API access
5. Create a new API key and give it a name
6. Save the API key to your notepad or use STUDENT-NOTES.txt provided in your VSCode browser window

Important: You will need this API key for Lakera integration in your N8N workflow

1.1.2 Prepare OpenRouter API Key

1. Go to openrouter.ai and sign up using your Gmail account or create a new account
2. Click Get API Key
3. Click New Key (top right corner). Give your new key a name and set expiration date to 1 day. Click Create
4. Save the API key to your notepad or use STUDENT-NOTES.txt provided in your VSCode browser window

Important: You will need this API key for connecting your AI agent to the LLM model

1.2 Environment Setup

1.2.1 Launch N8N with GitHub Codespaces

1. Log in to GitHub in your browser
2. Visit the repository: mkol5222/lakera-in-n8n
3. Click the green Code button and select the Codespaces tab
4. Click the green Create codespace on main button
5. Be patient. VSCode will open in the browser. N8N deployment on a publicly accessible URL will be automatically created for you

This may take a few minutes

6. Once Codespace is ready, run the startup script in terminal:

   ./start-n8n.sh

   
7. When the provisioning script completes, open the newly created N8N-ACCESS.md file to see the URL
8. Login to N8N with these credentials:

   Field	Value
   Email	guru@nowhere.local
   Password	AdminIzk1ng

9. On the "Customize n8n" popup, click Get Started
10. On the next page, click Skip

1.2.2 Import Base Workflow

1. Click Create Workflow button (top right corner)
2. Click the three dots on the top right corner and select Import from URL
3. Use this URL to import the basic AI agent workflow:

   https://raw.githubusercontent.com/Bobes85/ITU2026/refs/heads/main/AI-agent.json

   
4. After successful import, you should see this workflow diagram:
5. Double-click OpenRouter Chat Model object
6. Click Set up credential
7. Insert your OpenRouter API key and click Save. You should see a green success message
8. Close the credentials window and verify the model is set to: openrouter/free

IMPORTANT: Make sure you use the FREE model!

9. Test the AI agent by opening the Chat window (bottom left corner). Send a message to verify you receive a response

1.3 Implement Input Scanning

Goal: Add AI Guardrails to scan user input before it reaches the AI agent

Step 1: Add HTTP Request Node

1. Click on When chat message received workflow object and click the plus sign (Add)
2. Insert a new HTTP Request workflow step

Step 2: Configure the HTTP Request

Fill in the following details:

Click Set up credential and insert your Lakera API key as the bearer token:

Your configuration should look like this:

Step 3: Configure Request Body

1. Enable Send Body (if not already on)
2. Set Specify Body to Using JSON
3. Paste this JSON:

{
  "messages": [
    {
      "content": "{{ $json.chatInput }}",
      "role": "user"
    }
  ],
  "breakdown": true
}

Step 4: Test the Integration

1. Write something in the chat window and send the message
2. You will get an error — this is expected!
3. Look for the flagged parameter in the output window — this confirms Lakera has inspected the message

Step 5: Add IF Router

1. Insert an IF node to handle Lakera verdicts
2. Set the condition: if flagged is equal to false
3. Drag and drop the flagged object from the left panel to the condition field

Step 6: Configure AI Agent

1. Double-click on the AI agent node
2. Change Source for Prompt (User Message) to Define Below
3. Drag and drop chatInput from INPUT to the Prompt field

Step 7: Add Blocking Response

1. Click the plus sign on the true connector of the IF node (flagged = true)
2. Add a new Chat node of "Send a message" type
3. Set your blocking message: Your message has been blocked for security reasons!!!

Your flow should look like this:

Step 8: Test with Malicious Prompts

Try sending malicious prompts to test the guardrails. You can:

• Create your own malicious prompts
• Use prompts from this dataset: OpenSafetyLab/Salad-Data

1.4 Implement Output Scanning

Goal: Add AI Guardrails to scan AI agent output before returning it to the user

Overview

You will add three new nodes after the AI agent:

1. Code node — Clean up AI agent output for scanning
2. HTTP Request node — Send output to Lakera for inspection
3. IF node — Decide whether to block or return the output

Step 1: Add Code Node

1. Click the plus sign behind AI Agent
2. Add a new Code - Code in Javascript node
3. Name the node sanitize-AI-output and paste this code:

return [{ json: { output: $input.first().json.output.replace(/\n/g, '\\n').replace(/"/g, '\\"') } }];

Step 2: Add Output Scanning Request

1. Duplicate the previous HTTP request node (right-click → Duplicate)
2. Rename it to Lakera-output
3. Connect it behind the sanitize-AI-output node
4. Modify the JSON body:

{
  "messages": [
    {
      "content": "{{ $json.output }}",
      "role": "assistant"
    }
  ],
  "breakdown": true
}

Step 3: Fix Chat Node

Update the final Chat node to return the AI agent's output:

• From INPUT, select AI Agent output and drag it to the Message field

Your flow should now work end-to-end:

Step 4: Add Output Verdict Routing

1. Delete the link between Lakera-output and the final Chat node
2. Duplicate the IF node from the input scanning section
3. Insert it between Lakera-output and Chat (via the false output)

Step 5: Add Output Blocking Response

1. Create a new Chat node
2. Connect it to the true connector of the IF node
3. Add a blocking message for flagged outputs

Complete Workflow

Your finished workflow should look like this:

1.5 Quick Start (TLDR)

For those who want to skip ahead or need to catch up quickly

Prerequisites

1. Generate API key at https://openrouter.ai
2. Generate API key at https://lakera.ai

Import Complete Workflow

Import the pre-built workflow with input and output scanning:

https://raw.githubusercontent.com/Bobes85/ITU2026/refs/heads/main/AI-agent-LAKERA-input%2Boutput.json

Bonus: Malicious Prompt Tester

A "Malicious Prompt Chat Roulette" workflow by Martin Koldovsky is available in your N8N instance. It picks random prompts from a dataset and sends them to AI Guardrails for testing.

Note: This tool doesn't use AI — it only tests the guardrails system.

2.1 Environment Setup

2.1.1 Prepare Windows 11 Machine

1. Connect to your assigned machine via RDP with these credentials:

   Field	Value
   Username	hiro
   Password	Welcom3Hom3!

2. Run the setup script to install necessary applications:

   .\setup.ps1

3. Run the MCP configuration script:

   .\addmcps.ps1

2.1.2 Configure Claude Desktop

1. Launch Claude and login using your Gmail account
2. Go to Settings → Extensions
3. Browse extensions and install Filesystem extension
4. (Optional) Add additional MCP servers as desired

Some MCP servers require API keys or authentication

5. Configure the Filesystem extension:
   • Allow access to your Desktop folder
   • Enable the extension
   
6. Test the setup: Prompt Claude to create a text file on your desktop

2.2 Deploy Workforce AI Security

2.2.1 Run Discovery Script

1. Access https://portal.checkpoint.com using your email

An invitation was sent to you prior to this event

2. Access your ITU tenant/account
3. Open Workforce AI management via the hamburger menu in Infinity Portal
4. Explore the UI and familiarize yourself with the interface
5. Navigate to Workforce AI → Deployment → Downloads
6. Copy the Agentic Endpoint Discovery script for Windows
7. Run it as Administrator in PowerShell

Script takes ~18 seconds. Results will propagate to management in a few minutes

2.2.2 Install Security Agent

1. Download the agent from the portal
2. Copy the installer to your virtual machine
3. Install the agent
4. Verify installation:
   • Check for agent icon in system tray
   • Verify Harmony Browse extension appears in Chrome

The browser extension may take a minute to appear

2.3 Configure Security Policies

2.3.1 Access Control Rules

1. Navigate to Workforce AI → Manage Interactions → Access
2. Create Rule 1 — Block access to specific AI services:
   • Block: Deepseek, Grok, ChatGPT
   • Enable logging
   • Set rule to Active
3. Create Rule 2 — Allow all other AI services:
   • Allow: All remaining services
   • Enable logging
   • Set rule to Active
   
4. Reload policy on agent to force immediate update

Or take a short break while policy propagates

5. Test: Try accessing Deepseek, Grok, or ChatGPT in browser. You should see:
6. Verify Claude is still accessible
7. Test in Incognito: Open a new Incognito window and try accessing ChatGPT
8. Check the management console for Access layer events

2.3.2 Data Protection Rules

1. Navigate to Manage Interactions → Chat
2. Create Rule 1 — Block sensitive data to Claude:

   Setting	Value
   Position	1 (first)
   Destination	Claude
   Block Data Types	Email address, Czech Republic Personal ID
   Logging	Enabled
   Status	Active

   
3. Wait for policy update or reload policy on agent
4. Test: Try sending your email address to Claude

You should see a blocking message:

2.4 Quick Start (TLDR)

For those who want a quick overview

Watch the Workforce AI Security video demonstration:

YouTube: Workforce AI Security Demo