Learn your app's normal behavior, then block off-baseline requests (auth bypass, path traversal, scanners, unusual methods) in enforce mode. Rack/Rails/Sinatra middleware plus an OWASP-LLM prompt-injection guard backed by an embedded ML model (byte-identical across all Nemesis Shield SDKs). Privacy-preserving, fail-open, no runtime deps.