Guardrails & DLP
guardrails-v1Four-stage guardrail plane: PRE_ROUTE admission, PRE_MODEL input DLP, POST_MODEL output screening, PRE_RETURN final checks. A safety or DLP block never falls back to another model.
Policies
3
Evaluators
9registered
Blocks
2ledger total
Redactions
11
Flags
2+11 route restricts
Guardrail policies
Stage-by-stage evaluator wiring per policy; the streaming mode governs how output inspection interacts with SSE delivery.
Baseline safety + DLP
gp_baseline@3
- PRE_ROUTEprompt-injection-heuristic
- PRE_MODELpattern-dlpsecrets-scanner
- POST_MODELtoxicity-lite
- PRE_RETURNschema-validator
Strict confidential DLP
gp_strict@5
- PRE_ROUTEprompt-injection-heuristicegress-classifier
- PRE_MODELpattern-dlppii-redactorsecrets-scanner
- POST_MODELpattern-dlptoxicity-lite
- PRE_RETURNpii-redactorschema-validator
Audit-only (research sandbox)
gp_audit@1
- PRE_ROUTEprompt-injection-heuristic
- PRE_MODELpattern-dlp
- POST_MODELdisabled
- PRE_RETURNdisabled
Evaluator inventory
Deterministic evaluators run in-process on every request; learned evaluators plug into the same interface behind an inference call. Fail-closed evaluators block on internal error; fail-open ones downgrade to a flag.
| Evaluator | Type | Stages | Observed actions | Fail mode |
|---|---|---|---|---|
secrets-scanner AWS keys, PEM private keys, API keys, bearer tokens, JWTs. | deterministic | PRE_MODEL | allowredactrestrict_route | fail-closed |
pii-redactor Emails, phone numbers, NRIC/passport-like ids, credit cards (Luhn). | deterministic | PRE_MODELPRE_RETURN | allowredact | fail-closed |
pattern-dlp Classification markers, customer/financial identifiers, source-code heuristic. | deterministic | PRE_MODELPOST_MODEL | allowblockflag | fail-closed |
prompt-injection-heuristic Instruction-override, system-prompt exfiltration and role-override patterns. | deterministic | PRE_ROUTE | allow | fail-closed |
egress-classifier Classifies request data class to constrain egress placement. | deterministic | PRE_ROUTE | allowrestrict_route | fail-closed |
toxicity-lite Small deterministic harmful/harassment word-pattern screen. | deterministic | POST_MODEL | allow | fail-open-flag |
schema-validator Validates structured output parses when the client requested JSON. | deterministic | PRE_RETURN | allow | fail-open-flag |
size-budget Input size, context-pressure and per-request budget sanity checks. | deterministic | always-on | allow | fail-closed |
tool-authorizer Authorizes proposed tool calls against the profile's tool policy: unknown tools, principal kind, amount ceilings, approval requirements. | deterministic | always-on | — | fail-closed |
Recent guardrail decisions
Latest decisions across all generations, newest first. Details are masked — matched content is never echoed into the audit plane.
| When | Stage | Action | Evaluator | Detail (masked) | Generation |
|---|---|---|---|---|---|
| 4h ago | PRE_ROUTE | allow | size-budget | no findings [0.00ms] | gen_68n2seh6k5 |
| 4h ago | PRE_ROUTE | allow | prompt-injection-heuristic | no findings [0.00ms] | gen_68n2seh6k5 |
| 4h ago | PRE_MODEL | allow | pattern-dlp | no findings [0.00ms] | gen_68n2seh6k5 |
| 4h ago | PRE_MODEL | allow | secrets-scanner | no findings [0.00ms] | gen_68n2seh6k5 |
| 4h ago | POST_MODEL | allow | toxicity-lite | no findings [0.00ms] | gen_68n2seh6k5 |
| 4h ago | PRE_RETURN | allow | schema-validator | no findings [0.00ms] | gen_68n2seh6k5 |
| 4h ago | PRE_ROUTE | allow | size-budget | no findings [0.00ms] | gen_gwj31gprmv |
| 4h ago | PRE_ROUTE | allow | prompt-injection-heuristic | no findings [0.00ms] | gen_gwj31gprmv |
| 4h ago | PRE_MODEL | allow | pattern-dlp | no findings [0.00ms] | gen_gwj31gprmv |
| 4h ago | PRE_MODEL | allow | secrets-scanner | no findings [0.00ms] | gen_gwj31gprmv |
| 4h ago | POST_MODEL | allow | toxicity-lite | no findings [0.00ms] | gen_gwj31gprmv |
| 4h ago | PRE_RETURN | allow | schema-validator | no findings [0.00ms] | gen_gwj31gprmv |
| 4h ago | PRE_ROUTE | allow | size-budget | no findings [0.00ms] | gen_6jfcqptf2y |
| 4h ago | PRE_ROUTE | allow | prompt-injection-heuristic | no findings [0.00ms] | gen_6jfcqptf2y |
| 4h ago | PRE_MODEL | allow | pattern-dlp | no findings [0.00ms] | gen_6jfcqptf2y |
| 4h ago | PRE_MODEL | allow | secrets-scanner | no findings [0.00ms] | gen_6jfcqptf2y |
| 4h ago | POST_MODEL | allow | toxicity-lite | no findings [0.00ms] | gen_6jfcqptf2y |
| 4h ago | PRE_RETURN | allow | schema-validator | no findings [0.00ms] | gen_6jfcqptf2y |
| 7h ago | PRE_ROUTE | allow | size-budget | no findings [0.00ms] | gen_uqfbiyk91h |
| 7h ago | PRE_ROUTE | allow | prompt-injection-heuristic | no findings [0.00ms] | gen_uqfbiyk91h |
| 7h ago | PRE_MODEL | allow | pattern-dlp | no findings [0.00ms] | gen_uqfbiyk91h |
| 7h ago | PRE_MODEL | allow | secrets-scanner | no findings [0.00ms] | gen_uqfbiyk91h |
| 7h ago | PRE_ROUTE | allow | size-budget | no findings [0.00ms] | gen_09a6hqoasa |
| 7h ago | PRE_ROUTE | allow | prompt-injection-heuristic | no findings [0.00ms] | gen_09a6hqoasa |
| 7h ago | PRE_MODEL | allow | pattern-dlp | no findings [0.00ms] | gen_09a6hqoasa |
| 7h ago | PRE_MODEL | allow | secrets-scanner | no findings [0.00ms] | gen_09a6hqoasa |
| 7h ago | POST_MODEL | allow | toxicity-lite | no findings [0.00ms] | gen_09a6hqoasa |
| 7h ago | PRE_RETURN | allow | schema-validator | no findings [0.00ms] | gen_09a6hqoasa |
| 7h ago | PRE_ROUTE | allow | size-budget | no findings [0.00ms] | gen_r948r0lufk |
| 7h ago | PRE_ROUTE | allow | prompt-injection-heuristic | no findings [0.00ms] | gen_r948r0lufk |