Guardrails

Where guardrails run

Use a curated connector whenever these response controls are part of the safety boundary.

Policy shape

redact is an array of regular-expression strings. Matches are always replaced with the fixed marker [redacted]; custom rule names and replacement strings are not supported.

{
  "redact": [
    "(?i)bearer\\s+\\S+",
    "[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}"
  ],
  "maxResultBytes": 32768,
  "disableInjectionScan": false
}

The audit row records that redaction happened and how many values were affected, never the matched values.

Size and content handling

Text content is capped and truncated rune-safely with a visible marker; later text items are dropped after the shared budget is spent. Structured content is redacted and scanned through its JSON form, but it is dropped whole when that form exceeds the remaining budget. Binary content passes through unchanged. The injection scanner flags common attempts to redirect the model; it does not block the response by default, so review findings in the Flagged queue.