Copy page

AI Gateway

Data Loss Prevention (DLP) Policy

Scans AI request and response content — system prompts, message text, and tool-call arguments — for sensitive data such as credit cards, national identifiers, and API keys, applying per-rule actions (mask, block, or log). Detection runs entirely inside the gateway, and streaming responses are scanned as they stream.

Configuration

The configuration shows how to configure the policy in the 'policies.json' document.

Code
{
  "name": "my-ai-gateway-dlp-inbound-policy",
  "policyType": "ai-gateway-dlp-inbound",
  "handler": {
    "export": "AIGatewayDlpInboundPolicy",
    "module": "$import(@zuplo/runtime)",
    "options": {
      "rules": {
        "pii": {
          "inboundAction": "mask",
          "outboundAction": "block"
        },
        "secret": {
          "action": "block"
        }
      }
    }
  }
}

Policy Configuration

• name <string> - The name of your policy instance. This is used as a reference in your routes.
• policyType <string> - The identifier of the policy. This is used by the Zuplo UI. Value should be ai-gateway-dlp-inbound.
• handler.export <string> - The name of the exported type. Value should be AIGatewayDlpInboundPolicy.
• handler.module <string> - The module containing the policy. Value should be $import(@zuplo/runtime).
• handler.options <object> - The options for this policy. See Policy Options below.

Policy Options

The options for this policy are specified below. All properties are optional unless specifically marked as required.

• rules (required) <object> - What to find and what to do about it. Each key is a built-in data type id (like id-us-ssn) or a group selector (like pii or secret, plus any dash-aligned id prefix such as secret-aws); each value is a rule object stating either one action for both directions or a directional pair (inboundAction/outboundAction) — for example mask PII inbound and block it outbound. Types you do not mention are not scanned. The most specific key wins — an exact id beats a prefix beats a group — and the winning entry decides everything for its type. When one stretch of text matches multiple rules, the severest action wins (block > mask > log). At least one rule must scan something.
  • contact <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • finance <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • finance-us <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • id <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • id-au <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • id-br <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • id-ca <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • id-es <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • id-fr <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • id-in <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • id-it <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • id-nl <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • id-pl <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • id-sg <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • id-uk <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • id-us <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • network <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • pii <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • region-eu <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • secret <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • secret-aws <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • contact-email <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • contact-phone <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • finance-credit-card <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • finance-crypto-wallet <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • finance-cvv <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • finance-iban <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • finance-swift-bic <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • finance-us-aba-routing <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • finance-us-bank-account <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • id-au-abn <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • id-au-acn <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • id-au-medicare <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • id-au-tfn <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • id-br-cpf <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • id-ca-sin <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • id-es-nif <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • id-fr-nir <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • id-in-aadhaar <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • id-in-pan <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • id-it-fiscal-code <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • id-nl-bsn <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • id-pl-pesel <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • id-sg-nric <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • id-uk-nhs <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • id-uk-nino <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • id-us-itin <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • id-us-passport <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • id-us-ssn <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • network-ipv4 <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • network-ipv6 <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • network-mac <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • secret-anthropic <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • secret-aws-access-key <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • secret-aws-bedrock <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • secret-azure-client <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • secret-databricks <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • secret-digitalocean <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • secret-discord-webhook <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • secret-github <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • secret-gitlab <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • secret-google-api-key <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • secret-heroku <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • secret-hugging-face <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • secret-jwt <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • secret-mailchimp <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • secret-mailgun <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • secret-npm <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • secret-openai <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • secret-perplexity <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • secret-postman <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • secret-private-key <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • secret-pypi <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • secret-sendgrid <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • secret-sentry <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • secret-shopify <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • secret-slack <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • secret-square <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • secret-stripe <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • secret-telegram-bot <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • secret-terraform <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • secret-twilio <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
  • secret-zuplo <object> - No description available.
    • action <string> - What happens when this type is found, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the detected types (never the values); log records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; off excludes this type from a group enabled by a broader key. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
    • inboundAction <string> - What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with outboundAction to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or off) leaves the inbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • outboundAction <string> - What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or off) leaves the outbound direction unscanned for this type. Cannot be combined with action. Allowed values are mask, block, log, off.
    • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
    • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
    • partialMask <object> - No description available.
      • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
• customRules <object[]> - Your own detection rules alongside the built-ins: the same rule object plus a name, a regex pattern, and optional context words.
  • name (required) <string> - Identifier reported in findings and block details for this rule.
  • pattern (required) <string> - A JavaScript regular expression source string. Remember to escape backslashes for JSON (for example \\d for a digit). An invalid pattern fails the configuration at request time — a broken guardrail never degrades into a silent pass-through.
  • context <string[]> - Context words for this rule. With detection: "corroborated" the rule only fires when one of these words appears near the match.
  • action <string> - What happens when this rule matches, in BOTH directions. mask replaces the matched text with a placeholder and the conversation continues; block rejects the request or terminates the response with an error naming only the rule's name (never the values); log records a finding and lets the traffic pass unchanged; off disables the rule. A rule states either action or the directional pair (inboundAction/outboundAction), never both. Allowed values are mask, block, log, off.
  • inboundAction <string> - What happens when this rule matches in what callers send the model. Use with outboundAction to give the rule different behavior per direction. Omitting it (or off) leaves the inbound direction unscanned for this rule. Cannot be combined with action. Allowed values are mask, block, log, off.
  • outboundAction <string> - What happens when this rule matches in what the model sends back. Omitting it (or off) leaves the outbound direction unscanned for this rule. Cannot be combined with action. Allowed values are mask, block, log, off.
  • detection <string> - How much evidence a match needs before this rule acts. corroborated additionally requires one of the type's context words near the match (types that define no context words behave as standard); standard uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with the log action for audits. Overrides the policy-level detection for this rule. Allowed values are corroborated, standard, aggressive.
  • mask <string> - Replacement text for this rule's masked matches. The {type} token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into [CONTACT_EMAIL] — typed placeholders keep masked conversations legible to the model. Set a literal like [REDACTED] to hide the type. Defaults to "[{type}]".
  • partialMask <object> - No description available.
    • keepLast (required) <integer> - Keep the last N characters of the matched value unmasked and replace the rest with *, preserving length (for example **** **** **** 4242). Values no longer than N characters are fully masked.
• allowValues <string[]> - Exact strings that are never flagged by any rule — documentation samples like Stripe's public test card 4242 4242 4242 4242, or your own support email address. Matching is case-sensitive against the exact detected text, including when a value arrives split across streaming chunks.
• detection <string> - Default evidence level for rules that do not set their own. See the per-rule detection description for the level semantics. There are no numeric confidence thresholds to tune — levels are the whole dial. Allowed values are corroborated, standard, aggressive. Defaults to "standard".
• scanToolArguments <boolean> - Also scan tool/function-call argument payloads — in requests, buffered responses, and streamed tool-call deltas. Tool arguments are user and model content; disabling this exempts them from every rule. Defaults to true.
• streaming <object> - Tuning for streaming (SSE) response scanning. Each chunk is held until the boundary scan that includes its successor passes, then released — so values split across chunks are always fully maskable, at the cost of one chunk of latency.
  • enabled <boolean> - Scan streaming responses. When false, streaming responses pass through unscanned even when rules cover the outbound direction. Defaults to true.
  • boundaryScan <boolean> - Scan across chunk boundaries using a carried tail of already-scanned text. When false, each chunk is scanned alone and released immediately — lower cost, but values split across two chunks are missed. Defaults to true.
  • maxCarryChars <number> - How many trailing characters are carried from one chunk into the next boundary scan. Bounds memory and re-scan cost; must be larger than the longest value you need to catch. Defaults to 512.
• endpoints <string[]> - The endpoint shapes this policy applies to. Omit to apply to all (openai-chat, openai-responses, anthropic-messages).
• onUnknownShape <string> - What to do when the request shape cannot be inspected. As a guardrail this policy defaults to deny (fail closed) so uninspectable content is never served. Allowed values are deny, skip. Defaults to "deny".
• onError <string> - What to do if the scanner itself throws. The engine is a local in-gateway scanner, so this is effectively unreachable outside of a runtime defect — but a guardrail must declare its failure posture. block (the default) fails closed with a 500 in the route's native error format; allow fails open and serves the content uninspected. Allowed values are block, allow. Defaults to "block".
• engine <string> - The detection engine. Only builtin (in-gateway regex + checksum detection with context-word scoring; no data egress) is available today. Declaring the discriminator now keeps future engines an additive, non-breaking change. Allowed values are builtin. Defaults to "builtin".

Using the Policy

The Data Loss Prevention (DLP) policy scans the content of AI requests and responses — system prompts, message text, thinking blocks, tool-result text, and (by default) tool-call arguments — for sensitive data, and applies a per-rule action when something is found. It never inspects structural fields: model names, temperatures, token counts, and usage pass through untouched.

Detection runs entirely inside your gateway using the built-in DLP engine (62 data types backed by regexes, checksums such as Luhn and IBAN mod-97, and context-word scoring). Nothing is sent to a third-party scanning service.

Rules

rules is a map. Each key names a built-in data type id (like id-us-ssn) or a group selector (like pii, secret, or any dash-aligned prefix such as secret-aws); each value is a rule object stating what happens when that type is found:

• mask — replace the matched text with a placeholder; the conversation continues.
• block — reject the request (or terminate the response) with an error naming the detected types, never the values.
• log — record a finding and let the traffic pass; use it to trial a rule.
• off — exclude this type from a group enabled by a broader key.

A rule states its action in one of two ways, never both: a single action applying in both directions, or the directional pair inboundAction / outboundAction — inboundAction governs what callers send the model, outboundAction governs what the model sends back (buffered responses whole, streaming responses as they stream). Either directional field alone limits the rule to that direction.

Types you do not mention are not scanned. The most specific key wins (exact id beats a prefix beats a group) and the winning entry decides everything for its type, direction included. When one stretch of text matches multiple rules, the severest action wins (block > mask > log).

Code
"rules": {
  "pii": { "inboundAction": "mask", "outboundAction": "block" },
  "contact-phone": { "action": "off" },
  "secret": { "action": "block" },
  "finance-credit-card": { "action": "mask", "partialMask": { "keepLast": 4 } },
  "finance-cvv": { "action": "block", "detection": "corroborated" }
}

Detection levels

Each type combines its pattern with evidence — a checksum where the format has one, context words (like "cvv" or "routing number") where it does not. detection says how much evidence a match needs: corroborated additionally requires one of the type's context words near the match (types without context words behave as standard); standard (the default) uses the catalog as tuned — distinctive shapes such as a dashed SSN act on their own, ambiguous shapes such as a bare CVV need nearby context; aggressive counts every pattern match and is false-positive-prone — pair it with log for audits. There are no numeric confidence thresholds to tune.

Masking

The default replacement is the typed placeholder [{type}], which renders the detected type id in UPPER_SNAKE form — bob@acme.com becomes [CONTACT_EMAIL] — keeping masked conversations legible to the model. Set a rule's mask to a literal like [REDACTED] to hide the type instead. partialMask: { "keepLast": 4 } keeps the last four characters and *-fills the rest, preserving length (**** **** **** 4242).

Allowed values

allowValues lists exact strings never flagged by any rule — documentation samples like Stripe's public test card, or your own support email address. The exemption applies to the whole value even when it arrives split across streaming chunks.

Custom rules

customRules adds your own detections: the same rule object plus a name, a regex pattern, and optional context words (detection: "corroborated" then means "only near one of those words"). Names must be distinct and must not reuse a built-in type id or group selector — built-in types are configured through rules. An invalid pattern or a colliding name fails the configuration at request time — a broken guardrail never degrades into a silent pass-through.

Streaming responses

Streaming responses are scanned as they stream. Providers emit deltas of a few characters, so each channel's text is first coalesced into scan pieces of at least 64 characters (clients concatenate deltas, so only the chunking shifts — never the text). The scanner carries a bounded tail of already-scanned text (streaming.maxCarryChars, default 512) into each new piece's scan, and each piece is released once the scan including its successor passes — so a value split across pieces is fully maskable before anything is delivered, at the cost of roughly one coalesced piece (~64 characters) of latency. When a block rule fires mid-stream, the stream terminates with the endpoint's native content-filter events (OpenAI clients see a content_filter error chunk and [DONE]; Anthropic clients see a well-formed message_delta with stop_reason: "content_filter" and message_stop). Setting streaming.boundaryScan: false scans each chunk alone and releases it immediately — lower cost, but values split across chunks are missed.

Failure posture

This policy is a guardrail and fails closed by default: content whose shape cannot be inspected is denied (onUnknownShape: "deny", which also covers a streamed SSE event that cannot be parsed), and an internal scanner failure blocks with a 500 (onError: "block"). A detected value that masking cannot reach — one whose evidence spans two separate message fields, so no single field can be rewritten — is blocked instead of forwarded half-covered. Error responses (4xx/5xx) from the upstream are never scanned. Response hooks compose with other AI Gateway policies on compatibility dates of 2026-03-01 or later.

Known limits

• Masking is complete for streamed values up to two coalesced scan pieces (~128 characters) regardless of how finely the provider chunks its deltas, for types whose shape alone is decisive (dashed SSNs, cards, prefixed secrets). A longer value (or one past maxCarryChars) is still detected — and can block — but its earliest pieces may already have been delivered.
• A context-gated match (a weak form, or a corroborated rule) whose context word arrives only in a LATER piece can leak the characters delivered before the context made it actionable; detection and blocking still fire.
• Streamed logprobs are removed from scanned chat streams: masking rewrites the text they describe, and stale logprobs are worse than absent ones.
• Context words must appear in the conversation text itself; JSON field names in your application's data are not visible to the scanner.
• Multi-line values such as PEM private key blocks are not detected across streaming chunk boundaries.

Read more about how policies work