Module guardrails 

AI guardrails (DW-082): prompt-injection heuristics, PII detection, banned-content filters, and output schema enforcement as a middleware chain on the AI proxy action.

A GuardrailEngine is compiled from the ai.guardrails config block at dataplane refresh and stored behind an ArcSwap (swapped on reload, so a guardrail change applies to the next request with no restart). Each rule is compiled once: regex patterns into a [regex::RegexSet] (injection/pii/banned kinds) and JSON schemas into a JSON-schema validator (schema kind, feature-gated).

Enforcement order

Prompt-phase rules run AFTER the chat request is parsed and AFTER the governance check, BEFORE model resolution and the provider call. A block action returns a 400 guardrail_blocked; a redact action scrubs the matched content from the prompt and continues; a log action records the match and continues (dry-run).

Response-phase rules run AFTER the provider response is parsed and BEFORE it is returned to the client. A block action returns a 400 (response_schema_violation for schema kind, guardrail_blocked otherwise). Streaming responses cannot be schema-validated (partial content); banned-content checks run per-chunk in the stream body.

Policy scoping

A rule with an empty policies list applies to ALL consumers. A rule with a non-empty list applies only to consumers whose attached policies (the consumer > route > service > listener > global chain) include at least one listed name — the same vocabulary the budgets and governance use.

False-positive characteristics and recommended thresholds

The guardrails are PATTERN-BASED heuristics, not ML classifiers. Their false-positive profiles differ by kind; operators should tune the pattern sets per deployment and use the log action to measure the false-positive rate on benign traffic before switching to block.

• Injection: the built-in patterns target explicit instruction- override phrases (“ignore previous instructions”, “disregard the above”, “you are now”, “new instructions:”, role-injection "role":"system"). False positives arise when a legitimate prompt discusses prompt injection (security research, meta- discussion about LLM behavior). Recommended threshold: start with log, review the matches, and narrow the custom patterns before switching to block. The built-in set is deliberately conservative (phrase-level, not keyword-level) to keep the benign-traffic false-positive rate near zero.
• PII: the built-in patterns match structured PII (email, phone, API key, credit card). False positives are rare for structured formats but can occur on phone-number patterns in numeric-heavy prompts (math, statistics). The phone pattern is conservative (requires a leading + or 7+ digits with separators). Recommended threshold: redact is safe by default (scrubs and continues); switch to block only when the deployment must never forward PII.
• Banned: entirely deployment-defined (no built-in patterns). The false-positive rate depends on the operator’s pattern set. Recommended threshold: start with log, measure, then block.
• Schema: deterministic (JSON Schema validation). No false positives — a response either conforms or it does not. The “false positive” risk is an overly strict schema that rejects valid provider responses; test the schema against representative traffic before enforcing block.

Dependency direction

ai depends on config only (see scripts/check_deps.py); this module reads config::ai::AiConfig and nothing else. The regex crate is a workspace dependency. The jsonschema crate is a workspace dependency used unconditionally for schema guardrails (AI-08/#197 decoupled schema checks from the openapi_validation feature flag — schema conformance is always available).

Structs

GuardrailEngine

The per-generation compiled guardrail engine (DW-082): the compiled rules from the ai.guardrails config block. Built at dataplane refresh; immutable once built. Stored on the dataplane behind an ArcSwap and swapped on reload, so a guardrail change applies to the next request with no restart.

Enums

GuardrailResult

The guardrail check result for one request or response.