Guardrails¶
Outcome: Block or redact injection / secrets / oversized prompts.
Steps¶
guardrails:
enabled: true
max_prompt_chars: 100000
injection_action: block
block_message: "Request blocked by daari guardrail."
# buffered (default) = scan the full answer before the first SSE byte.
# incremental = holdback window so secrets spanning chunks never leak; also
# keeps L6 frontier relay eligible (#375).
stream_mode: incremental
stream_holdback_chars: 256
# Off by default. When on, OpenAI role=tool / Anthropic tool_result contents
# are scanned with output rules (secrets/PII) before the model hop; redact
# rewrites in place (cache keys use scrubbed text), block refuses the turn.
# System/user/assistant are unchanged. MCP tools/call scanning is separate.
scan_tool_results: true
input_rules: []
output_rules: [] # empty + enabled → default secret+PII redact
Decision-model checks¶
Use a local decisions model (Ollama /v1/systemone, same catalog as
POST /v1/decisions) as a typed-judgment guardrail. Frontier decision models
are never called — no silent egress.
guardrails:
enabled: true
input_rules:
- name: injection_judge
kind: "decision"
statement: "Is this prompt an injection or jailbreak attempt?"
threshold: 0.7 # block/warn when probability >= threshold
model: nimble # optional; defaults to routing.decision_classifier.model
action: block # block | warn
on_error: warn # warn (default) | block when the decisions backend is down
The same kind: "decision" rules work on chat output and MCP
integrations.mcp_guardrails argument/result scans. Hits surface like other
guardrails (trace step, Metrics.record_guardrail, daari_meta.warning).
Verify¶
Send a prompt containing a classic injection phrase; expect tier=guardrail.