windlass.providers.guardrails.rules

rules

Rule-based guardrails — no dependencies, no model calls, no latency.

This is the guardrail you should reach for first. It catches the failure modes that actually occur in production — leaked PII, prompt injection in retrieved documents, banned terminology, competitor names in generated copy — using deterministic checks that add microseconds rather than a model round trip.

Layer :class:~windlass.providers.guardrails.nemo.NeMoGuardrail on top when you need conversational policy, topical rails or a model-based classifier.

Example

guard = RuleGuardrail(pii=True, injection=True, on_violation="redact") guard.validate("email me at a@b.com") 'email me at [EMAIL]' guard.check("Ignore all previous instructions.").allowed False

RuleGuardrail

RuleGuardrail(
    *,
    pii: bool = True,
    pii_kinds: Sequence[str] | None = None,
    injection: bool = True,
    secrets: bool = True,
    banned_words: Sequence[str] | None = None,
    banned_patterns: Sequence[str] | None = None,
    max_length: int | None = None,
    required_patterns: Sequence[str] | None = None,
    on_violation: str = "block",
    stages: tuple[str, ...] = ("input", "output"),
    **config: Any
)

Bases: Guardrail

Deterministic content policy.

Parameters:

Name	Type	Description	Default
pii	bool	Detect personal data using :func:~windlass.providers.preprocessors.privacy.detect_pii.	True
pii_kinds	Sequence[str] | None	Which PII categories to check. None checks all.	None
injection	bool	Detect prompt-injection attempts. Recommended on the input stage, and on retrieved context in a RAG pipeline — that is where injected instructions actually arrive.	True
secrets	bool	Detect leaked credentials. Recommended on the output stage.	True
banned_words	Sequence[str] | None	Terms that must not appear. Matched case-insensitively on word boundaries, so "cat" does not fire on "category".	None
banned_patterns	Sequence[str] | None	Extra regular expressions to check.	None
max_length	int | None	Reject content longer than this. A cheap defence against context-stuffing.	None
required_patterns	Sequence[str] | None	Patterns that must be present, for output-format enforcement (a citation marker, a JSON envelope).	None
on_violation	str	block, redact, warn or allow.	'block'
stages	tuple[str, ...]	Which stages this guardrail runs at.	('input', 'output')
**config	Any	Forwarded to :class:~windlass.interfaces.guardrail.Guardrail.	{}

Performance

Pure regex; roughly microseconds per kilobyte. Safe to run on every request and on every retrieved chunk.

Note

Pattern matching catches known attack shapes, not novel ones. Treat this as defence in depth alongside least-privilege tool design and human approval for consequential actions — not as a complete solution to prompt injection.

Source code in src\windlass\providers\guardrails\rules.py

def __init__(
    self,
    *,
    pii: bool = True,
    pii_kinds: Sequence[str] | None = None,
    injection: bool = True,
    secrets: bool = True,
    banned_words: Sequence[str] | None = None,
    banned_patterns: Sequence[str] | None = None,
    max_length: int | None = None,
    required_patterns: Sequence[str] | None = None,
    on_violation: str = "block",
    stages: tuple[str, ...] = ("input", "output"),
    **config: Any,
) -> None:
    super().__init__(on_violation=on_violation, stages=stages, **config)
    self.pii = pii
    self.pii_kinds = list(pii_kinds) if pii_kinds else None
    self.injection = injection
    self.secrets = secrets
    self.banned_words = [w.lower() for w in (banned_words or [])]
    self.banned_patterns = [re.compile(p, re.IGNORECASE) for p in (banned_patterns or [])]
    self.max_length = max_length
    self.required_patterns = [re.compile(p, re.IGNORECASE) for p in (required_patterns or [])]
    self._word_re = (
        re.compile(
            r"\b(?:" + "|".join(re.escape(w) for w in self.banned_words) + r")\b", re.IGNORECASE
        )
        if self.banned_words
        else None
    )

acheck async

acheck(
    content: str, *, stage: str = "input", context: dict[str, Any] | None = None
) -> GuardrailResult

Run every enabled rule against content.

Parameters:

Name	Type	Description	Default
content	str	The text to inspect.	required
stage	str	"input" or "output".	'input'
context	dict[str, Any] | None	Extra signals. Ignored by this guardrail.	None

Returns:

Type	Description
GuardrailResult	The verdict. content holds the redacted text when anything was
GuardrailResult	found, so a redact policy has something to use.

Source code in src\windlass\providers\guardrails\rules.py

async def acheck(
    self,
    content: str,
    *,
    stage: str = "input",
    context: dict[str, Any] | None = None,
) -> GuardrailResult:
    """Run every enabled rule against ``content``.

    Args:
        content: The text to inspect.
        stage: ``"input"`` or ``"output"``.
        context: Extra signals. Ignored by this guardrail.

    Returns:
        The verdict. ``content`` holds the redacted text when anything was
        found, so a ``redact`` policy has something to use.
    """
    detections: list[dict[str, Any]] = []
    redacted = content
    blocked: str | None = None

    if self.max_length and len(content) > self.max_length:
        detections.append(
            {"rule": "max_length", "detail": f"{len(content)} > {self.max_length}"}
        )
        blocked = blocked or "max_length"
        redacted = redacted[: self.max_length]

    if self.injection:
        for name, pattern in INJECTION_PATTERNS:
            match = pattern.search(content)
            if match:
                detections.append(
                    {"rule": "prompt_injection", "pattern": name, "match": match.group(0)[:120]}
                )
                blocked = blocked or "prompt_injection"

    if self.secrets:
        for name, pattern in SECRET_PATTERNS:
            if pattern.search(redacted):
                redacted = pattern.sub("[REDACTED_SECRET]", redacted)
                detections.append({"rule": "secret", "pattern": name})
                blocked = blocked or "secret"

    if self.pii:
        from windlass.providers.preprocessors.privacy import redact_pii

        redacted, pii_matches = redact_pii(redacted, self.pii_kinds)
        for detected in pii_matches:
            detections.append({"rule": "pii", "kind": detected.kind})
        if pii_matches:
            blocked = blocked or "pii"

    if self._word_re is not None:
        found = self._word_re.findall(redacted)
        if found:
            redacted = self._word_re.sub("[REDACTED]", redacted)
            detections.append({"rule": "banned_word", "matches": sorted(set(found))[:10]})
            blocked = blocked or "banned_word"

    for pattern in self.banned_patterns:
        if pattern.search(redacted):
            redacted = pattern.sub("[REDACTED]", redacted)
            detections.append({"rule": "banned_pattern", "pattern": pattern.pattern})
            blocked = blocked or "banned_pattern"

    for pattern in self.required_patterns:
        if not pattern.search(content):
            detections.append({"rule": "missing_required", "pattern": pattern.pattern})
            blocked = blocked or "missing_required"

    return GuardrailResult(
        allowed=blocked is None,
        content=redacted,
        detections=detections,
        rule=blocked,
        stage=stage,
    )