Guardrails
For: tenant administrators and plugin users.
Install ai.oz0/guardrails to apply its hooks to every tool call and job in the tenant. It is not installed by default and is not a member of Essentials. These checks run only after a tenant installs it.
The platform's command rules already ask about catastrophic shell commands on every node, using the same reader and default rules as this plugin's command guard. Guardrails is free under Apache License 2.0, as are the other checks that protect data. It provides six checks:
| Check | Hook | What it does by default |
|---|---|---|
| Classified text | job_start, post_tool_call and job_end, first: oz0_guardrails.classified | A job's input, a tool's result or a job's output that carries a security-classification marking (HEMLIG and its levels, VS-NfD and the other VS grades, RESTREINT UE/EU RESTRICTED and above) is refused before a model reads it; nobody is asked |
| Personal data | post_tool_call and job_end: oz0_guardrails.redact | Each match in a tool's result or a job's output becomes [PII:<label>], such as [PII:personnummer] |
| Secrets | the same hook | The tenant's own secrets become [SECRET:<name>], such as [SECRET:TEAM_TOKEN], and well-known key formats [SECRET:<label>] |
| Injection | post_tool_call: oz0_guardrails.injection | A result that reads like an injection waits for a person before the model reads it |
| Shell commands | pre_tool_call: oz0_guardrails.command_guard | Uses platform command rules on current nodes and asks about catastrophic or unreadable commands on older nodes. See runtime coverage. |
| Intent | pre_tool_call: oz0_guardrails.intent_check | Off. When on, a model is asked whether the call fits what the job was asked to do; when it says no, the call waits for a person |
Command checks by runtime version
On a node whose runtime decides commands itself, as this release's does, the hook leaves commands to the platform's command rules. Those rules ask about the same catastrophic commands by default.
On an older node, a harness shell command waits for a person when it is catastrophic or cannot be read with certainty. Examples include rm -rf ~, mkfs, a force push to main, and curl ... | sh. The request explains the reason; the hook refuses nothing. See The command guard.
The classified check runs first, then redaction, then the injection check, so a person who is asked about a result
sees it redacted. Before a call, the command guard runs before the intent check: it asks no model. A tool oz0_guardrails.scan
(read-only) and the agent oz0-guardrails-check say what a text holds, by pack and position, without repeating it;
the scan reads the text and its folded form as the hooks do, and redacts it as the redaction hook would.
These are checks, not a guarantee. They find formats, not meaning: read what they miss before you rely on them, and keep the tool policy, taint and labels and approvals as they are.
Install
Its agent oz0-guardrails-check asks for the tenant's default model alias with tools, never a vendor's model, so it runs on whichever provider the tenant set up first; map it elsewhere with oz0 model alias set default <provider>/<model>.
oz0 plugin install hub:ai.oz0/guardrails --accept-model
The hub is not public yet; until it is, install from a checkout: oz0 plugin install plugins/guardrails --accept-model.
--accept-model lets the intent check call a model in the calling job's name (see The intent check).
The install is refused without it and says so. oz0 plugin revoke-reads guardrails model takes the grant back: the
other checks keep working, and the intent check, when on, sends every call to a person with the reason.
Packs
The patterns are packs of data, each with its own tests (examples that must match and that must not) and a note on its false positives. Every pack is on unless you turn it off.
| Pack | Finds | Checked with |
|---|---|---|
pii.core | Email addresses, international phone numbers, payment card numbers, IBANs (with or without spaces) | Luhn for cards, mod-97 for IBANs |
pii.se | Swedish personnummer and samordningsnummer (with or without the century, - or +), Swedish mobile numbers | The control digit (Luhn), a valid date; a samordningsnummer's day is 61 to 91 |
pii.no | Norwegian fødselsnummer and D-nummer | Both mod-11 control digits, a valid date |
pii.dk | Danish CPR numbers | A valid date, and a word such as CPR near it (the control digit is not reliable since 2007) |
pii.fi | Finnish henkilötunnus, with the century signs of 2023 | The mod-31 control character |
pii.is | Icelandic kennitala | The mod-11 control digit, a valid date |
pii.de | The German Steuer-Identifikationsnummer and ID card number | ISO 7064 MOD 11,10 for the tax ID, the ICAO 7-3-1 check digit for the card, and a context word near each |
classified.core | Security-classification markings, one per level, in capitals as they are stamped: the Swedish security classes (KVALIFICERAT HEMLIG, HEMLIG, KONFIDENTIELL, BEGRÄNSAT HEMLIG), the German VS grades (STRENG GEHEIM, GEHEIM, VS-VERTRAULICH, VS-NUR FÜR DEN DIENSTGEBRAUCH or VS-NfD in any case) and the EU classified markings (TRÈS SECRET UE/EU TOP SECRET, SECRET UE/EU SECRET, CONFIDENTIEL UE/EU CONFIDENTIAL, RESTREINT UE/EU RESTRICTED, and the short forms TS-UE/EU-TS, S-UE/EU-S, C-UE/EU-C, R-UE/EU-R) | The words only, with any spaces, non-breaking spaces or line breaks between them; always on (see Classified text) |
secrets.formats | Cloud access key IDs, forge and chat tokens, payment live keys, API keys of common shapes, private key blocks, JWTs | The format only |
injection.core | Instruction overrides, "new instructions", role changes, chat-template markers, requests for the system prompt, exfiltration phrasing, forged tool calls; and hidden text (invisible characters) | Patterns only |
The injection check uses patterns only. A small local classifier would need a model file downloaded at run time, which the plugin does not do; so it catches phrasing, not intent, and the threat model says what that leaves.
Related tasks
- Configure guardrails: Look up settings that control the guardrail checks.
- Check classified text: Understand classification matching and refusal behaviour.
- Check shell commands: Understand command parsing and approval behaviour on current and older nodes.
- Guardrail coverage and limits: Configure intent checks and understand what redaction and detection can miss.
Previous section links
- Section: classified text
- Section: invisible characters and look alike letters
- Section: settings
- Section: the command guard
- Section: the intent check
- Section: what redaction does not remove
- Section: what the checks miss
- Section: your own packs