Policy

One YAML file controls what gets blocked, masked, or allowed per entity type. Stored in git, reloads without a restart.

Edit config/policy.yaml:

pii_min_score: 0.70  # global confidence threshold — entities below this are ignored

pii:
  EMAIL_ADDRESS: mask   # replace with [EMAIL_ADDRESS] before the LLM sees it
  PHONE_NUMBER: mask
  IP_ADDRESS: mask
  CREDIT_CARD: block    # reject the request, LLM never called
  US_SSN:
    action: block
    min_score: 0.85     # per-entity threshold overrides pii_min_score for this type
  IBAN_CODE: block
  CRYPTO: block
  MEDICAL_LICENSE: block
  PERSON: allow         # pass through unchanged
  LOCATION: allow
  DATE_TIME: allow
  URL: allow

injection:
  action: block

on_detector_error: fail_closed

Policy enforcement requires the detection engine. Set PROMPTSHIELD_ENGINE_URL to connect it. Without the engine the gateway runs in gateway-only mode: secret detection (Gitleaks) is still active, but PII and injection policies are not enforced.

Actions

Action	Behavior
`block`	HTTP 403 returned. LLM never called. Zero tokens consumed.
`mask`	Entity replaced with `[ENTITY_TYPE]`. Sanitized prompt forwarded.
`allow`	Passes through unchanged.
`warn`	Logs the event and audit record, but lets the request through. Coming soon.

warn is useful for rolling out policy changes gradually: run in warn mode, review what would have been blocked in the audit log, tune the config, then switch to block.

Confidence thresholds

pii_min_score sets a global floor — any entity with a confidence score below it is ignored before actions are applied. Range: 0.0–1.0. Default: 0 (accept all scores).

Individual entity entries accept a min_score field that overrides the global threshold for that type:

pii_min_score: 0.70      # default floor for all entities

pii:
  US_SSN: block          # shorthand — inherits the 0.70 global floor
  PERSON:
    action: allow
    min_score: 0.90      # only consider PERSON entities with confidence >= 0.90
  EMAIL_ADDRESS:
    action: mask
    min_score: 0.80      # higher bar for email — reduces false positives

Both the shorthand string form (US_SSN: block) and the object form are valid and can be mixed freely in the same file.

Secrets

The secrets block controls what happens when a credential appears in a prompt. See Secrets Detection for the full list of detected types.

secrets:
  action: block # block | allow | warn (coming soon)

mask does not apply to secrets. A partially redacted API key may still be usable, so the options are block or pass through.

Injection

Injection detection is not yet active. The injection config block is accepted and parsed, but the detection engine currently returns false for all injection checks. This will be the first thing shipped next. Configure the policy now and it will take effect when detection lands.

When injection detection ships, mask will not apply. Replacing "ignore previous instructions" with a placeholder still produces a broken prompt. Any mask set on injection will escalate to block.

Response scanning

To scan LLM responses before they reach your app:

response:
  scan: true
  EMAIL_ADDRESS: mask
  CREDIT_CARD: block

Engine errors

on_detector_error controls what happens when the detection engine is unreachable:

fail_closed: block any request that cannot be scanned. Recommended for production.
fail_open: pass unscanned requests through. Use during development when uptime matters more than enforcement.

Keeping policy in version control

policy.yaml is a plain file. Check it into git, review changes in pull requests, and deploy it alongside your application code. The gateway watches the file and reloads on change without a restart.