Guard Policies are authored at the Project level and attached to that Project’s Guardian. Open a Project, then click Policies in the left sidebar.
Each policy card shows its name, type (PII or Topic), version, and last-updated date. Use Add Policy to create a new one, the pencil to edit, and the trash to delete.
Before you start
PII policies
A PII policy is composed of three rule layers. Click a policy to see all three on one page.
NER Entities
Natural-language entity detection. Each entity carries:
- Name and Description — what the model should detect
- Policy Type —
MASKING, BLOCKING, or PASSING
- Mask Word — the token substituted when masking (e.g.,
RESIDENT_NUMBER)
- Alert Message — shown to the user or operator when the rule fires
- Positive / Negative Examples — training anchors that also serve as live test data
Regex Rules
Deterministic pattern matches. Each rule has:
- Rule ID (e.g.,
resident_number:_all_gender_with_separators)
- Pattern (regex)
- Policy Type —
PASSING (explicit allow, used for test fixtures) or MASKING (redact matches)
- Mask Word and Alert Message
Author PASSING rules with a test_data: prefix to whitelist example values you do not want masked in documentation or test fixtures.
Keywords
Literal string matches. Each keyword has a Word, a Mask Word (e.g., sensitive info), a Policy Type, and an Alert Message.
Topic policies
Topic policies classify the overall intent of an input into one of three branches:
| Branch | Meaning |
|---|
safe | Permitted content for this topic. |
unsafe | Content that should be blocked. |
controversial | Content that needs an additional check_criteria before a decision. |
id, title, and description; each branch carries its own title, description, and example inputs.
Versioning
Policies are versioned (e.g., v0.1.1). The detail view’s Version button lets you select a historical version; JSON exports the full definition; Add creates a new rule in the current version; Delete removes the policy.
Attach to a Guardian
Policies only take effect once attached to a Guardian. See Deploy a Guard API. 
