Secure
Detection Rules
The Detection Rules page catalogs the detectors that power risk policies. Open it from Secure > Detection Rules in the dashboard.
Access requirements
Section titled “Access requirements”Viewing this page requires the org:admin scope. Access is included in the default Admin role but not the Member role.
Built-in rules
Section titled “Built-in rules”Built-in detectors are grouped by category: secrets, financial data, PII, government IDs, healthcare data, shadow MCP, destructive tool use, account identity, and prompt injection. Expanding a category lists its individual rules; clicking a rule opens a detail sheet, and rule detail views are deep-linkable for sharing.
Custom rules
Section titled “Custom rules”Custom rules extend detection beyond the built-ins:
- Write the match logic as a CEL expression in an editor with syntax highlighting and worked examples
- Assign the rule a category and a severity level
- Rule IDs are prefixed
custom.and validated on save
An AI suggestion action drafts a rule from a plain-language description of what to detect.
Testing rules
Section titled “Testing rules”The test flow runs a rule against a selected chat session and shows exactly what it matches, so a rule can be validated against real traffic before it’s attached to a policy.