Detection Rules

The Detection Rules tab of the Guardrails page catalogs the reusable rules that guardrail policies scan with: a built-in library grouped by category, and the organization’s custom rules. Policies use rules in both directions, to flag messages and to exempt them through exclusion rules. A rule detects nothing on its own until a policy turns it on.

Open it from Security and Policy > Guardrails in the dashboard and select the Detection Rules tab. Old links to the standalone Detection Rules page redirect to the tab.

Access requirements

Viewing the tab requires the org:admin scope.

This page covers:

Browsing the catalog

Find a rule and open its detail sheet

Testing a rule

Run a rule against a pasted sample or a real session

Creating a custom rule

Draft a rule from a plain-language description, or write it by hand

Editing a custom rule

Change, retest, or delete an existing custom rule

Browsing the catalog

1. Select a category. Its rule list expands, one row per rule with the rule’s name and id.

   

2. Select a rule. The rule sheet opens with the rule’s category, a description of what it detects, and a playground.

   

The Built-in group lists the detector categories from the detector category table, each with its rule count. The organization’s own rules sit above it in a Custom group.

Testing a rule

Every rule sheet carries a playground that runs the rule with the same scanner code the production worker uses.

1. Choose the input: Paste sample for pasted text, or Run on a chat to run the rule over an existing agent session, picked by external user.

2. Paste a sample value, an MCP payload, or a chat message snippet, and select Run rule.

   

3. Review the matches. Each match shows the rule id, the match span, the confidence, the category, the matched value, and a description of the finding.

   

A run that returns 0 matches on a value the rule should catch usually means the sample doesn’t match the detector’s canonical format. Built-in secret detectors are tuned to the issuing service’s exact token shape.

Creating a custom rule

1. Select Custom Detection Rule. The new rule sheet opens.

   

2. Describe what to detect and select Suggest with AI, or select Skip, fill manually to start from empty fields. Include a sample value or the format in the description, so the model writes a tight expression.

   

3. Review the suggested rule and adjust any field:

   • Rule ID: the identifier that policies and findings use to reference the rule. It always starts with custom., must be unique across all built-in and custom rules, and cannot change after creation
   • Title: the rule’s display name in the catalog and on findings
   • Description: what the rule detects and why it matters, shown to reviewers alongside findings
   • Detection expression: the CEL expression the scanner evaluates against message content. The example chips below it insert working patterns to start from

   

4. Select Create rule. The rule appears in the Custom group of the catalog.

   

A custom rule attaches to a policy from the Custom Rules section of the policy’s Detect step, where each rule is selected individually.

Editing a custom rule

1. In the Custom group, select the rule. Its sheet opens as an editor, with the rule’s fields and the playground.

   

2. Adjust the title, description, or detection expression. Test the change in the playground, then select Save changes.

   

3. To remove the rule, select Delete rule in the sheet’s footer, beside Save changes. Deletion is immediate: there is no confirmation step.

Built-in rules cannot be edited or deleted. To narrow one, disable it for a policy on the Detect step’s Customize panel, or suppress specific values with an exclusion rule.