Configure security filters

Security Filters is where you decide what CID222 looks for in a prompt or a model response, and what it does when it finds it. A rule can mask the match, flag it and let it through, or reject the whole message. The same page holds the response-side rules on a second tab.

What do I need?

Licence

Any

Role

admin_user

Prerequisites

• You are signed in as admin_user or superadmin. A viewer can read the page and is refused every change.
• At least one tenant group exists if you want a rule to behave differently for one department.
• You know which entity types the detectors already produce — see the generated entity type reference.

Three objects stack. A filter group holds filters and can switch all of them off at once. A filter carries the action, the priority and the model entity types it reacts to. A pattern is one regular expression under a filter. A filter with no patterns and no entity types detects nothing, whatever its Active toggle says.

Screenshot pendingSecurity Filters with the Input Filters tab, the editing-scope selector, five detection-engine tiles and the filters table/assets/screenshots/filters@0.4.png

Create an input filter

Add and test a pattern

A new filter matches nothing until it has a pattern or an entity binding. The Edit dialog does not contain patterns — they live behind the row menu.

Regex safety

Every pattern runs against every request, so the gateway refuses a pattern that

• fails to compile, or exceeds 1000 characters;
• has a catastrophic-backtracking shape — a quantified group whose body is quantified ((a+)+), repeated alternation with duplicate branches ((a|a)*), or chained open wildcards (.*.*);
• exceeds a 50 ms budget on adversarial probe input.

Breadth concerns — a pattern that matches everything, an unanchored short pattern, an absurd repetition count — come back as warnings beside the field and do not block the save.

Draft a rule from a description

Describe it turns plain language plus examples into candidate patterns, compiles them and runs them against your examples before anything is written.

Override a rule for one tenant group

Precedence is base < group < tenant. A tenant-level override is the most specific and wins outright; per-tenant overrides are written through the /admin/filter-overrides API, not from this page.

Turn a detection engine off for a group

The five tiles above the table — PII detection, Secrets & data leakage, Content safety, Jailbreak & injection, Code safety — group the filters that share one detector call.

Export, import, or apply a baseline

Baselines are action-policy bundles: they carry identity plus action and on/off state only, so the mode selector is disabled for them and an unknown reference degrades to a warning instead of failing the import. Output filters have no override table, so a group-targeted import skips the output section with a warning.

Output filters

The Output Filters tab holds the rules applied to the model's response. They are a separate table with their own actions and no regex patterns of their own.

• Filter types are PII Detection, Content Policy, Hallucination and Regex.
• Actions are Mask, Reject, Flag and Warn. Warn shows a warning and keeps the response, so it leaves the same residual exposure as a flag.
• Create one with Add output filter; the dialog asks for Group, Filter Name, Filter Type, Action Type, Validation Entity Type, ML Entity Types and Priority.
• Output rules are global. There is no output override layer: ai_filter_overrides addresses input filter ids, so a tenant or group override never reaches a response rule.

Fields reference

Add Input Filter / Edit Filter

Input filters table

Verify

1. The rule appears in the table with the action, priority and Active state you set, and its Detection methods cell is not Detects nothing.
2. Send a message that should match through AI Chat, then open All detections and confirm a row with the verdict you expect.
3. Open Event logs. Changing an action or an Active toggle writes one POLICY_PROTECTION_CHANGED row per changed field, with the value before and after, so a weakening is distinguishable from a re-enable. Renames and priority edits write nothing.
4. Exporting writes a FILTER_BUNDLE_EXPORTED row; a completed import writes a RESOURCE_UPDATED row against the resource type filter_bundle, carrying the mode, the target scope, the checksum and the change counts.

If it fails

• The rule matches in the pattern tester and does nothing in real traffic — check Active on the filter and on its group. An inactive rule still matches in the tester.
• Detects nothing on the row — the filter has neither a pattern nor an ML Entity Types value. Open Open menu → Patterns and add one.
• Nested quantifiers detected …, Repeated alternation contains duplicate branches …, or Multiple consecutive .* / .+ sequences … — the pattern is refused as a catastrophic-backtracking risk. Bound the quantifier, for example {1,20}.
• Pattern is {n} characters; the maximum is 1000. — shorten the pattern or split it into two.
• Could not check this pattern — the server did not respond. Saving is blocked until it can be verified. — the gateway is unreachable from the dashboard; the editor refuses to save an unverified pattern.
• Filter group "{name}" still contains {n} filter(s): … Delete them first, or repeat this request with ?cascade=true to remove them together. — the group is not empty.
• The filter configuration changed after this preview was taken. Re-run the preview and confirm the new diff. — someone else changed a filter between your preview and your confirm. Preview again.
• Bundle failed validation; nothing was imported. — the bundle is malformed or references objects this appliance cannot resolve. The response lists the errors.
• This is a read-only demo account (viewer role) — actions and changes are disabled. — the request was refused with READ_ONLY_ROLE. Sign in with an account that is not a viewer.

Next steps

• Filter testing — prove a rule catches what you think it catches before it reaches production.
• All detections — see what the rules are actually catching, across every capture point.
• Tenant groups — create the group whose overrides this page edits.