Security Profiles

A security profile is a named set of policy rules attached to a project. Every API key inherits the policies of its project's active security profile. Profiles are evaluated in real time — changes take effect on the next request.

Built-in profiles

Custom profiles

Create a custom profile when the built-in options are too broad or too restrictive. Profiles are defined as JSON or via the dashboard.

{
  "name": "healthcare-strict",
  "description": "HIPAA-aligned profile for healthcare AI",
  "risk_threshold": 0.2,          // block if score ≥ 0.2
  "dlp": {
    "mode": "block",              // block | redact | warn
    "patterns": ["ssn", "phi", "credit_card", "email"]
  },
  "classifiers": {
    "injection": true,
    "jailbreak": true,
    "toxicity": true,
    "pii": true
  },
  "topic_blocks": [
    "competitor pricing",
    "employee compensation"
  ],
  "rbac": {
    "require_role": ["analyst", "admin"]
  }
}

Rule evaluation order

When multiple conditions could apply, the decision engine uses strict precedence:

1. RBAC check — if the calling user lacks the required role, block immediately.
2. Topic block list — if the prompt matches a blocked topic, block.
3. DLP scan — if PII or secrets are found, apply the configured DLP mode.
4. Risk score threshold — if the composite risk score exceeds the threshold, block or warn.
5. Allow — all checks passed; forward to model.

DLP patterns

GovernanceAI ships with 30+ pre-built regex patterns. You can extend with custom patterns using standard Python regex syntax.

{
  "dlp": {
    "custom_patterns": [
      {
        "name": "internal_ticket",
        "regex": "TICK-[0-9]{6}",
        "action": "warn"
      },
      {
        "name": "employee_id",
        "regex": "EMP[0-9]{5}",
        "action": "redact"
      }
    ]
  }
}