airblackbox/guardrails.yaml at main · airblackbox/airblackbox · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
## AIR Blackbox Gateway — Guardrails Configuration
## Copy this file and set GUARDRAILS_CONFIG to enable agent safety detection.
##
## When a guardrail triggers, the gateway returns HTTP 429 with a
## structured error instead of forwarding to the LLM provider.

budgets:
  max_session_tokens: 80000
  max_session_cost_usd: 25

loop_detection:
  similar_prompt_threshold: 0.80
  max_similar_prompts: 5
  window_seconds: 60

tool_protection:
  max_repeat_calls: 3
  repeat_window_seconds: 30

retry_protection:
  max_consecutive_errors: 3

alerts:
  webhook_url: ""  # Slack incoming webhook URL

actions:
  on_trigger:
    - terminate_session
    - block_tool_execution
    - alert_webhook
    - save_replay

## --- Prevention Layer ---
## Runs BEFORE detection. Modifies requests to enforce policies before they
## reach the LLM provider. Prevention returns 403, detection returns 429.
prevention:
  tools:
    enabled: true
    allowlist: []         # empty = allow all (use blocklist instead)
    blocklist:
      - execute_dangerous_command
      - delete_all_data

  pii:
    enabled: true
    block_ssn: true
    block_cc: true
    block_email: false
    block_phone: false
    redact_mode: "redact"  # "block" = reject request, "redact" = replace with [SSN] etc.

  model_limits:
    enabled: false
    cost_per_mtoken:
      "gpt-4o": 0.0025
      "gpt-4o-mini": 0.00015
      "gpt-4": 0.03
      "gpt-3.5-turbo": 0.0005
    cost_threshold_usd: 10.0
    downgrade_map:
      "gpt-4": "gpt-3.5-turbo"
      "gpt-4o": "gpt-4o-mini"

  approval:
    enabled: false
    webhook_url: ""
    timeout_seconds: 30
    rules:
      - token_budget
      - prompt_loop
    fallback_allow: true


## --- Optimization Layer ---
## Aggregates per-model performance metrics, classifies failures, and
## auto-routes requests to better models when one is struggling.
optimization:
  analytics:
    enabled: true          # enable /v1/analytics endpoint + metrics tracking

  router:
    enabled: false          # set true to activate automatic model routing
    rules:
      - from_model: "gpt-4"
        to_model: "gpt-4o"
        condition: "error_rate"
        threshold: 0.20     # route when error rate exceeds 20%
        enabled: true

      - from_model: "gpt-4"
        to_model: "gpt-4o"
        condition: "latency_p95"
        threshold: 10000    # route when p95 latency exceeds 10s
        enabled: true


## --- Trust Layer ---
## Cryptographic audit chain, compliance reporting, and evidence export.
## Turns AIR records into tamper-proof, regulator-ready evidence packages.
trust:
  enabled: true
  signing_key: ""  # set via TRUST_SIGNING_KEY env var (HMAC-SHA256 key)
  compliance:
    frameworks:
      - SOC2
      - ISO27001


## --- Telemetry Layer ---
## Controls what anonymized scan metadata leaves this environment.
## This is the data flywheel: crowd-sourced metadata improves the compliance
## model for everyone. Enterprise can opt out completely.
##
## Modes:
##   crowd_source  — Anonymized metadata sent to telemetry.airblackbox.ai (default for free tier)
##   private       — Metadata stays local, but you get benchmarking dashboard access (pro tier)
##   air_gapped    — Nothing leaves this network. Full isolation. (enterprise tier)
##
## What IS sent (crowd_source mode):
##   - Framework detected (LangChain, CrewAI, AutoGen, etc.)
##   - Article pass/fail/warn scores per scan
##   - File count and language breakdown
##   - Model provider (OpenAI, Anthropic, etc.) and token counts
##   - Error patterns and fix adoption rates
##
## What is NEVER sent (any mode):
##   - Source code, file contents, or file paths
##   - Prompts, completions, or conversation content
##   - API keys, credentials, or environment variables
##   - Repository URLs, company names, or user identities
##
telemetry:
  mode: "crowd_source"  # crowd_source | private | air_gapped
  endpoint: "telemetry.airblackbox.ai:4317"  # OTel collector endpoint
  batch_size: 50         # buffer this many scan results before sending
  flush_interval: 300    # seconds between flushes (5 min default)
  include_model_metrics: true   # token counts, latency, error rates
  include_framework_detection: true  # which frameworks detected
  include_article_scores: true  # per-article pass/fail/warn