Rules and models

Available rule and model IDs for Injection, DLP, PII, and Threat scans.

Use these IDs in config.gates.rules and config.gates.models. Rule switches select individual checks; model switches control the detector that runs them. Both the detector and its analysis level must be enabled for a rule to run.

Unspecified switches use the service defaults. Setting one rule to true does not disable the other rules. Model switches allow a detector to run; they do not force execution or override max_level.

Example

Keep PII analysis enabled but skip email detection:

{
  "text": "Text to inspect",
  "config": {
    "categories": ["pii"],
    "max_level": "L1",
    "gates": {
      "models": {"native:pii": true},
      "rules": {"pii_email": false}
    }
  }
}

For the request format and field limits, see configuration.

Models

These are execution-gate IDs, not a choice of chat provider. Native detectors run at L1; learned classifiers run at L2 or L3. Availability and escalation still depend on the service pipeline.

L1 detectors

All model gates default to allowed. Individual rule defaults still apply: enabling a DLP model does not turn on its disabled-by-default rules.

Model ID	Category	Controls
`native:injection_l1`	Injection	All Injection L1 checks; must also be enabled for the individual Injection detectors below.
`native:injection_rule_catalog`	Injection	Catalog-based Injection rules.
`native:injection_structural`	Injection	Instruction overrides linked to sensitive disclosure.
`native:agentic_control_abuse`	Injection	Abuse of agent controls.
`native:authority_escalation`	Injection	Claims of elevated authority.
`native:binary_smuggling`	Injection	Instructions concealed in binary representations.
`native:covert_instruction`	Injection	Covert execution instructions.
`native:cross_tool_instruction`	Injection	Instructions crossing tool boundaries.
`native:encoded_instruction`	Injection	Encoded instructions.
`native:guardrail_tamper`	Injection	Tampering with safety controls.
`native:hidden_html_instruction`	Injection	Instructions hidden in HTML.
`native:instruction_boundary`	Injection	Instruction boundary manipulation.
`native:instruction_leak`	Injection	Disclosure of hidden instructions.
`native:instruction_override`	Injection	Overrides of existing instructions.
`native:jailbreak_framing`	Injection	Jailbreak framing.
`native:multi_turn_escalation`	Injection	Escalation across turns.
`native:output_manipulation`	Injection	Forced or manipulated output.
`native:tool_call_injection`	Injection	Injected tool calls.
`native:tool_output_instruction`	Injection	Instructions embedded in tool output.
`native:unicode_confusable`	Injection	Visually confusable Unicode characters.
`native:zero_width_obfuscation`	Injection	Obfuscation using zero-width characters.
`native:dlp`	DLP	Credential and sensitive-content pattern rules.
`native:sensitive_material`	DLP	Sensitive-material relationships.
`native:secret_transfer`	DLP	Transfers of secrets.
`native:mcp_runtime_risk`	DLP	MCP runtime risks.
`native:mcp_policy`	DLP	MCP policy risks.
`native:destructive_operation`	DLP	Destructive operations.
`native:pii`	PII	Personal-data pattern rules.

L2 classifiers

Each classifier has two gate keys. Both must be allowed; setting either one to false disables that classifier. Omitted keys remain allowed.

Model gate keys	Category	Controls
`injection`, `wolf-defender-small`	Injection	Injection classification at L2.
`threat`, `unified-v3-threat`	Threat	Threat classification at L2.

L3 classifier

Model ID	Categories	Controls
`unified-multitask-model-augmented-v3`	Injection, Threat	Shared L3 classification, when selected by the service pipeline.

This key applies to the shared L3 classifier. It does not select the server’s L3 strategy or guarantee that this model runs. Set gates.l3 to false to disable the entire L3 level regardless of the classifier in use.

Rules

All rules below run at L1. Threat has no L1 rule catalog; its analysis requires at least L2. Disabling every available detector for a requested category can leave the scan without a result.

PII rules (39)

All 39 rules are enabled by default when the PII detector runs.

Rule ID	Detects
`pii_email`	`EMAIL`
`pii_ipv4`	`IP_ADDRESS`
`pii_ipv6_full`	`IP_ADDRESS`
`pii_ipv6_compressed`	`IP_ADDRESS`
`pii_ipv6_loopback`	`IP_ADDRESS`
`pii_phone_international`	`PHONE`
`pii_phone_de`	`PHONE`
`pii_phone_de_national_context`	`PHONE`
`pii_phone_us`	`PHONE`
`pii_mac_address`	`MAC_ADDRESS`
`pii_iban_de`	`IBAN`
`pii_iban_generic`	`IBAN`
`pii_credit_card`	`CREDITCARD`
`pii_credit_card_cvv`	`CREDITCARD_CVV`
`pii_credit_card_expiry`	`CREDITCARD_EXPIRY`
`pii_swift_bic_context`	`SWIFT_CODE`
`pii_employee_id`	`EMPLOYEE_ID`
`pii_employee_id_ocr_field`	`EMPLOYEE_ID`
`pii_employee_id_prefixed`	`EMPLOYEE_ID`
`pii_customer_id`	`CUSTOMER_ID`
`pii_patient_id`	`PATIENT_ID`
`pii_student_id`	`STUDENT_ID`
`pii_applicant_id`	`APPLICANT_ID`
`pii_username`	`USERNAME`
`pii_date_of_birth`	`DOB`
`pii_date_of_birth_written_day_first`	`DOB`
`pii_date_of_birth_written_month_first`	`DOB`
`pii_financial_account_number`	`FINANCIAL_ACCOUNT_NUMBER`
`pii_steuer_id_de`	`STEUERID`
`pii_steuernummer_de`	`TAX_NUMBER_DE`
`pii_rentenversicherung_de`	`SOCIALID`
`pii_health_insurance_number_de`	`HEALTH_INSURANCE_NUMBER`
`pii_physician_number_lanr_de`	`PHYSICIAN_NUMBER_LANR`
`pii_passport_number_de`	`PASSPORT_NUMBER`
`pii_identity_card_number_de`	`IDENTITY_CARD_NUMBER`
`pii_driver_license_number_de`	`DRIVER_LICENSE_NUMBER`
`pii_kfz_kennzeichen_de`	`LICENSEPLATE`
`pii_ssn_us`	`SSN`
`pii_ni_uk`	`NATIONALID`

DLP regex rules (59)

Credentials and secrets are enabled by default. Set an optional rule to true to include business identifiers or content checks.

Rule ID	Detects	Default
`dlp_anthropic_key`	`API_KEY`	on
`dlp_openai_key`	`API_KEY`	on
`dlp_openai_legacy`	`API_KEY`	on
`dlp_openai_svc`	`API_KEY`	on
`dlp_huggingface`	`API_KEY`	on
`dlp_groq_key`	`API_KEY`	on
`dlp_xai_key`	`API_KEY`	on
`dlp_replicate`	`API_KEY`	on
`dlp_aws_access_key`	`CLOUD_KEY`	on
`dlp_aws_secret_key`	`CLOUD_KEY`	on
`dlp_google_api_key`	`CLOUD_KEY`	on
`dlp_google_oauth_token`	`CLOUD_KEY`	on
`dlp_gcp_client_secret`	`CLOUD_KEY`	on
`dlp_github_token`	`SECRET_TOKEN`	on
`dlp_github_pat`	`SECRET_TOKEN`	on
`dlp_gitlab_pat`	`SECRET_TOKEN`	on
`dlp_npm_token`	`SECRET_TOKEN`	on
`dlp_stripe_key`	`PAYMENT_KEY`	on
`dlp_stripe_webhook`	`PAYMENT_KEY`	on
`dlp_slack_token`	`SECRET_TOKEN`	on
`dlp_discord_token`	`SECRET_TOKEN`	on
`dlp_eth_private_key`	`CRYPTO_KEY`	on
`dlp_btc_wif`	`CRYPTO_KEY`	on
`dlp_private_key_block`	`PRIVATE_KEY`	on
`dlp_private_key_header`	`PRIVATE_KEY`	on
`dlp_jwt_token`	`SECRET_TOKEN`	on
`dlp_credential_in_url`	`CREDENTIAL`	on
`dlp_env_var_secret`	`CREDENTIAL`	on
`dlp_password_assignment`	`CREDENTIAL`	on
`dlp_generic_credential_assignment`	`CREDENTIAL`	on
`dlp_bearer_token`	`SECRET_TOKEN`	on
`dlp_basic_auth`	`CREDENTIAL`	on
`dlp_signed_url_signature`	`CREDENTIAL`	on
`dlp_session_cookie`	`CREDENTIAL`	on
`dlp_csrf_token`	`SECRET_TOKEN`	on
`dlp_password_hash`	`PASSWORD_HASH`	on
`dlp_url_userinfo_password`	`CREDENTIAL`	on
`dlp_de_vat_id`	`dlp.de.vat_id`	off
`dlp_de_commercial_register_number`	`dlp.de.commercial_register_number`	off
`dlp_de_facility_number_bsnr`	`dlp.de.facility_number_bsnr`	off
`dlp_record_case_id`	`dlp.record.case_id`	off
`dlp_record_contract_id`	`dlp.record.contract_id`	off
`dlp_record_claim_id`	`dlp.record.claim_id`	off
`dlp_record_order_id`	`dlp.record.order_id`	off
`dlp_record_invoice_id`	`dlp.record.invoice_id`	off
`dlp_project_id`	`dlp.project_id`	off
`dlp_organization_id`	`dlp.organization_id`	off
`dlp_internal_business_metric`	`dlp.internal.business_metric`	off
`dlp_database_dump_insert`	`dlp.content.database_dump`	off
`dlp_source_code_fence`	`dlp.content.source_code`	off
`dlp_source_code_statement`	`dlp.content.source_code`	off
`dlp_source_code_python_rust_assignment`	`dlp.content.source_code`	off
`dlp_source_code_declaration`	`dlp.content.source_code`	off
`dlp_source_code_import`	`dlp.content.source_code`	off
`dlp_sql_statement`	`dlp.content.sql`	off
`dlp_sql_multiline_statement`	`dlp.content.sql`	off
`dlp_database_dump_header`	`dlp.content.database_dump`	off
`dlp_stacktrace_block`	`dlp.content.system_log`	off
`dlp_structured_system_log`	`dlp.content.system_log`	off

DLP relationship rules (5)

These checks detect relationships between actions and sensitive data or tool operations. Both the rule and the associated model must be allowed.

Rule ID	Model ID	Default
`dlp_sensitive_material`	`native:sensitive_material`	on
`dlp_secret_transfer`	`native:secret_transfer`	on
`dlp_mcp_runtime_risk`	`native:mcp_runtime_risk`	off
`dlp_mcp_policy`	`native:mcp_policy`	off
`dlp_destructive_operation`	`native:destructive_operation`	off

Injection rules (42)

All 42 rule gates are enabled by default.

Rule ID	Checks for
`ark.injection.agentic.control_abuse`	Agentic control abuse.
`ark.injection.authority.claim`	Claim to be developer/admin
`ark.injection.authority.escalation`	Authority escalation.
`ark.injection.authority.fake_system_asset_transfer`	Uses a fake system or administrator authority marker to mandate a concrete crypto-asset transfer
`ark.injection.boundary.delimited_replacement_action`	Uses a synthetic delimiter boundary before a replacement instruction and action
`ark.injection.boundary.delimiter`	Instruction boundary.
`ark.injection.boundary.fake_system`	Fake system prompt injection
`ark.injection.covert.execution`	Covert instruction.
`ark.injection.cross_tool.override_action`	Cross tool instruction.
`ark.injection.escalation.multi_turn`	Multi turn escalation.
`ark.injection.exfil.external_sink`	Send data to external URL/email
`ark.injection.exfil.sensitive_path_external_sink_audited`	Reads a sensitive credential path and transfers it to an explicit external network destination
`ark.injection.exfil.sensitive_path_to_sink`	Reads a sensitive credential path and directs its contents to an output or transfer sink
`ark.injection.guardrail.tamper`	Guardrail tamper.
`ark.injection.identity.reassign`	Identity reassignment
`ark.injection.jailbreak.dual_response`	Dual response mode (classic DAN pattern)
`ark.injection.jailbreak.framing`	Jailbreak framing.
`ark.injection.jailbreak.game_framing`	Game-based jailbreak opening
`ark.injection.jailbreak.named_mode`	Known jailbreak persona names
`ark.injection.jailbreak.remove_constraints`	Bypass restrictions/safety
`ark.injection.leak.hidden_instructions`	Instruction leak.
`ark.injection.leak.system_instructions`	Request to reveal system prompt
`ark.injection.leak.system_prompt_extraction`	Directly requests disclosure of the assistant’s system or initialization instructions
`ark.injection.obfuscation.binary_smuggling`	Binary smuggling.
`ark.injection.obfuscation.decode_request`	Encoded message decode request
`ark.injection.obfuscation.decode_then_execute`	Directs the model to decode an encoded payload and execute or follow it
`ark.injection.obfuscation.encoded_instruction`	Encoded instruction.
`ark.injection.obfuscation.hidden_html`	Hidden html instruction.
`ark.injection.obfuscation.steganographic`	Acrostic/steganographic instruction
`ark.injection.obfuscation.unicode_confusable`	Unicode confusable.
`ark.injection.obfuscation.zero_width`	Zero width obfuscation.
`ark.injection.output.forced_marker`	Output manipulation.
`ark.injection.output.ignore_then_fixed_output`	Overrides surrounding instructions and restricts the response to attacker-chosen output
`ark.injection.override.authority_issued_replacement`	Claims that an authority issued replacement instructions and demands an action
`ark.injection.override.discard_prior`	Ignore previous instructions pattern
`ark.injection.override.hierarchy`	Instruction override.
`ark.injection.override.hierarchy_then_direct_action`	Discards an instruction-hierarchy constraint and immediately requests a replacement action
`ark.injection.override.obfuscated_discard`	Ignore what I said before (incl. typos)
`ark.injection.override.replacement_directive`	New instructions declaration
`ark.injection.structure.override_sensitive_disclosure`	Structural override plus sensitive-disclosure relationship.
`ark.injection.tool_call.injected`	Tool call injection.
`ark.injection.tool_output.override`	Tool output instruction.