Skip to main content

​
What are Custom Guardrails?

Custom guardrails allow you to define domain-specific rules and detection patterns beyond the built-in security controls. While standard guardrails protect against general threats like prompt injection and data leakage, custom guardrails enable you to enforce business logic, regulatory compliance, and industry-specific requirements. Custom guardrails are essential when you need to:
  • Enforce industry regulations (financial advice, medical guidance, legal counsel)
  • Detect domain-specific violations (unauthorized trading advice, prescription recommendations)
  • Implement business rules (brand voice, competitor mentions, pricing policies)
  • Protect specialized workflows (code review standards, documentation requirements)

​
Industry Examples

  • Financial Services
  • Healthcare
  • Brand Voice
  • Code Quality
Prevents unauthorized investment advice that violates SEC regulations and creates legal liability.

​
What It Detects

Violation TypeExamplesAction
Investment Recommendations”Buy $AAPL”, “I recommend selling”BLOCK
Forward-Looking Statements”Stock will rise 20%”, “Guaranteed returns”BLOCK
Trading Strategies”You should invest in”, “Safe investment”BLOCK
Educational ContentGeneral market informationWARN

​
Real-World Example

User Input:
"Should I invest in Apple stock?"
Without Guardrails:
AI: "Yes, Apple (AAPL) is a strong buy right now. 
     The stock price is expected to rise 20% in the next quarter. 
     I recommend buying at least 100 shares."
With Guardrails:
  1. Detects ticker symbol: $AAPL
  2. Identifies recommendation language: “I recommend buying”
  3. Flags forward-looking statement: “expected to rise 20%”
  4. Classification: Financial Advice (confidence: 0.94)
  5. Action: BLOCK
  6. Response: “I cannot provide specific investment advice. Please consult with a licensed financial advisor.”

​
Configuration

{
  "guardrail": {
    "name": "financial_advice_prevention",
    "type": "custom",
    "detection": {
      "patterns": [
        {
          "regex": "\\$(?:[A-Z]{1,5}|\\d+)\\b",
          "name": "ticker_symbol"
        },
        {
          "keywords": [
            "you should buy",
            "I recommend selling",
            "invest in this",
            "guaranteed returns"
          ],
          "name": "investment_language"
        }
      ],
      "semantic": {
        "classifier": "financial_advice",
        "threshold": 0.85
      }
    },
    "enforcement": {
      "action": "BLOCK",
      "message": "I cannot provide specific investment advice. Please consult with a licensed financial advisor."
    }
  }
}

​
Building Custom Guardrails

1

Define Requirements

Identify what you need to detect:
  • What content violates your policies?
  • What context matters?
  • What actions should be taken?
2

Choose Detection Methods

Select appropriate techniques:
  • Pattern matching: For structured data, keywords, or known formats
  • Semantic analysis: For understanding intent and context
  • Rule-based logic: For complex business rules with multiple conditions
3

Configure Detection

Define your patterns, classifiers, and rules in the policy configuration.
4

Set Enforcement Actions

Choose how violations are handled:
  • BLOCK: Prevent request/response from proceeding
  • WARN: Log violation and sanitize content before proceeding
  • SANITIZE: Remove violations and proceed with clean content
  • REDACT: Replace sensitive content with placeholders
5

Test and Tune

Test with real-world examples, monitor false positives, and refine based on production feedback.

​
Enforcement Actions

ActionWhen to UseBehavior
BLOCKCritical violationsPrevents request/response from proceeding, returns error
WARNMonitoring phaseLogs violation but allows content to proceed
SANITIZENon-critical issuesRemoves violations and proceeds with clean content
REDACTSensitive dataReplaces sensitive content with placeholders

​
Best Practices

Start Specific

Begin with clear, well-defined rules before expanding to broader patterns

Combine Techniques

Use pattern matching + semantic analysis for better accuracy and fewer false positives

Monitor Performance

Track detection rates, false positives, and adjust thresholds regularly

Provide Context

Include clear messages explaining why content was blocked or modified

Regular Updates

Review and update patterns as threats and requirements evolve

Document Rules

Keep clear documentation of what each guardrail protects against

​
Integration with Policies

Custom guardrails integrate seamlessly with Oximy’s policy system: 
{
  "policy": {
    "name": "financial_service_policy",
    "guardrails": [
      "data_leakage_prevention",
      "prompt_injection_defense",
      "financial_advice_prevention",
      "compliance_monitoring"
    ]
  }
}
Policy Benefits:
  • Group related guardrails together
  • Apply different guardrails to different endpoints
  • Enable/disable guardrails based on context
  • Monitor violations across guardrail types