Stop secrets leaking in model output

An output binding inspects a bounded buffered response before it reaches the client. Begin in monitor mode with the ruleset detector, select the profile explicitly, then test detection and failure cases before enforcement.

guardrails:
  enabled: true
  default_profile: standard
  local_budget_ms: 50
  guards:
    - id: sec_out
      category: secrets
      phases: [output]
      detectors: [secrets.ruleset]
      mode: monitor
      action: redact
      rule_ref: POL-SEC-1
  profiles:
    standard: [sec_out]

default_profile: standard makes this binding effective for requests without another profile assignment. Defining a guard and a profile alone does not select them.

Detector	Scope
secrets.ruleset	Named provider patterns and structured credential forms
secrets.generic	Assignment-shaped credentials without a recognizable issuer
secrets.entropy	Suspicious high-entropy candidate strings

Detector versions bind changes to their rules and scan behavior. Repository fixtures are synthetic regression cases; historical measurements from an earlier scanner version are not current precision, recall or latency guarantees. Evaluate the selected versions against representative positive and benign examples.

Move from findings to enforced delivery

Change mode to enforce after checking the extracted surface, detector execution and proposed action. Choose on_error deliberately: open can release bytes when inspection fails; acknowledged closed suppresses unreleased output on protection failure. An oversize, opaque, malformed or timed-out response is not a clean result. Use the failure matrix and verify those cases with actual client bytes and stored receipts.

A successful redaction requires a complete committed transformation. The receipt should show both the mutation and what was delivered. No-finding rows without completed inspection establish no protection claim.

Streaming needs its own policy

An output binding does not silently become an incremental stream guard. The secrets detectors have no incremental matcher. The stock gateway rejects stream_fallback: buffer during activation. For unavailable incremental coverage, monitor records the gap and applies the effective mode and failure posture; acknowledged closed suppresses unreleased bytes in enforcing mode. Monitor mode preserves traffic. See the failure matrix.

Neither bounded non-streaming output inspection nor a larger local budget guarantees successful inspection for every response. Exhaustion applies the configured failure posture. When the requirement is to withhold a credential whenever protection cannot complete, verify the acknowledged closed path as well as the successful redaction path.

Credentials are not checked with their issuers; a revoked key can match just as a live key can. Tool schemas, metadata and media content remain outside this recipe’s mutation scope. See What gets inspected.