Research Agent Guardrails #522

Activity

1. sahilds1

   moved this to Backlog in Balanceron Jul 15, 2026
2. sahilds1

   added this to Balanceron Jul 15, 2026
3. sahilds1

   self-assigned this

   on Jul 15, 2026
4. sahilds1

   added

   BugSomething isn't workingSomething isn't working

   on Jul 15, 2026
5. sahilds1

   moved this from Backlog to In Progress in Balanceron Jul 15, 2026
6. sahilds1

   assigned

   snaeem3

   and unassigned

   sahilds1

   on Aug 17, 2026
7. mahirhir commented on Aug 27, 2026

   

   mahirhir

   on Aug 27, 2026

   More actions

   For structuring the agent guardrails and sanitizer pipeline in server/api/views/assistant/sanitizer.py:

   1. Layered Sanitization Pipeline:

      • Stage 1 (O(1) Structural Injection Pre-filter):
        Strip instruction-override tags and block common prompt-injection syntax before context assembly:

        import re
        from typing import Tuple
        
        INJECTION_PATTERNS = [
            r"(?i)\bignore\s+(all\s+)?(previous|prior)\s+instructions\b",
            r"(?i)\bsystem\s*:\s*override\b",
            r"(?i)\byou\s+are\s+now\s+in\s+developer\s+mode\b"
        ]
        
        def prefilter_user_input(text: str) -> Tuple[bool, str]:
            for pattern in INJECTION_PATTERNS:
                if re.search(pattern, text):
                    return False, "Input flagged by injection guardrail."
            return True, text

      • Stage 2 (PII Redaction):
        Replace emails, phone numbers, and identifying tokens with deterministic placeholders ([REDACTED_EMAIL], [REDACTED_PHONE]) before storing or sending to the LLM.
      • Stage 3 (Async Moderation Gate):
        Evaluate openai.moderations.create in parallel with vector retrieval, aborting immediately if safety thresholds are violated.

   2. Pre-flight Tool Execution Validation:

      • Validate tool invocation arguments against strict Pydantic models before executing backend database queries or calculations.

   We use this layered data-sanitization and schema-enforced tool receipt pattern in https://github.com/TraceFold/tracefold (architecture in docs/TRACEFOLD_TR.md §4.1) for production agent safety.