Skip to main content

Rules

A GuardrailRule has three fields:

FieldTypeDescription
namestringUnique identifier. Used in the audit log and dashboard.
descriptionstringHuman-readable explanation. Shown in Slack alerts and block messages.
conditionfunctionReturns true to trigger the rule. Can be sync or async.
action'block' | 'require_approval' | 'alert'What to do when the condition is true.

Pre-built Rules Reference​

noExternalEmail() / no_external_email()​

Blocks any send_email action where payload.to does not end with an internal domain.

Default internal domains: ['yourdomain.com']

Customize in the full SDK via the dashboard or by passing internalDomains:

Auditail.rules.noExternalEmail({ internalDomains: ['acme.com', 'acme-internal.com'] })
rules.no_external_email(internal_domains=["acme.com", "acme-internal.com"])

noDataDeletion() / no_data_deletion()​

Blocks any action where payload.query contains DELETE, DROP TABLE, or TRUNCATE.

noExternalApiCalls() / no_external_api_calls()​

Fires an alert (does not block) when action === 'http_request'.

noPiiInLogs() / no_pii_in_logs() (Python only in preview)​

Fires an alert when the payload string contains an email address or phone number pattern.

Custom Rule Example​

import type { GuardrailRule } from 'auditail-sdk';

const noWeekendActions: GuardrailRule = {
  name: 'no-weekend-actions',
  description: 'Blocked: automated actions are disabled on weekends.',
  condition: () => {
    const day = new Date().getDay();
    return day === 0 || day === 6; // Sunday = 0, Saturday = 6
  },
  action: 'block',
};