> This page is for Agent Handler.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.merge.dev/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.merge.dev/_mcp/server.

# Standard Entity Rules

> Full reference for Agent Handler's Standard Entity Rules: every entity type, what it detects, the action choices, and per-tool-pack overrides.

Standard Entity Rules are pre-trained detectors for sensitive data categories - PII, payment data, government IDs, network identifiers. Each entity has a detector, a configurable confidence threshold, and an action that fires when the detector matches. This page is the per-entity reference; for the architecture, start with the [Security Gateway overview](/merge-agent-handler/secure/security-gateway).

## How detection works

Detection runs on a Presidio-based stack underneath. For each entity type, Agent Handler scans tool inputs and outputs against:

* **Pattern recognizers** - regex for things with structure (credit card numbers, SSNs, IBANs).
* **Named-entity recognizers** - NLP-based for things that don't have a clean pattern (person names, locations).
* **Context analyzers** - words near the candidate match that increase confidence ("SSN" near a 9-digit number, "@" near an email-shaped string).

Each match comes back with a confidence score from 0.0 to 1.0. Each rule has a threshold. Above the threshold, the rule's action fires; below, the match is ignored.

## Configurable per entity

For every entity type, you set:

| Setting                  | What it does                                                                                           |
| ------------------------ | ------------------------------------------------------------------------------------------------------ |
| **Enabled**              | Master switch for this entity type                                                                     |
| **Action**               | Allow / Redact / Block when the entity appears in tool arguments                                       |
| **Confidence threshold** | Lower = more recall, more false positives. Higher = more precision, more false negatives. Default 0.5. |
| **Regions**              | For region-specific entities (US SSN, EU IBAN), which regions the detector should fire in              |

Configuration lives at [Security → PII Detection](https://ah.merge.dev/security/rules).

## The three actions

Each rule fires one of three actions per direction:

* **Allow.** Match is logged as a violation; no data is altered or stopped. Use for monitoring without enforcement.
* **Redact.** Match is replaced with a placeholder (`[REDACTED:EMAIL]`, for example). The call proceeds.
* **Block.** Call is canceled. Agent receives an error indicating a security rule fired.

Allow is for visibility. Redact is the right default for most categories. Block is for categories you absolutely don't want crossing the boundary in either direction.

## Entity catalog

Agent Handler ships detectors for the categories below. Some are region-specific; the regional toggle controls whether the detector fires.

### Personal identity

| Entity             | What it detects                                                                                             |
| ------------------ | ----------------------------------------------------------------------------------------------------------- |
| **PERSON**         | Person names. NLP-based; less precise than pattern entities, more prone to false positives on common words. |
| **EMAIL\_ADDRESS** | Email addresses. High-precision regex; rarely false-positives.                                              |
| **PHONE\_NUMBER**  | Phone numbers, international and domestic. Configurable per region.                                         |
| **LOCATION**       | Cities, countries, addresses. NLP-based; can match common product names.                                    |
| **NRP**            | Nationality, religious affiliation, political group. NLP-based; useful for HR contexts.                     |
| **DATE\_TIME**     | Dates and times. Often disabled by default - most tool calls legitimately contain dates.                    |

### Government and financial IDs

| Entity                  | What it detects                               | Region              |
| ----------------------- | --------------------------------------------- | ------------------- |
| **US\_SSN**             | US Social Security Numbers                    | US                  |
| **US\_ITIN**            | US Individual Taxpayer Identification Numbers | US                  |
| **US\_PASSPORT**        | US passport numbers                           | US                  |
| **US\_DRIVER\_LICENSE** | US driver's license numbers                   | US, varies by state |
| **US\_BANK\_NUMBER**    | US bank account and routing numbers           | US                  |
| **IBAN\_CODE**          | International Bank Account Numbers            | Global, EU-heavy    |

### Payment

| Entity           | What it detects                                                                                                           |
| ---------------- | ------------------------------------------------------------------------------------------------------------------------- |
| **CREDIT\_CARD** | Credit card numbers across major networks (Visa, Mastercard, Amex, Discover, Diners, JCB). Validates with Luhn algorithm. |
| **CRYPTO**       | Cryptocurrency wallet addresses (BTC, ETH, others).                                                                       |

### Health

| Entity               | What it detects                   |
| -------------------- | --------------------------------- |
| **MEDICAL\_LICENSE** | US medical license / DEA numbers. |

### Network

| Entity          | What it detects                                                                                                      |
| --------------- | -------------------------------------------------------------------------------------------------------------------- |
| **IP\_ADDRESS** | IPv4 and IPv6 addresses.                                                                                             |
| **URL**         | URLs. Frequently false-positives on internal slugs that look like URLs; consider raising the threshold or disabling. |

## Per-tool-pack overrides

Default rules apply org-wide, and a Tool Pack's overrides are authoritative for that pack. An override can change a rule's action, add an entity the org has no rule for, or switch one off for that pack alone. Common patterns: block credit cards org-wide and allow on a payments pack; redact emails org-wide and allow on a CRM pack; block SSNs everywhere except a payroll pack; scan a support pack for an entity the rest of the organization doesn't scan for.

Configure overrides on the Tool Pack's **Rules** tab. Each override picks an entity and an action.

## Choosing thresholds

The default 0.5 confidence threshold works well for high-precision entities (CREDIT\_CARD, EMAIL\_ADDRESS, IBAN\_CODE) and is too aggressive for fuzzy entities (PERSON, LOCATION, URL).

If a rule is firing on legitimate traffic, raise its threshold. If a rule is missing data you'd expect it to catch, lower it.

The [Rule Tester](/merge-agent-handler/secure/rule-tester) lets you paste a sample input and see exactly which entities and confidences come back. Use it to dial in thresholds before deploying changes.

For anything the standard catalog doesn't cover - internal customer IDs, project codes, employee numbers - use [Custom Regex Rules](/merge-agent-handler/secure/custom-regex-rules) instead.

## Next

Detect anything the standard catalog doesn't cover with [Custom Regex Rules](/merge-agent-handler/secure/custom-regex-rules).