Custom Regex Rules

Custom Regex Rules catch identifiers that Standard Entity Rules don’t cover, such as customer IDs, project codes, or employee numbers.

Create a rule

Open Security → PII detection and click Add rule on the custom rules card.

Field	What it does
Rule	Name shown in Alerts and the Audit trail
Describe the pattern	Optional. Describe the match in plain English and Generate writes the regex. Shown once guardrails are enabled.
Regex	Pattern matched against tool arguments
Context keywords	Optional. Words near a match that raise confidence.
Pre-run action	Log, Redact, or Block

Examples

Rule:      Customer IDs
Regex:     \bCUST-\d{5}\b
Keywords:  customer, account
Action:    Redact

Rule:      Internal email
Regex:     [\w._%+-]+@acme-internal\.com\b
Keywords:  (none)
Action:    Block

Rule:      Project codes
Regex:     \bP-[A-Z0-9]{4}\b
Keywords:  project, milestone, sprint
Action:    Redact

With keywords, the P-A1B2 project is on track matches but a bare P-A1B2 in unrelated text does not.

Context keywords

Workforce looks about 50 characters either side of a match for a keyword. Each keyword found raises confidence, and the action fires once it clears the threshold. Add keywords when the pattern alone is too loose. Avoid generic ones such as “id” or “number”.

Regex doesn’t validate checksums like Luhn, so pair loose patterns with keywords.

Roll out a rule

In the Guardrail tester, confirm it catches one sample and ignores another.
Set the action to Log for a week and review Violations and alerts.
Switch to Redact or Block.

To change the action or turn a rule off for one Tool Pack, use the pack’s Rules tab. For topics with no pattern, use AI Guardrails.