Standard Entity Rules

Standard Entity Rules detect sensitive data in tool call arguments, such as emails, SSNs, and credit card numbers. Each entity has a detector and an action.

Configure them at Security → PII detection, grouped into Global sensitive data types and US sensitive data types.

Entity rule settings

Column	What it does
Entity type	The detector, such as `US_SSN`
Detection method	`Pattern match`, `Pattern match and NLP`, or `Pattern match, NLP and checksum`. Pattern entities are precise. NLP entities can fire on ordinary prose.
Pre-run action	Log, Redact, or Block. See actions.
Enabled	Turns the entity on or off for this region

Entity rules scan only tool arguments. To screen tool results, use an AI Guardrail.

Entity catalog

Entity	Detects	Region
PERSON	Person names (NLP, can fire on common words)
EMAIL_ADDRESS	Email addresses
PHONE_NUMBER	Phone numbers
LOCATION	Cities, countries, addresses (NLP)
NRP	Nationality, religion, political group (NLP)
DATE_TIME	Dates and times. Consider turning off, since most tool calls contain dates.
US_SSN	Social Security Numbers	US
US_ITIN	Individual Taxpayer Identification Numbers	US
US_PASSPORT	Passport numbers	US
US_DRIVER_LICENSE	Driver’s license numbers	US
US_BANK_NUMBER	Bank account and routing numbers	US
IBAN_CODE	International Bank Account Numbers	Global
CREDIT_CARD	Card numbers, Luhn-validated
CRYPTO	Crypto wallet addresses
MEDICAL_LICENSE	US medical license and DEA numbers
IP_ADDRESS	IPv4 and IPv6 addresses
URL	URLs. Often fires on internal slugs, so most organizations use Log or turn it off.

Override for one Tool Pack

On a Tool Pack’s Rules tab, pick an entity and an action. The override wins for that pack. Examples:

Block credit cards everywhere, Log them on a finance pack
Block government IDs everywhere except the payroll pack

Roll out a rule

Check a sample in the Guardrail tester.
Set the rule to Log for a week and review Violations and alerts.
Switch to Redact or Block.

For identifiers not in the catalog, use Custom Regex Rules.