Skip to main content

Safety Filter

The safety-filter policy is a term-based safety control. It does not use a classifier or moderation service. It checks configured terms. It can also use fuzzy matching and a simple age list.

Phase and verdicts​

  • Input phase: full input check with block_if, optional fuzzy matching, and optional max_age
  • Output phase: term checks in supported buffered and streaming response paths
  • Verdicts: allow, block, escalate

Configuration​

pack:
  name: safety-filter-example-1
  version: "1.0.0"
  enabled: true

policies:
  chain:
    - safety-filter

policy:
  safety-filter:
    mode: critical_infrastructure
    block_if:
      - override safety interlock
      - disable emergency shutdown
    action: block
    fuzzy_matching: true
    max_distance: 1
    max_age: 0

Supported fields​

FieldTypeDefaultNotes
modestringcritical_infrastructurecritical_infrastructure, automotive, education, law_enforcement, government, military, hr, justice, healthcare, finance, legal, or defense.
block_ifstring[][]When non-empty, this is the active match list. Built-in defaults are used only when block_if is empty.
actionstringblockblock or escalate.
fuzzy_matchingbooleanfalseUsed by the input phase only.
max_distanceinteger1Edit-distance threshold for input fuzzy matching.
max_ageinteger0Used by the input phase only. Ages 1..17 start a simple adult-term check.

Built-in default keywords when block_if is empty​

ModeDefault terms
critical_infrastructureexplosive, weapon, attack
automotivedisable airbags, bypass brakes, tamper
educationself-harm, suicide
law_enforcementdoxx, target

Other accepted modes use the generic critical_infrastructure terms. A non-empty block_if list replaces these terms.

Important behavior notes​

  • Custom block_if values replace the default terms. The gateway does not merge the lists.
  • The input phase supports fuzzy matching and max_age checks.
  • The output path checks terms and action. It does not use the input fuzzy checks or age control.
  • max_age uses a simple keyword list (alcohol, tobacco, gambling, explicit, pornograph, drug use, substance abuse, violence, gore, profanity) rather than a classifier.
  • For SSE output, the gateway buffers assistant text before it sends the stream.
  • The SSE output path enforces only action: block. It does not enforce action: escalate.

Use stream: false when output escalation is necessary. Test each response family because an input allow result does not prove output enforcement.

Minimal correct example​

policy:
  safety-filter:
    action: block

Next steps​