{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/webrix/main/json-schema/webrix-guard-schema.json",
  "title": "Guard",
  "x-generated": "2026-10-19",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/_original/webrix-api-openapi.json#/components/schemas/Guard",
  "type": "object",
  "properties": {
    "id": {
      "type": "string"
    },
    "slug": {
      "type": "string"
    },
    "name": {
      "type": "string"
    },
    "description": {
      "type": [
        "string",
        "null"
      ]
    },
    "checks": {
      "type": "array",
      "items": {
        "$ref": "#/$defs/GuardCheck"
      }
    },
    "threshold": {
      "type": "number",
      "description": "Score threshold that triggers the guard action"
    },
    "action": {
      "type": "string",
      "enum": [
        "redact",
        "warn",
        "warn_user",
        "block"
      ],
      "description": "Action to take when threshold is exceeded. `redact` masks the matched text, `warn` allows the call but shows a warning, `warn_user` requires the user to approve the request before it proceeds, and `block` prevents the call entirely."
    },
    "status": {
      "type": "string",
      "enum": [
        "active",
        "draft"
      ]
    },
    "is_default": {
      "type": "boolean",
      "description": "Whether this is a built-in default guard"
    },
    "scope": {
      "type": [
        "string",
        "null"
      ],
      "enum": [
        "buildtime",
        "runtime"
      ],
      "description": "When the guard is evaluated"
    },
    "created_at": {
      "type": "string",
      "format": "date-time",
      "description": "Creation timestamp."
    },
    "org_id": {
      "type": "string",
      "format": "uuid",
      "description": "Organization this record belongs to."
    },
    "message": {
      "type": [
        "string",
        "null"
      ],
      "description": "Message shown to the user when this guard blocks or warns a call. Absent on the built-in default guards."
    },
    "settings": {
      "type": [
        "object",
        "null"
      ],
      "additionalProperties": true,
      "description": "Guard-level settings.",
      "properties": {
        "sync_checks": {
          "type": "boolean",
          "description": "Whether the guard's checks are kept in sync with their source."
        },
        "redact_fallback_action": {
          "type": "string",
          "enum": [
            "block",
            "warn",
            "allow"
          ],
          "description": "What a redact guard does when it triggers but nothing could be masked (for example when the match only exists inside encoded content). Defaults to `block`."
        }
      }
    },
    "sort_order": {
      "type": "integer",
      "description": "Position used when ordering guards for evaluation."
    },
    "updated_at": {
      "type": "string",
      "format": "date-time",
      "description": "Last modification timestamp."
    }
  },
  "$defs": {
    "GuardCheck": {
      "type": "object",
      "required": [
        "id",
        "type",
        "certainty"
      ],
      "properties": {
        "id": {
          "type": "string",
          "description": "Unique identifier for the check"
        },
        "name": {
          "type": "string",
          "description": "Display name for the check"
        },
        "type": {
          "type": "string",
          "enum": [
            "builtin",
            "regex",
            "jsonata",
            "llm"
          ],
          "description": "Type of check to perform"
        },
        "certainty": {
          "type": "number",
          "description": "Certainty score (0-10) contributed when this check matches"
        },
        "config": {
          "$ref": "#/$defs/GuardCheckConfig"
        },
        "disabled": {
          "type": "boolean",
          "description": "Whether the check is disabled"
        }
      }
    },
    "GuardCheckConfig": {
      "type": "object",
      "description": "Check-specific configuration",
      "properties": {
        "pattern": {
          "type": "string",
          "description": "Regex pattern (for regex type)"
        },
        "replacement": {
          "type": "string",
          "description": "Replacement text for redaction (for regex type)"
        },
        "expression": {
          "type": "string",
          "description": "JSONata expression (for jsonata type)"
        },
        "prompt": {
          "type": "string",
          "description": "LLM prompt (for llm type)"
        },
        "precondition_pattern": {
          "type": "string",
          "description": "Optional regex the content must match (case-insensitive) before the LLM is called (for llm type). Content that doesn't match is skipped and scores 0."
        },
        "builtin_id": {
          "type": "string",
          "description": "Built-in check identifier (for builtin type)"
        },
        "min_confidence": {
          "type": "number",
          "minimum": 0,
          "maximum": 1,
          "description": "Minimum model confidence (for the person-name-builtin check)"
        },
        "allowlist": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Spans to never report (for the person-name-builtin check)"
        }
      }
    }
  }
}