Define the pre/post guardrail pipeline input contract

The accepted input remains: user text, policy rules, model adapter. Keep parsing and normalization in functions that do not score, train, or call a model. That split lets a test fail the boundary without blaming the core logic. The user-facing decision stays: block unsafe prompts and strip or refuse unsafe completions before they reach users.

from dataclasses import dataclass
@dataclass(frozen=True)
class GuardDecision:
    action: str  # allow|block|refuse
    rule_id: str
print(GuardDecision('block','pii-email'))

Expected evidence: guard decision contract. If the contract is silent on a bad value, later debugging will look like an algorithm bug when it is really a data bug.

Write one assertion for a neighboring valid input to the pre/post guardrail pipeline so tightening the boundary does not over-reject. Document field names and types the way a teammate would need them on day two of guardrails-in-code—not as comments you plan to delete.

List every field in policy with PII and self-harm categories + sample prompts and mark each as required, optional, or forbidden. Required fields must fail loudly when missing; optional fields need defaults you can quote in a test; forbidden fields (secrets, raw PII, path escapes) must never be accepted silently. This list is the contract for the pre/post guardrail pipeline.

Add one sentence about encoding, units, or timezones if relevant to user text, policy rules, model adapter. Contracts that ignore units create “correct” programs that still ship wrong decisions when someone tries to block unsafe prompts and strip or refuse unsafe completions before they reach users.

Write the error string you want for the most likely bad input. Prefer ValueError('threshold out of range')-style messages over generic invalid input. The contract’s job is to make post-guard only that still bills the model for blocked intents, or regex gaps on obfuscation harder to confuse with a model or algorithm bug later.

At the data contract stage for guardrails-in-code, the job is narrower than finishing a product demo. You are creating one progressive evidence piece about policy with PII and self-harm categories + sample prompts that later pages inherit without redefining success. Keep that fixture small enough to inspect by hand, keep outputs copy-pasteable as text, and refuse to narrate this baseline as if it were a production SLA: model call with no guards on the same fixtures.

For this page specifically, success looks like malformed inputs rejected with field-named errors while still centering the user decision to block unsafe prompts and strip or refuse unsafe completions before they reach users. If you cannot point to a file, command, or assertion that proves that for the pre/post guardrail pipeline, stay on this page instead of advancing.

Cheatsheet: prompt injection defense

Previous · Next