adk_guardrail/
lib.rs

1//! # adk-guardrail
2//!
3//! Guardrails framework for validating agent inputs and outputs.
4//!
5//! ## Overview
6//!
7//! Guardrails run in parallel with agent execution and can:
8//! - Block harmful or off-topic content
9//! - Enforce output schemas
10//! - Redact PII (emails, phones, SSNs)
11//! - Limit costs and token usage
12//!
13//! ## Quick Start
14//!
15//! ```rust,ignore
16//! use adk_guardrail::{GuardrailSet, ContentFilter, PiiRedactor};
17//!
18//! let input_guardrails = GuardrailSet::new()
19//!     .with(ContentFilter::harmful_content())
20//!     .with(PiiRedactor::new());
21//!
22//! let agent = LlmAgentBuilder::new("assistant")
23//!     .input_guardrails(input_guardrails)
24//!     .build()?;
25//! ```
26
27//! ## Tool Guardrails
28//!
29//! [`Guardrail`] validates [`Content`](adk_core::Content) — a user message or a model response —
30//! and never sees a tool call. [`ToolConfirmationPolicy`](adk_core::ToolConfirmationPolicy)
31//! decides per tool *name*. Neither can express "this tool may run, but not with these
32//! arguments".
33//!
34//! [`ToolGuardrail`] receives the tool name and the arguments before the tool executes, and may
35//! allow, deny, or narrow them:
36//!
37//! ```rust,ignore
38//! use adk_guardrail::{PathAllowList, ToolGuardrailSet};
39//!
40//! let tool_guardrails = ToolGuardrailSet::new().with(
41//!     PathAllowList::new("agents-only", ["path"], ["/Users/me/Library/LaunchAgents"])
42//!         .on_tools(["plist_write"]),
43//! );
44//!
45//! let agent = LlmAgentBuilder::new("ops")
46//!     .tool_guardrails(tool_guardrails)
47//!     .build()?;
48//! ```
49//!
50//! Guardrails run in order and revisions compose, so a later guardrail sees what an earlier one
51//! produced. The first denial stops evaluation, and a denial is reported to the model as the
52//! tool's result so it can correct the call rather than the run stalling.
53//!
54//! Two implementations ship: [`DeniedArgumentPattern`] refuses calls whose serialized arguments
55//! match a regular expression, and [`PathAllowList`] confines path-valued arguments to a set of
56//! roots — comparing by path component, resolving each existing component to reject symlink
57//! escapes, and refusing any path with a `..` component. It is a preflight check; filesystem tools
58//! exposed across a hostile local trust boundary still need platform secure-open primitives to
59//! eliminate time-of-check/time-of-use races.
60
61pub mod content;
62pub mod error;
63pub mod executor;
64pub mod pii;
65#[cfg(feature = "schema")]
66pub mod schema;
67pub mod tool;
68pub mod traits;
69
70pub use content::{ContentFilter, ContentFilterConfig};
71pub use error::{GuardrailError, Result};
72pub use executor::{GuardrailExecutor, GuardrailSet};
73pub use pii::{PiiRedactor, PiiType};
74#[cfg(feature = "schema")]
75pub use schema::SchemaValidator;
76pub use tool::{
77    DeniedArgumentPattern, PathAllowList, ToolCallDecision, ToolGuardrail, ToolGuardrailResult,
78    ToolGuardrailSet,
79};
80pub use traits::{Guardrail, GuardrailResult, Severity};
adk_guardrail/lib.rs

adk_guardrail/
lib.rs
