Enum OutputSanitization 

pub enum OutputSanitization {
    None,
    SanitizeTokens,
    Quarantine,
    SanitizeTagged(&'static str),
    SanitizeWithNotice {
        tag: &'static str,
        notice: &'static str,
    },
}

Automatic prompt-injection sanitization policy applied to tool outputs.

Secure by default: the default is OutputSanitization::SanitizeTokens. Raw, unmodified output requires an explicit opt-out.

Configure it on a tool via:

• #[llm_tool(quarantine)] / #[llm_tool(sanitize = "tag")] for stronger envelopes
• #[llm_tool(sanitization = "none")] (or sanitize = false) to opt out
• RustTool::OUTPUT_SANITIZATION on manual impls

ToolRegistry::with_output_floor enforces a registry-wide minimum (also SanitizeTokens by default), so a single tool that opts out still gets the floor unless the registry floor is lowered too.

Or on individual return values / struct fields via Sanitized<T> and Untrusted<T> (Quarantined<T>).

Variants

None

Do not modify the tool output. Must be chosen explicitly.

SanitizeTokens

Neutralize all known LLM control/turn/tool delimiters (DELIMITER_RULES) and breakout tags in-place without adding outer XML boundary tags (already-valid boundary envelopes are preserved unchanged). This is the default.

Quarantine

Neutralize all known LLM control/turn/tool delimiters (DELIMITER_RULES) and idempotently wrap the output in a <tool_output_quarantine> XML envelope via quarantine_tool_output.

SanitizeTagged(&'static str)

Neutralize control delimiters and wrap output in a <tag> boundary envelope with the default boundary notice.

SanitizeWithNotice

Neutralize control delimiters and wrap output in a <tag> boundary envelope with a custom boundary notice.

Fields

tag: &'static str

notice: &'static str

Implementations

impl OutputSanitization

pub const fn at_least(self, floor: Self) -> Self

Return the more protective of self and floor.

Ties keep self, so a tool’s own envelope (e.g. a custom tag) is never replaced by an equally strong floor.

pub const fn is_none(&self) -> bool

Returns true if the policy is OutputSanitization::None.

pub const fn sanitizes_tokens(self) -> bool

Returns true if this policy neutralizes control tokens.

pub const fn is_quarantined(self) -> bool

Returns true if this policy wraps output in an XML boundary envelope.

pub fn apply_str(self, raw: &str) -> Cow<'_, str>

Apply this sanitization policy to a string slice, returning a borrowed Cow when no modification is needed.

Panics

Panics if a tagged sanitization policy was configured with a tag that is not a valid ASCII XML NCName.

pub fn apply(self, output: ToolOutput) -> ToolOutput

Apply this sanitization policy to a ToolOutput.

Trait Implementations

impl Clone for OutputSanitization

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for OutputSanitization

impl Debug for OutputSanitization

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for OutputSanitization

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for OutputSanitization

fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>

where D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for OutputSanitization

impl Hash for OutputSanitization

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl JsonSchema for OutputSanitization

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl PartialEq for OutputSanitization

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for OutputSanitization

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for OutputSanitization