Rule Categories
Command Validation
61 rules that block destructive shell commands before execution.
Prompt Injection
20 rules that detect attempts to hijack AI agent behavior.
Secret Detection
15 rules that prevent credentials and secrets from leaking.
How Rules Work
Rules are pattern-based checks evaluated as Claude Code hooks on LLM requests and responses. When a rule matches:- The action is blocked or flagged based on severity
- A security event is logged
- The event appears in your dashboard under Monitor > Events
- Claude Code receives feedback indicating the action was blocked
Rule Severity
Rules are classified by severity, which determines the response:| Severity | Description |
|---|---|
| Critical | Immediate threat — data destruction, system compromise. Blocked. |
| High | Significant risk — credential exposure, unauthorized access. Blocked. |
| Medium | Moderate risk — potentially unsafe operations. Warning issued. |
| Low | Minor risk — best practice violations. Warning issued. |
Managing Rules
In the dashboard, go to Rules Engine > Guard to:- View all rules — See every rule with its category, severity, and enabled status
- Enable/disable rules — Toggle individual rules on or off
- Create custom rules — Add organization-specific rules using the custom rule wizard