Infrastructure · Verification
OutputGuard
Final egress filter for safety and privacy
Definition
Mechanism
Post-generation content filter. Scans candidate Solution against PII patterns and Toxicity Classifiers. If Score > Threshold, triggers mitigation (Redact/Reject). It mirrors the logic of input guard but applied to egress traffic, scanning for leakage or toxicity.
Preconditions
- Candidate solution generated
- Safety policies active
Postconditions
- Safe output delivered OR Block signal returned
Invariants
- Fail-Safe: If Scanner fails (timeout/error), Output is BLOCKED (not passed).
- Privacy First: detected PII must not reach egress unmitigated. Which mitigation applies — redaction, blocking, or hashing — is the caller's `pii_mode` choice; what is mandatory is that one of them runs, since blocking is stronger than redaction where the content cannot be safely salvaged.
Risks
Failure modes
Scunthorpe {{problem}}
Over-censorship blocking valid words containing restricted substrings.
Semantic context blindness
Guard blocks necessary medical terms misclassified as toxicity.
Redaction Leak
[REDACTED] markers revealing the location/length of hidden secrets.
Relationships
Builds on
Accepts
The fractal unit of completed work
References
A state gap with a cost of inaction
Used by
Composes with
Society
Isolate agent execution with resource limits and egress controls
References
Default-deny policy for uncertain states
Reference
Parameters
pii_modeEnum, {Redact, Block, Hash}- Default: Redact
scan_timeoutDuration, unspecified- Default: 500ms
toxicity_thresholdFloat, [0.0, 1.0]- Default: 0.8