Content Policy Profiles
Content policy profiles are reusable rules for sensitive AI traffic. Runtime enforcement evaluates configured literal or regex terms against the normalized conversation and tool arguments in memory; the resulting telemetry and evidence remain promptless. Profiles can be bound to many subjects or routes through policy bindings.
Use Cases
- Restricted project names.
- Secrets and credential handling.
- Customer or counterparty watchlists.
- Payment instruction handling.
- Claims escalation categories.
- Research restrictions and disclosure controls.
API Surface
GET /api/v1/llm/content_policy_profiles
PUT /api/v1/llm/content_policy_profiles
GET /api/v1/llm/content_policy_profiles/{profile_uuid}
DELETE /api/v1/llm/content_policy_profiles/{profile_uuid}Profiles can be evaluated directly through policy simulation records, or enforced when a matching policy binding applies to the request.
Profile Design
Profiles are intentionally reusable. A profile should describe a business rule or risk category rather than one caller or one model route. For example, one profile can represent restricted research projects, another can represent payment instructions, and another can represent credential handling.
Typical profile inputs include:
| Input | Use |
|---|---|
| Terms and categories | Identify configured topics, labels, or business-sensitive phrases. |
| Actions | Decide whether a match should allow, audit, redact, or block traffic. |
| Severity | Help dashboards and review flows sort policy outcomes. |
| Version metadata | Let operators prove which profile version made a decision. |
Profiles become active only when they are bound to traffic through policy bindings or selected by a simulation/review workflow.
Runtime Behavior
At runtime Eden gathers the profiles attached to the request context, derives request-scoped terms from the normalized conversation and tool arguments, evaluates them before provider or tool egress, and records the decision as safe policy evidence. Content profiles can run alongside PII scanners, access boundaries, template lookup, model routing, and work metadata controls.
When multiple profiles match the same request, Eden preserves the strictest applicable action. This makes it safe to layer broad organization policy with narrower route, group, project, or endpoint policy.
Rollout Guidance
Start new profiles in audit-oriented flows, review promptless simulation records and safe telemetry, and then bind stricter actions to production traffic after operators agree on the match behavior. Keep profile names and categories business-readable because they appear in dashboards, approvals, and evidence exports.
Telemetry
Policy telemetry records profile identifiers, matched rule categories, status, and counts. It does not record raw prompt text or sensitive match values.