Olyx Guardrails

In-process AI guardrails for Ruby and Rails. Detect, decide, and redact at the application boundary without proxying model traffic or sending content to Olyx.

• Detects PII, secrets, prompt injection, and multi-turn attacks.
• Enforces immutable custom content policies.
• Checks completed model inputs and outputs.
• Adds opt-in Rails adapters, notifications, and instrumentation.
• Accepts an application-owned LLM hook for semantic analysis.

Deterministic checks run locally. Rails and semantic analysis are optional.

Add the gem to your Gemfile:

gem "olyx-guardrails", "~> 1.2"

Then run bundle install.

require "olyx/guardrails"

policy = Olyx::Guardrails::Policy.new(
  name: "ai-boundary",
  block_injections: true,
  block_secrets: true,
  rules: [
    {
      name: :confidential_projects,
      terms: ["Project Falcon"],
      match: :whole_word,
      block: true,
      replacement: "[CONFIDENTIAL_PROJECT]"
    }
  ]
)

decision = Olyx::Guardrails.check(prompt, policy: policy)
return forbidden unless decision[:allowed]

safe_prompt = Olyx::Guardrails.redact(prompt, policy: policy)[:text]
completion = LlmClient.complete(safe_prompt)

output = Olyx::Guardrails.check_output(completion, policy: policy)
return invalid_output unless output[:allowed]

check returns a decision without changing content. redact transforms recognized content without making an allow/block decision. Call both when you need both behaviors.

The default policy limits input to 10,000 characters, blocks injection, reports PII and secrets, and defines no custom rules. Use an explicit policy in production. See the policy guide for all options.

Generate the initializer and policy file:

bin/rails generate olyx_guardrails:install

Opt in only at controllers or other boundaries that handle AI content:

class AiRequestsController < ApplicationController
  include Olyx::Guardrails::Rails::Controller

  rescue_from Olyx::Guardrails::Blocked do |error|
    render json: { error: "input_rejected", decision: error.decision },
           status: :unprocessable_entity
  end

  def create
    prompt = params.require(:prompt)
    guardrails_check!(prompt, metadata: { user_id: current_user.id })

    safe_prompt = guardrails_redact(prompt)[:text]
    completion = LlmClient.complete(safe_prompt)
    Olyx::Guardrails::Rails::Enforcer.check_output!(completion)

    render json: { completion: completion }, status: :created
  end
end

The gem never scans Rails requests globally. See the Rails guide for controllers, jobs, GraphQL, Action Cable, uploads, and instrumentation.

Output methods operate on complete values; they do not inspect token streams.

Pass any callable as llm_provider:

provider = lambda do |text, context|
  LocalClassifier.call(text: text, signals: context)
end

result = Olyx::Guardrails.check(
  prompt,
  policy: Olyx::Guardrails::Policy.new(llm_failure_mode: :block),
  llm_provider: provider
)

The application owns model selection, credentials, transport, timeouts, and retries. Provider results can add findings but cannot clear deterministic findings. See the provider contract.

Olyx Guardrails is a defense-in-depth control, not a complete semantic security boundary or data-loss-prevention system.

• Pattern matching can miss novel, translated, or deeply encoded attacks.
• PII and secret detection cover documented formats, not every possible value.
• File parsing, authorization, streaming enforcement, quotas, centralized rollout, and audit retention remain application responsibilities.

See the operations guide for production guidance. Report vulnerabilities through the security policy.

• Documentation index
• Policies
• Rails integration
• API reference
• Framework-free example
• Changelog
• Contributing

bin/setup
bin/ci

Rails adapter changes must also pass bundle exec appraisal rake test. See Contributing for the complete workflow.

Olyx Guardrails is available under the Apache License 2.0.