Firewall rules
This page is rendered from the enforced policy itself (secure.cljk, guardrails kotoba-guardrails-2026-09-v2 / firewall kotoba-firewall-2026-09-v1). GET /v1/secure serves the same versions.
Guardrail templates
Evaluated deterministically on every request, both teams. block refuses with 403 guardrail-blocked before a job exists and leaves a durable receipt; redact masks before the model sees it; flag marks for review and never refuses.
A block rule is the AUP and has no switch. The redact / flag rules and each compliance framework can be turned on / off per signed-in account under Security controls (/secure); a rule an enabled framework requires is held on while that framework is on.
| id | action | What |
|---|---|---|
csam-block
|
block | CSAM references are refused on every request (AUP strictly-prohibited). |
cbrn-block
|
block | CBRN/WMD uplift requests are refused on every request (AUP strictly-prohibited). |
fraud-block
|
block | Fraud-as-a-service asks are refused (AUP strictly-prohibited). |
secret-hygiene
|
redact | Live credential shapes in the prompt are masked before the model sees them. |
pii-passkeys
|
flag | References to passkeys/private keys are flagged for review, never blocked. |
Firewall: task × rung
task is the request's purpose (the bearer path defaults to code-review). Each row opens at its rung and above. The blue team has no rungs: the three standard tasks only. Observe mode is off (decisions are enforced).
| task | min rung | none | card | identity | business | contracted |
|---|---|---|---|---|---|---|
code-review
|
identity | — | — | ✓ | ✓ | ✓ |
vulnerability-triage
|
identity | — | — | ✓ | ✓ | ✓ |
remediation
|
identity | — | — | ✓ | ✓ | ✓ |
payload-crafting
|
contracted | — | — | — | — | — |
c2-tooling
|
contracted | — | — | — | — | — |
payload-crafting and c2-tooling have an empty task list — even a contracted rung on the record does not open them; that is a separate operator decision. Refusals are 403 firewall-denied naming the tool.