AI Data Loss Prevention on agentgateway — built-in regex + custom webhook

# Prereq — one-time gcloud auth so helm can pull the chart from GAR.
# (02-agentgateway.sh will prompt for this automatically if you skip it.)
brew install --cask google-cloud-sdk    # macOS, if you don't have gcloud
gcloud auth login

git clone https://github.com/tjorourke/solo-labs.git
cd solo/agentic-pii-guardrail-kind

export ANTHROPIC_API_KEY=sk-ant-...
export AGENTGATEWAY_LICENSE_KEY=...    # ask your Solo account team

./scripts/quick.sh up
./scripts/port-forward.sh   # leave running

apiVersion: enterpriseagentgateway.solo.io/v1alpha1
kind: EnterpriseAgentgatewayPolicy
metadata:
  name: anthropic-guardrails
  namespace: agentgateway-system
spec:
  targetRefs:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      name: anthropic
  backend:
    ai:
      promptGuard:
        request:
          # Layer 1 — built-in regex masks. Zero code, ships with AGW.
          - regex:
              action: Mask
              builtins: [CreditCard, Ssn, Email, PhoneNumber, CaSin]
          # Layer 2 — custom webhook for the rest.
          - webhook:
              backendRef:
                kind: Service
                name: pii-guardrail-webhook
                namespace: pii-demo
                port: 8000
        response:
          - regex:
              action: Mask
              builtins: [CreditCard, Ssn, Email, PhoneNumber, CaSin]
          - webhook:
              backendRef:
                kind: Service
                name: pii-guardrail-webhook
                namespace: pii-demo
                port: 8000

PII_PATTERNS = [
    # UK National Insurance Number: 2 letters + 6 digits + 1 letter (e.g. QQ123456C).
    ("UK_NINO", re.compile(r"\b[A-CEGHJ-PR-TW-Z][A-CEGHJ-NPR-TW-Z]\d{6}[A-D]\b")),
    # IBAN: 2-letter country, 2 check digits, up to 30 alphanumeric.
    ("IBAN", re.compile(r"\b[A-Z]{2}\d{2}[A-Z0-9]{11,30}\b")),
    # EU/UK passport: one letter + 8 digits — matches a lot of national formats.
    ("EU_PASSPORT", re.compile(r"\b[A-Z]\d{8}\b")),
]

INJECTION_PATTERNS = [
    re.compile(r"ignore (all|previous|the above) (instructions|rules|prompts)", re.I),
    re.compile(r"disregard (all|previous|the above) (instructions|rules|prompts)", re.I),
    re.compile(r"reveal (your |the )?system prompt", re.I),
]

@app.post("/request", response_model=GuardrailsPromptResponse)
def process_request(req: GuardrailsPromptRequest) -> GuardrailsPromptResponse:
    # 1. Reject path — any injection pattern in any user/system message.
    for msg in req.body.messages:
        if msg.role in ("user", "system"):
            hit = _check_injection(msg.content)
            if hit:
                return GuardrailsPromptResponse(action=RejectAction(
                    body="Request blocked by guardrail webhook: suspected prompt injection.",
                    status_code=403,
                    reason=f"prompt-injection pattern matched: {hit!r}",
                ))

    # 2. Mask path — apply EU/UK PII regexes to every message.
    redacted, all_matches, any_change = [], [], False
    for msg in req.body.messages:
        new_content, hits = _redact_text(msg.content)
        if hits: any_change = True; all_matches.extend(hits)
        redacted.append(Message(role=msg.role, content=new_content))

    if any_change:
        return GuardrailsPromptResponse(action=MaskAction(
            body=PromptMessages(messages=redacted),
            reason=f"masked: {', '.join(sorted(set(all_matches)))}",
        ))

    # 3. Pass path — nothing to do.
    return GuardrailsPromptResponse(action=PassAction(reason="no PII or injection detected"))

# Most recent guardrail decisions, newest first
kubectl --context kind-pii -n pii-demo \
  exec deploy/pii-guardrail-webhook -- \
  wget -qO- http://localhost:8000/events | jq

# Policy attachment status — should show Accepted/Attached True
kubectl --context kind-pii -n agentgateway-system \
  get enterpriseagentgatewaypolicy anthropic-guardrails -o yaml \
  | grep -A6 conditions

# Webhook logs — every /request and /response call logs phase + action + matches
kubectl --context kind-pii -n pii-demo logs -f deploy/pii-guardrail-webhook

helm install inspector ./charts/pii-inspector-ui \
  --namespace my-ai-demo --create-namespace \
  --set agw.url=http://my-gateway.agentgateway-system.svc.cluster.local \
  --set agw.format=anthropic-messages \
  --set webhook.url=http://my-guardrail.guardrail-system.svc.cluster.local:8000

kubectl -n my-ai-demo port-forward svc/inspector-pii-inspector-ui 8090:80
open http://localhost:8090

# Two-column mode: what you sent, what came back. Useful when you don't have
# a Guardrail Webhook implementation yet but want to smoke-test a route — a
# Reject from a built-in regex shows up as the raw 403 body under column 3.
helm install inspector ./charts/pii-inspector-ui \
  --namespace my-ai-demo --create-namespace \
  --set agw.url=http://my-gateway.agentgateway-system.svc.cluster.local \
  --set agw.format=openai-chat