Skip to main content

Set up DLP rules for my team

Surfaces used: dashboard DLP Rules Editor (source of truth) + any enforcement surface (gateway, hooks, browser extension, SDK) Modes supported: Hosted Hybrid Tiers: Solo Teams

What you'll do​

Open the DLP Rules Editor, pick from 64 built-in patterns (SSN, AWS keys, credit cards, health identifiers, etc.) or write custom regex, test your rules against sample inputs, and publish. Every enforcement surface in your org picks up the change automatically.

Why this is the right path for you​

  • If you want one canonical place where "what is sensitive" is defined, this is it. You do not maintain parallel lists in multiple tools.
  • The editor is the source. Deployment surfaces (gateway, coding hooks / SDK, browser extension) enforce it -- you author one ruleset, not a per-surface copy.
  • A mask rule redacts sensitive values in place and lets the call proceed on Claude Code and Gemini CLI through the Python SDK. On Node hooks and every other surface, including the Gateway, it becomes a deny.
  • Coverage remains explicit per event: the browser extension enforces custom rules scoped to browser_ext; its always-on built-in patterns are detect-only. A block rule denies on every covered event.

When NOT to use this approach​

caution

If you only need detection on one surface and do not care about consistency, the built-in default ruleset already covers most cases. The editor is for teams that want to add custom patterns or tune defaults.

5-minute setup​

  1. Dashboard -> DLP -> Rules editor.
  2. Click Add rule. Pick a preset (e.g., US SSN) or Custom regex.
  3. Configure:
    • Pattern: the regex or preset id.
    • Action: mask, detect, or block. mask rewrites only through the Python SDK on Claude Code and Gemini CLI; elsewhere it denies.
    • Scope: prompt, response, tool_arguments, or any subset.
    • Applies to: all projects, or a specific project.
  4. Paste a test input in the Test panel. Confirm your rule matches (or not) before publishing.
  5. Click Publish. Policy bundle is re-signed and distributed; enforcement surfaces pick it up within ~60 seconds.

Example custom rule (internal project code):

Name:       Internal project codenames
Pattern:    \b(BLUEBIRD|NIGHTHAWK|REDFIN)-[A-Z0-9]{4,}\b
Action:     mask  # rewrites only on Claude Code/Gemini CLI via Python SDK; otherwise denies
Scope:      prompt, tool_arguments
Applies to: Project "engineering"

Verifying it's working​

  1. Test pane: the editor shows matched spans on your sample text before you publish.
  2. Enforcement: Send a test prompt through the target surface. On Claude Code or Gemini CLI through the Python SDK, confirm the sensitive value is redacted and the call proceeds. On every other surface, confirm the mask rule denies the call.
  3. Audit: dashboard -> Audit shows the matched rule id on each event.

Common follow-ups​

Reference​