Guardrails quickstart

Use Ruby 3.4 or newer. Rails applications can follow this guide and then add the Rails adapters.

Install

Add the gem to your Gemfile:

gem "olyx-guardrails", "~> 1.2"

Install your dependencies:

bundle install

Define a policy

Create guardrails_example.rb:

require "olyx/guardrails"

policy = Olyx::Guardrails::Policy.new(
  name: "application-boundary",
  max_input_length: 4_000,
  block_pii: false,
  block_injections: true,
  block_secrets: true,
  rules: [
    {
      name: :confidential_projects,
      terms: ["Project Falcon"],
      match: :whole_word,
      block: true,
      replacement: "[CONFIDENTIAL_PROJECT]"
    }
  ]
)

input = ARGV.first || "Summarize these release notes."
decision = Olyx::Guardrails.check(input, policy: policy)

unless decision[:allowed]
  warn "Input rejected by #{policy.name}"
  exit 1
end

safe_input = Olyx::Guardrails.redact(input, policy: policy)[:text]
puts safe_input

Run an allowed input and a restricted input:

bundle exec ruby guardrails_example.rb "Summarize these release notes."
bundle exec ruby guardrails_example.rb "Discuss Project Falcon"

The second command exits with status 1. Keep policies in trusted application configuration; construct them once and reuse their immutable instances.

In this policy, PII findings are reported without blocking. The explicit redaction call removes recognized PII before model submission. Injection and secret findings, and the confidential project rule, reject the input instead.

Check model output

After obtaining safe_input, call your application’s model client and check the complete response before returning it:

completion = LlmClient.complete(safe_input) # Your application-owned client
output_decision = Olyx::Guardrails.check_output(completion, policy: policy)

if output_decision[:allowed]
  safe_output = Olyx::Guardrails.redact_output(completion, policy: policy)[:text]
  # Return safe_output to your caller.
else
  # Return an application-specific rejection without exposing completion.
end

LlmClient is a placeholder for your existing model integration. Completed-output methods do not inspect a live token stream.

Add Rails adapters

Generate the initializer and environment-keyed policy file:

bin/rails generate olyx_guardrails:install

The generator creates config/initializers/olyx_guardrails.rb and config/olyx_guardrails.yml. Configure the policy before boot completes and add the adapters at the boundaries you want to protect. See controller boundaries for a full example.

Next steps

Configure policy rules, inspect the decision result, and choose provider failure behavior before supplying an optional semantic classifier.