zuplo 7.2.3 → 7.2.4

package/docs/policies/ai-gateway-dlp-inbound/schema.json

@@ -0,0 +1,4050 @@
+{
+  "$schema": "https://json-schema.org/draft-07/schema",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/ai-gateway-dlp-inbound.json",
+  "type": "object",
+  "title": "Data Loss Prevention (DLP)",
+  "isDeprecated": false,
+  "isPaidAddOn": false,
+  "isEnterprise": false,
+  "isInternal": false,
+  "isBeta": false,
+  "isHidden": false,
+  "requiresAI": true,
+  "policyType": "ai-gateway-dlp",
+  "products": ["ai-gateway"],
+  "description": "Data Loss Prevention (DLP) Inbound Policy for the AI Gateway",
+  "deprecatedMessage": "",
+  "required": ["handler"],
+  "properties": {
+    "handler": {
+      "type": "object",
+      "default": {},
+      "required": ["export", "module", "options"],
+      "properties": {
+        "export": {
+          "const": "AIGatewayDlpInboundPolicy",
+          "description": "The name of the exported type"
+        },
+        "module": {
+          "const": "$import(@zuplo/runtime)",
+          "description": "The module containing the policy"
+        },
+        "options": {
+          "x-zuplo-policy-type": "ai-gateway-dlp",
+          "type": "object",
+          "title": "AIGatewayDlpInboundPolicyOptions",
+          "description": "The options for the Data Loss Prevention (DLP) policy. Scans the content of AI requests and responses — system prompts, messages, and tool-call arguments — for sensitive data such as credit cards, national identifiers, and API keys, applying a per-rule action (mask, block, or log). Detection runs entirely inside the gateway and streaming responses are scanned as they stream.",
+          "additionalProperties": false,
+          "required": ["rules"],
+          "examples": [
+            {
+              "rules": {
+                "pii": {
+                  "inboundAction": "mask",
+                  "outboundAction": "block"
+                },
+                "secret": {
+                  "action": "block"
+                }
+              }
+            }
+          ],
+          "properties": {
+            "rules": {
+              "type": "object",
+              "title": "DlpRules",
+              "additionalProperties": false,
+              "description": "What to find and what to do about it. Each key is a built-in data type id (like `id-us-ssn`) or a group selector (like `pii` or `secret`, plus any dash-aligned id prefix such as `secret-aws`); each value is a rule object stating either one `action` for both directions or a directional pair (`inboundAction`/`outboundAction`) — for example mask PII inbound and block it outbound. Types you do not mention are not scanned. The most specific key wins — an exact id beats a prefix beats a group — and the winning entry decides everything for its type. When one stretch of text matches multiple rules, the severest action wins (block > mask > log). At least one rule must scan something.",
+              "properties": {
+                "contact": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "finance": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "finance-us": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "id": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "id-au": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "id-br": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "id-ca": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "id-es": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "id-fr": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "id-in": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "id-it": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "id-nl": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "id-pl": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "id-sg": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "id-uk": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "id-us": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "network": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "pii": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "region-eu": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "secret": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "secret-aws": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "contact-email": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "contact-phone": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "finance-credit-card": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "finance-crypto-wallet": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "finance-cvv": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "finance-iban": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "finance-swift-bic": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "finance-us-aba-routing": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "finance-us-bank-account": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "id-au-abn": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "id-au-acn": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "id-au-medicare": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "id-au-tfn": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "id-br-cpf": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "id-ca-sin": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "id-es-nif": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "id-fr-nir": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "id-in-aadhaar": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "id-in-pan": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "id-it-fiscal-code": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "id-nl-bsn": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "id-pl-pesel": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "id-sg-nric": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "id-uk-nhs": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "id-uk-nino": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "id-us-itin": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "id-us-passport": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "id-us-ssn": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "network-ipv4": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "network-ipv6": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "network-mac": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "secret-anthropic": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "secret-aws-access-key": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "secret-aws-bedrock": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "secret-azure-client": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "secret-databricks": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "secret-digitalocean": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "secret-discord-webhook": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "secret-github": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "secret-gitlab": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "secret-google-api-key": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "secret-heroku": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "secret-hugging-face": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "secret-jwt": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "secret-mailchimp": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "secret-mailgun": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "secret-npm": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "secret-openai": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "secret-perplexity": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "secret-postman": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "secret-private-key": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "secret-pypi": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "secret-sendgrid": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "secret-sentry": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "secret-shopify": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "secret-slack": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "secret-square": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "secret-stripe": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "secret-telegram-bot": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "secret-terraform": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "secret-twilio": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                },
+                "secret-zuplo": {
+                  "type": "object",
+                  "title": "DlpRule",
+                  "additionalProperties": false,
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                    },
+                    "inboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "outboundAction": {
+                      "type": "string",
+                      "enum": ["mask", "block", "log", "off"],
+                      "description": "What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`."
+                    },
+                    "detection": {
+                      "type": "string",
+                      "enum": ["corroborated", "standard", "aggressive"],
+                      "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                    },
+                    "mask": {
+                      "type": "string",
+                      "default": "[{type}]",
+                      "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                    },
+                    "partialMask": {
+                      "type": "object",
+                      "title": "DlpPartialMask",
+                      "additionalProperties": false,
+                      "required": ["keepLast"],
+                      "properties": {
+                        "keepLast": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 8,
+                          "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "customRules": {
+              "type": "array",
+              "x-advanced": true,
+              "description": "Your own detection rules alongside the built-ins: the same rule object plus a `name`, a regex `pattern`, and optional `context` words.",
+              "items": {
+                "type": "object",
+                "title": "DlpCustomRule",
+                "additionalProperties": false,
+                "required": ["name", "pattern"],
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "description": "Identifier reported in findings and block details for this rule."
+                  },
+                  "pattern": {
+                    "type": "string",
+                    "description": "A JavaScript regular expression source string. Remember to escape backslashes for JSON (for example `\\\\d` for a digit). An invalid pattern fails the configuration at request time — a broken guardrail never degrades into a silent pass-through."
+                  },
+                  "context": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    },
+                    "description": "Context words for this rule. With `detection: \"corroborated\"` the rule only fires when one of these words appears near the match."
+                  },
+                  "action": {
+                    "type": "string",
+                    "enum": ["mask", "block", "log", "off"],
+                    "description": "What happens when this rule matches, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the rule's name (never the values); `log` records a finding and lets the traffic pass unchanged; `off` disables the rule. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both."
+                  },
+                  "inboundAction": {
+                    "type": "string",
+                    "enum": ["mask", "block", "log", "off"],
+                    "description": "What happens when this rule matches in what callers send the model. Use with `outboundAction` to give the rule different behavior per direction. Omitting it (or `off`) leaves the inbound direction unscanned for this rule. Cannot be combined with `action`."
+                  },
+                  "outboundAction": {
+                    "type": "string",
+                    "enum": ["mask", "block", "log", "off"],
+                    "description": "What happens when this rule matches in what the model sends back. Omitting it (or `off`) leaves the outbound direction unscanned for this rule. Cannot be combined with `action`."
+                  },
+                  "detection": {
+                    "type": "string",
+                    "enum": ["corroborated", "standard", "aggressive"],
+                    "description": "How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule."
+                  },
+                  "mask": {
+                    "type": "string",
+                    "default": "[{type}]",
+                    "description": "Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER\\_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type."
+                  },
+                  "partialMask": {
+                    "type": "object",
+                    "title": "DlpPartialMask",
+                    "additionalProperties": false,
+                    "required": ["keepLast"],
+                    "properties": {
+                      "keepLast": {
+                        "type": "integer",
+                        "minimum": 1,
+                        "maximum": 8,
+                        "description": "Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked."
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "allowValues": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "description": "Exact strings that are never flagged by any rule — documentation samples like Stripe's public test card `4242 4242 4242 4242`, or your own support email address. Matching is case-sensitive against the exact detected text, including when a value arrives split across streaming chunks."
+            },
+            "detection": {
+              "type": "string",
+              "enum": ["corroborated", "standard", "aggressive"],
+              "default": "standard",
+              "description": "Default evidence level for rules that do not set their own. See the per-rule `detection` description for the level semantics. There are no numeric confidence thresholds to tune — levels are the whole dial."
+            },
+            "scanToolArguments": {
+              "type": "boolean",
+              "default": true,
+              "x-advanced": true,
+              "description": "Also scan tool/function-call argument payloads — in requests, buffered responses, and streamed tool-call deltas. Tool arguments are user and model content; disabling this exempts them from every rule."
+            },
+            "streaming": {
+              "type": "object",
+              "title": "DlpStreamingSettings",
+              "x-advanced": true,
+              "additionalProperties": false,
+              "description": "Tuning for streaming (SSE) response scanning. Each chunk is held until the boundary scan that includes its successor passes, then released — so values split across chunks are always fully maskable, at the cost of one chunk of latency.",
+              "properties": {
+                "enabled": {
+                  "type": "boolean",
+                  "default": true,
+                  "description": "Scan streaming responses. When false, streaming responses pass through unscanned even when rules cover the outbound direction."
+                },
+                "boundaryScan": {
+                  "type": "boolean",
+                  "default": true,
+                  "description": "Scan across chunk boundaries using a carried tail of already-scanned text. When false, each chunk is scanned alone and released immediately — lower cost, but values split across two chunks are missed."
+                },
+                "maxCarryChars": {
+                  "type": "number",
+                  "minimum": 32,
+                  "maximum": 4096,
+                  "default": 512,
+                  "description": "How many trailing characters are carried from one chunk into the next boundary scan. Bounds memory and re-scan cost; must be larger than the longest value you need to catch."
+                }
+              }
+            },
+            "endpoints": {
+              "type": "array",
+              "title": "Applicable Endpoints",
+              "x-advanced": true,
+              "description": "The endpoint shapes this policy applies to. Omit to apply to all (openai-chat, openai-responses, anthropic-messages).",
+              "items": {
+                "type": "string",
+                "enum": [
+                  "openai-chat",
+                  "openai-responses",
+                  "anthropic-messages"
+                ]
+              }
+            },
+            "onUnknownShape": {
+              "type": "string",
+              "title": "On Unknown Shape",
+              "x-advanced": true,
+              "enum": ["deny", "skip"],
+              "default": "deny",
+              "description": "What to do when the request shape cannot be inspected. As a guardrail this policy defaults to `deny` (fail closed) so uninspectable content is never served."
+            },
+            "onError": {
+              "type": "string",
+              "title": "On Engine Error",
+              "x-advanced": true,
+              "enum": ["block", "allow"],
+              "default": "block",
+              "description": "What to do if the scanner itself throws. The engine is a local in-gateway scanner, so this is effectively unreachable outside of a runtime defect — but a guardrail must declare its failure posture. `block` (the default) fails closed with a 500 in the route's native error format; `allow` fails open and serves the content uninspected."
+            },
+            "engine": {
+              "type": "string",
+              "x-advanced": true,
+              "enum": ["builtin"],
+              "default": "builtin",
+              "description": "The detection engine. Only `builtin` (in-gateway regex + checksum detection with context-word scoring; no data egress) is available today. Declaring the discriminator now keeps future engines an additive, non-breaking change."
+            }
+          }
+        }
+      },
+      "examples": [
+        {
+          "export": "AIGatewayDlpInboundPolicy",
+          "module": "$import(@zuplo/runtime)",
+          "options": {
+            "rules": {
+              "pii": {
+                "inboundAction": "mask",
+                "outboundAction": "block"
+              },
+              "secret": {
+                "action": "block"
+              }
+            }
+          }
+        }
+      ]
+    }
+  }
+}