Allowlist

The prompt injection allowlist lets you mark specific phrases as safe so they are not caught by the regex-based prompt injection detection guardrail. This is useful when your application legitimately uses language that overlaps with injection patterns — for example, a security-training chatbot that discusses prompt injection techniques, or a customer-support agent whose canned responses include phrases like "ignore previous instructions."

The allowlist only applies to regex-based detection patterns. Evasion detectors — typoglycemia and Base64/hex encoding — are not affected, because they operate on decoded or normalized text where selective phrase exemption is not meaningful.

How it works#

When a request is scanned, allowlisted phrases are masked before the detection patterns run:

1. Each allowlisted phrase is located in the message text (case-insensitive).
2. The matched spans are replaced with neutral placeholder text so the detection regex cannot match them.
3. Detection runs on the masked text — any remaining (non-allowlisted) injection patterns are still caught.
4. If the action is redact, the allowlisted phrases are restored in the final output; only the non-allowlisted injection spans become [PROMPT_INJECTION].

You can allowlist one phrase while still catching other attacks in the same message: only the exact phrases you allowlisted are exempt.

Matching rules#

• Case-insensitive. An entry matches regardless of letter casing in the message text.
• Exact substring match. The phrase must appear verbatim. Wildcards and regex are not supported.
• All actions. The allowlist applies equally to flag, redact, and block.

Managing phrases#

Manage your allowlist in Settings → Guardrails, under the Prompt injection detection section. (The dashboard persists it through the session-authenticated PUT /api/user/guardrails — a dashboard endpoint, not part of the key-authenticated /v1 API.)

Phrases are trimmed, blanks are dropped, and duplicates are rejected case-insensitively.

Limits#

• Up to 200 phrases per account.
• Each phrase can be up to 1,000 characters.
• Account-scoped. The allowlist applies to every request the account makes, across all API keys and the chat.
• Regex patterns only. Typoglycemia and encoded-payload detections cannot be selectively allowlisted — if a message trips an evasion detector, it is handled regardless of allowlist entries.