Policy-as-Code

# policy.yaml
guardrails:
  prompt_injection:
    level: strict
  pii_detection:
    level: strict
    mode: redact
  data_exfiltration:
    level: moderate
  toxicity:
    threshold: 0.7
  secret_key_detection:
    level: moderate

promptguard policy export --project-id proj_abc123 > policy.yaml

promptguard policy diff policy.yaml --project-id proj_abc123

Comparing policy.yaml against live config...

Differences:

  prompt_injection.level:
    - "moderate"
    + "strict"
  toxicity.threshold:
    - 0.8
    + 0.7

# Preview first
promptguard policy apply policy.yaml --project-id proj_abc123 --dry-run

# Apply for real
promptguard policy apply policy.yaml --project-id proj_abc123

Policy validation failed:
  guardrails.prompt_injection.level: Must be one of {"strict", "moderate", "permissive"}
  guardrails.toxicity.threshold: Must be a number between 0.0 and 1.0

# 1. Export current config as baseline
promptguard policy export --project-id proj_abc > policy.yaml

# 2. Edit policy.yaml in your editor
# 3. Review changes
promptguard policy diff policy.yaml --project-id proj_abc

# 4. Commit to git
git add policy.yaml
git commit -m "Tighten injection detection to strict"

# 5. Apply in CI/CD or manually
promptguard policy apply policy.yaml --project-id proj_abc

# .github/workflows/policy.yml
name: Apply Security Policy
on:
  push:
    branches: [main]
    paths: ['policy.yaml']

jobs:
  apply:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install CLI
        run: curl -fsSL https://get.promptguard.co/cli | bash
      - name: Apply policy
        run: promptguard policy apply policy.yaml --project-id ${{ secrets.PROJECT_ID }}
        env:
          PROMPTGUARD_API_KEY: ${{ secrets.PROMPTGUARD_API_KEY }}