Policy-as-Code lets you define your PromptGuard guardrail configuration in YAML files, version them in git, and apply them via the CLI. This enables code review, audit trails, and reproducible deployments for your security policies.
Overview
Instead of configuring guardrails through the dashboard UI, define them declaratively:
# policy.yaml
guardrails:
prompt_injection:
level: strict
pii_detection:
level: strict
mode: redact
data_exfiltration:
level: moderate
toxicity:
threshold: 0.7
secret_key_detection:
level: moderate
CLI Commands
Export Current Config
Fetch the live guardrail config and output as YAML:
promptguard policy export --project-id proj_abc123 > policy.yaml
Preview Changes
Compare a YAML file against the live config to see what would change:
promptguard policy diff policy.yaml --project-id proj_abc123
Comparing policy.yaml against live config...
Differences:
prompt_injection.level:
- "moderate"
+ "strict"
toxicity.threshold:
- 0.8
+ 0.7
Apply Changes
Apply a YAML policy file to update the live config:
# Preview first
promptguard policy apply policy.yaml --project-id proj_abc123 --dry-run
# Apply for real
promptguard policy apply policy.yaml --project-id proj_abc123
Validation
The CLI validates your YAML before applying:
- Level fields must be
strict, moderate, or permissive
- PII mode must be
redact, mask, or block
- Toxicity threshold must be a number between 0.0 and 1.0
- YAML syntax is validated before any API calls
Invalid policies are rejected with clear error messages:
Policy validation failed:
guardrails.prompt_injection.level: Must be one of {"strict", "moderate", "permissive"}
guardrails.toxicity.threshold: Must be a number between 0.0 and 1.0
Workflow
Development Workflow
# 1. Export current config as baseline
promptguard policy export --project-id proj_abc > policy.yaml
# 2. Edit policy.yaml in your editor
# 3. Review changes
promptguard policy diff policy.yaml --project-id proj_abc
# 4. Commit to git
git add policy.yaml
git commit -m "Tighten injection detection to strict"
# 5. Apply in CI/CD or manually
promptguard policy apply policy.yaml --project-id proj_abc
CI/CD Integration
Apply policies automatically on merge:
# .github/workflows/policy.yml
name: Apply Security Policy
on:
push:
branches: [main]
paths: ['policy.yaml']
jobs:
apply:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Install CLI
run: curl -fsSL https://get.promptguard.co/cli | bash
- name: Apply policy
run: promptguard policy apply policy.yaml --project-id ${{ secrets.PROJECT_ID }}
env:
PROMPTGUARD_API_KEY: ${{ secrets.PROMPTGUARD_API_KEY }}
Best Practices
- Version everything: Keep
policy.yaml in git alongside your application code
- Code review policies: Require PR approval for policy changes
- Diff before apply: Always run
policy diff before policy apply
- Use dry-run in CI: Validate policies in CI before merging
- Environment-specific configs: Maintain separate policy files for staging and production
Next Steps
