Skip to main content
This guide explains how to use TrueFoundry’s built-in Regex Pattern Matching guardrail to detect and redact sensitive data patterns in LLM interactions and MCP tool invocations.

​
What is Regex Pattern Matching?

Regex Pattern Matching is a built-in TrueFoundry guardrail that uses regular expressions to detect and handle sensitive data patterns in text content. It ships with a library of preset patterns and supports user-defined custom patterns. It runs directly within the AI Gateway without requiring external API calls, providing fast and cost-effective pattern detection.
Regex Pattern Matching can be applied to all four guardrail hooks: LLM Input, LLM Output, MCP Pre Tool, and MCP Post Tool providing comprehensive pattern-based protection across your entire AI workflow.

​
Key Features

  1. Preset Patterns: Predefined regex patterns for detecting personally identifiable information (PII), payment card numbers, credentials, network identifiers, protected class references for fair lending compliance, and dangerous content.
  2. Custom Pattern Support: Define your own regex patterns with custom redaction text to match more specific data patterns.

​
Adding Regex Pattern Matching Guardrail

To add Regex Pattern Matching to your TrueFoundry setup, follow these steps:
1

Navigate to Guardrails

Go to the AI Gateway dashboard and navigate to the Guardrails section.
2

Create or Select a Guardrails Group

Create a new guardrails group or select an existing one where you want to add the Regex Pattern Matching guardrail.
3

Add Regex Pattern Matching Integration

Click on Add Guardrail and select Regex Pattern Match from the TrueFoundry Guardrails section.
TrueFoundry guardrail selection interface showing Regex Pattern Match option

Select Regex Pattern Match from TrueFoundry Guardrails

4

Configure the Guardrail

Fill in the configuration form:
  • Name: Enter a unique name for this guardrail configuration (e.g., regex-personal-info-redaction)
  • Operation: Choose the operation mode:
    • validate: Detect patterns and block requests containing matches
    • mutate: Detect patterns and redact matches, allowing the request to continue
  • Preset Patterns: Select from the built-in patterns
  • Custom Patterns: Add your own regex patterns with custom redaction text
Regex Pattern Matching configuration form showing preset pattern selection and custom pattern fields

Configure Regex Pattern Matching with presets and custom patterns

5

Save the Configuration

Click Save to add the guardrail to your group.

​
Configuration Options

See Guardrails Overview for details on Operation Modes and Enforcing Strategy.

​
How It Works

​
Validate Mode

When configured in validate mode, the guardrail scans content against all enabled preset and custom patterns. If any pattern matches, the request is blocked. Example:

​
Mutate Mode

When configured in mutate mode, the guardrail scans content and replaces each match with the pattern’s redaction text, allowing the request to continue. Example:
Input:
Output:
Input:
Result: Request will be blocked by the guardrail, as it matches the explosives pattern.

​
Preset Patterns

The following preset patterns are available. Each has a unique identifier that you select when configuring the guardrail, and a default redaction text used in mutate mode.
You do not need to enable all preset patterns. Select only the ones relevant to your use case to minimize false positives.

​
Custom Patterns

In addition to preset patterns, you can define your own regex patterns to match more specific data patterns. Each custom pattern requires: Example: To redact internal employee IDs like EMP-123456:
  • Pattern: EMP-\d{6}
  • Redaction Text: [REDACTED EMPLOYEE ID]
Test custom regex patterns thoroughly before deploying. Overly broad patterns may cause excessive false positives.

​
Use Cases

​
Best Practices

Start with Audit enforcing strategy to monitor pattern matches in Request Traces before switching to Enforce. This helps you identify false positives and tune your pattern selection.
Regex-based detection: Pattern matching is syntax-based. Obfuscated or encoded content (base64, Unicode escapes) may bypass detection. Use as part of a defense-in-depth strategy alongside other guardrails for comprehensive protection.