Policy JSON
{
"guard": {
"prompt_injection": {
"enabled": true,
"sensitivity": "medium",
"action": "DENY",
"log_attempts": true
}
},
"secrets": {
"enabled": true,
"confidence_threshold": 0.8,
"categories": ["api_keys", "tokens", "passwords", "cloud_secrets", "database_urls", "certificates"],
"actions": {
"critical": "DENY",
"high": "DENY",
"medium": "REDACT"
}
},
"registry": {
"models": ["gpt-4o", "claude-3-5-sonnet", "claude-3-sonnet"],
"strict": true,
"tools": ["file_read", "file_write", "terminal_execute", "web_search", "code_search"],
"deny_unlisted": true
},
"memory": {
"default_scope": "session",
"allowed_scopes": ["request", "session"],
"purge_on_session_end": true,
"deny_secrets_in_memory": true
},
"cost": {
"budget": {
"daily": 50.00,
"action_on_exceed": "DENY",
"alert_threshold": 0.8
},
"per_request_limit": 2.00,
"action_on_exceed": "DENY"
},
"reliability": {
"circuit_breaker": {
"failure_threshold": 5,
"reset_timeout_ms": 30000,
"half_open_max_attempts": 1
},
"retry": {
"max_retries": 3,
"backoff": "exponential",
"max_backoff_ms": 5000,
"action_on_exhausted": "DENY"
},
"fallback_chain": ["gpt-4o", "claude-3-5-sonnet", "claude-3-sonnet"],
"action_on_chain_exhausted": "DENY"
},
"audit": {
"enabled": true,
"log_decisions": true,
"log_evidence": true,
"redact_pii": true,
"retention_days": 30
}
}
policy = {
"guard": {
"prompt_injection": {
"enabled": True,
"sensitivity": "medium",
"action": "DENY",
"log_attempts": True,
},
},
"secrets": {
"enabled": True,
"confidence_threshold": 0.8,
"categories": [
"api_keys", "tokens", "passwords",
"cloud_secrets", "database_urls", "certificates",
],
"actions": {"critical": "DENY", "high": "DENY", "medium": "REDACT"},
},
"registry": {
"models": ["gpt-4o", "claude-3-5-sonnet", "claude-3-sonnet"],
"strict": True,
"tools": ["file_read", "file_write", "terminal_execute", "web_search", "code_search"],
"deny_unlisted": True,
},
"memory": {
"default_scope": "session",
"allowed_scopes": ["request", "session"],
"purge_on_session_end": True,
"deny_secrets_in_memory": True,
},
"cost": {
"budget": {"daily": 50.00, "action_on_exceed": "DENY", "alert_threshold": 0.8},
"per_request_limit": 2.00,
"action_on_exceed": "DENY",
},
"reliability": {
"circuit_breaker": {
"failure_threshold": 5,
"reset_timeout_ms": 30000,
"half_open_max_attempts": 1,
},
"retry": {
"max_retries": 3,
"backoff": "exponential",
"max_backoff_ms": 5000,
"action_on_exhausted": "DENY",
},
"fallback_chain": ["gpt-4o", "claude-3-5-sonnet", "claude-3-sonnet"],
"action_on_chain_exhausted": "DENY",
},
"audit": {
"enabled": True,
"log_decisions": True,
"log_evidence": True,
"redact_pii": True,
"retention_days": 30,
},
}
What’s Included
| Dimension | Configuration | Why |
|---|---|---|
| Security | Prompt injection (medium sensitivity) | Developers paste code that may resemble injection patterns; medium avoids false positives |
| Secrets | 6 categories, all severity levels | Code frequently contains credentials — broadest detection coverage |
| Registry | Capable models + dev tools | Code assistants need capable models and file/terminal access |
| Memory | Session-only + secret denial | Code context shouldn’t persist; secrets must never be stored |
| Cost | 50/day+2/request | Higher limits for long code generation sessions |
| Reliability | Circuit breaker + retry + fallback | Developers expect responsive tools; fallback across providers |
Install
# Install the code assistant starter
tealtiger policy install --starter code-assistant
# Or copy the JSON above into your tealtiger.config.json
Customize
| Setting | Default | Adjust For |
|---|---|---|
guard.prompt_injection.sensitivity | medium | Raise to high for untrusted code inputs |
secrets.categories | 6 categories | Add private_keys for infrastructure code |
registry.tools | 5 dev tools | Match your IDE’s tool set |
cost.budget.daily | 50.00 | Scale with team size |
Related
- API Key Detection — Standalone secret detection
- Cloud Secrets — AWS — AWS-specific credential detection
- Session Scope Only — Standalone memory scoping
- TealSecrets Documentation — Full API reference