Skip to content

PatternContentGuard

Namespace AgentPrism · Assembly AgentPrism.Core.dll

AgentPrism’s built-in pattern-based content guard.

public sealed class PatternContentGuard : IContentGuard

objectPatternContentGuard

IContentGuard

object.GetType(), object.ToString(), object.Equals(object?), object.Equals(object?, object?), object.ReferenceEquals(object?, object?), object.GetHashCode()

The extension point alone is not enough: the rule is that an in-memory implementation is first-class,“ and without a built-in implementation IContentGuard would be an empty promise. It carries three pattern families: a denied-term list (ContentGuardAction.Block), PII patterns, and secret patterns (ContentGuardAction.Mask).

Every pattern is written with the source generator (RegularExpressions.GeneratedRegexAttribute). AgentPrism.Core is AOT-compatible; a RegularExpressions.Regex compiled at runtime would break that.

Every pattern carries a timeout (1000 ms). This is the only defense against ReDoS and is mandatory on the hot path.

Card and Turkish national ID patterns are validated with AgentPrism.CheckDigits. Without it, every order number would be masked and the guard would get turned off.

Allocation order: a match is looked for first with IsMatch / EnumerateMatches, and a new string is produced only if there is a match. If no rule is defined, ContentGuardResult.Allow is returned on the first line.

PatternContentGuard(IOptionsMonitor<PatternContentGuardOptions>)

Section titled “ PatternContentGuard(IOptionsMonitor<PatternContentGuardOptions>)”

Creates a new built-in guard.

public PatternContentGuard(IOptionsMonitor<PatternContentGuardOptions> options)

options IOptionsMonitor<PatternContentGuardOptions>

Pattern and denied-term settings.

ArgumentNullException

options is null.

The guard’s name. This name is written to the audit trail and the run event.

public string Name { get; }

string

InspectAsync(ContentGuardContext, CancellationToken)

Section titled “ InspectAsync(ContentGuardContext, CancellationToken)”

Inspects the content.

public ValueTask<ContentGuardResult> InspectAsync(ContentGuardContext context, CancellationToken cancellationToken = default)

context ContentGuardContext

The inspection context.

cancellationToken CancellationToken

The cancellation token.

ValueTask<ContentGuardResult>

The decision. Returns ContentGuardResult.Allow when the content passes unchanged; this path allocates nothing.