Skip to content

Guardrails, a worked example

Northwind again: 60 people, file share \\files01\Company with HR, Finance, Legal and Shared folders, and an HR system added under My apps with the short name hris. AD groups: AI-Users (everyone who gets Gate), HR, Finance, AI-Admins.

Remember the base rule: every call already runs as the person, so Windows and each app still apply their own permissions. Guardrails are a second, tighter fence on top. They can take away; they can never give someone more than the directory does.

Week 1: learning mode

Do nothing. A fresh Gate allows and records everything. Let people use it for a normal week of work. Look at Audit trail now and then to see what the AIs actually do.

Week 2: draft from the trail

  1. Guardrails → Build rules from the trail. Gate drafts rules from real use, grouped by people and apps.
  2. Or start from Template: company baseline and edit.
  3. Read each rule as a sentence: who may do what in which app.

Northwind's policy

Here is where Dana ended up, rule by rule. Each one is a row in Add a guardrail, or the JSON under Advanced.

1. Everyone may read their files. Windows decides which files. 

{"id": "everyone-reads-files", "who": ["group:AI-Users"], "effect": "allow", "do": ["read"], "on": ["files://**"]}

2. Nobody's AI touches Legal, whatever Windows says. Locked, so changing it needs an admin's authenticator code. 

{"id": "never-legal", "who": ["*"], "effect": "deny", "do": ["*"], "on": ["files://**/Legal/**"], "locked": true}

3. HR may read the HR system, except the full export. 

{"id": "hr-reads-hris", "who": ["group:HR"], "effect": "allow", "do": ["read"], "on": ["hris://tools/**"], "except": ["hris://tools/export_all"]}

4. HR changes in the HR system wait for an approver. 

{"id": "hr-changes-approved", "who": ["group:HR"], "effect": "approve", "do": ["write"], "on": ["hris://tools/**"], "approvers": ["role:admin"]}

5. Admins keep their Gate helper (see Connect an AI). 

{"id": "admins-run-gate-helper", "who": ["role:admin"], "effect": "allow", "do": ["read"], "on": ["gate://tools/*"]}

What this means for two people:

Maria (HR) Lee (Finance)
Read S:\HR\... Yes, if Windows lets her No: Windows refuses Lee, and the AI never sees the names
Read S:\Finance\... Only if Windows lets her Yes, if Windows lets him
Anything in Legal No (rule 2) No (rule 2)
Look up an employee in hris Yes (rule 3) No: no rule allows it
Change an employee record Waits for an admin (rule 4) No

How Gate decides

In this fixed order, every time:

  1. No rule matches → deny. (After you save a policy, anything not named is refused.)
  2. Any matching rule says deny → deny. A block always wins.
  3. Any says break-glass → allowed only with a stated reason, flagged for review.
  4. Any says needs approval → waits under Approvals.
  5. Otherwise → allow, credited to the most specific rule.

Names: group: uses the group name as Groups shows it (case does not matter). * matches inside one path segment, ** across segments.

Try before you save

  1. Try it as a person: pick Lee, read, app hris. Gate says deny and why. Pick Maria: allow, by hr-reads-hris.
  2. Tick Dry run, write a note under What changed, and Save as new version. For a few days Gate logs what it would block (dry_run in the audit trail) and blocks nothing new.
  3. Check the trail for surprises, untick Dry run, save again. Now it is enforced.

Every save is a version under Version history, with who and when.

Approvals in practice

When Maria's AI tries to change a record, the call waits under Approvals. An admin opens it, reads the full arguments, and presses approve with their authenticator code. The action then runs as Maria, and the audit trail shows both: Maria asked, the admin approved.

Approvers must have an authenticator set up in Gate, because every approval asks for its code.

The data filter

Last fence: Guardrails → Data filter redacts payment card numbers, Social Security numbers, API keys, email addresses and phone numbers from what apps send back, before the model sees it. Choose Redact (or Block the result), tick what to catch, Save, and paste a sample under Try it.