Categories
A detection belongs to one of these families.categories lists the distinct families that fired, ordered by severity.
Severity is
critical, high, medium, or low.
Input normalisation
Literal matching alone is easy to evade, so every payload is normalised before the static pass. Encoding tricks, invisible characters, look-alike characters, and spacing games are folded away first. Offsets are mapped back to your original text, so redaction stays exact.The two stages
The static pass answers in about 2 ms. When it finds nothing, a semantic classifier reads the payload and names the strategy, in about 100 ms round trip. It reports what it said inmodelCheck.
A block with empty
matches and a modelCheck that says unsafe came from the semantic pass. That is the one case where reason is not a rule id: it is the classifier’s own label.
The classifier fails open
The static pass has already run and found nothing, so a classifier that is unreachable or slow leaves the payload where it was: allowed, withmodelCheck.ran false and an error token saying why. The alternative would make a separately hosted model a single point of failure for every clean request.
Tuning the semantic pass
You can change what the semantic pass may do to a verdict. This exists for callers that remove personal data with Cloak before the request reaches a model, because the classifier treats personal data itself as unsafe.
Signature matches block in every mode.
Plan allowances
Every plan runs the static pass without a limit. The semantic pass is metered: a monthly number of scans and a monthly number of blocks it may produce. Each verdict carries aquota block with your usage. Once the block allowance is spent, a semantic detection is still reported but comes back as an allow, with quota.enforcementWithheld true and quota.overflow counting how many went that way. A signature block is never withheld.