{
  "rules": [
    {
      "id": "safety.block_harm",
      "phase": "in",
      "priority": 100,
      "if": {
        "regex": "\\b(how to (kill|hurt|harm)|suicide|self-harm|build a bomb)\\b"
      },
      "then": { "action": "block", "reply": "I can't help with that." }
    },
    {
      "id": "safety.block_lewd",
      "phase": "in",
      "priority": 90,
      "if": {
        "regex": "\\b(child porn|csam|sexualize minors)\\b"
      },
      "then": { "action": "block", "reply": "I can't help with that." }
    },
    {
      "id": "output.mask_emails",
      "phase": "out",
      "priority": 50,
      "if": { "regex": "[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}" },
      "then": { "action": "mask", "mask_pattern": "[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}", "mask_replacement": "[EMAIL]" }
    },
    {
      "id": "output.mask_phones",
      "phase": "out",
      "priority": 50,
      "if": { "regex": "\\b\\+?[0-9][0-9 .-]{7,}\\b" },
      "then": { "action": "mask", "mask_pattern": "\\b\\+?[0-9][0-9 .-]{7,}\\b", "mask_replacement": "[PHONE]" }
    },
    {
      "id": "output.block_unsafe_code",
      "phase": "out",
      "priority": 60,
      "if": { "regex": "rm -rf /|format c:|DROP TABLE users" },
      "then": { "action": "block", "reply": "That output was blocked for safety." }
    }
  ]
}