Extending Entities

# policies/acme/policy.yaml
custom_patterns:
  - entity_type: "mrn"                                  # your type name, lowercase_with_underscores
    pattern: '\bMRN[-:\s]?\d{6,10}\b'                   # Rust regex; linear-time, bounded quantifiers only, validated at load
    confidence: 0.9
    context_words: ["mrn", "medical record", "patient"] # nearby words raise confidence

rules:
  - entity_type: "mrn"            # reference it by the same bare name
    protection_level: 1
    action: "tokenize"
    restore_mode: "masked"
    conditions: []

custom_patterns:
  - entity_type: "bank_account"
    pattern: '(?i)\b(?:account|acct|konto)[ \t:#.-]{0,4}(\d{8,17})\b'
    value_group: 1                # tokenize only capture group 1 (the number, not the label)
    context_words: ["account", "acct", "konto"]

custom_patterns:
  - entity_type: "icd10"
    pattern: '\b[A-TV-Z][0-9][0-9AB](?:\.[0-9A-TV-Z]{1,4})?\b'
    context_words: ["icd", "diagnosis", "diagnose", "dx"]
    context_required: true          # keep a code only near a diagnosis label
    context_window_chars: 40        # optional; defaults to the built-in window

restore_strategies:
  credit_card:
    kind: reveal_last_n   # **** **** **** 4821
    n: 4
  salary:
    kind: bucket          # generalize a number into a coarse band
    ranges:
      - {max: 50000, label: "band: under 50k"}
      - {label: "band: 50k and up"}

detection:
  required_for: ["diagnosis"]          # fail closed if NER is down
  ner_labels: ["medical condition"]    # extra labels to detect
  ner_label_map:
    "medical condition": "diagnosis"   # report the label as this entity type

topical_redaction:
  - name: "clinical_topic"
    phrases: ["cancer diagnosis", "HIV status"]   # matched case-insensitively, UTF-8 safe
    scope: "sentence"                              # redact the whole containing sentence
    on_match: "continue"                           # redact and keep processing (default)
  - name: "matter_code"
    patterns: ['\bMATTER-\d{4,6}\b']               # linear-time regex, compiled at load
    scope: "window"
    window_chars: 30                               # redact 30 chars on each side of the match
  - name: "classified_block"
    phrases: ["classified"]
    on_match: "reject"                             # deny the whole request (403) instead

document_columns:
  - format: "csv"
    header: "employee_notes"   # matched case-insensitively, whitespace-normalized
    entity_type: "employee_note"

rules:
  - entity_type: "employee_note"  # a normal rule governs action + restore
    protection_level: 2
    action: "tokenize"
    restore_mode: "masked"

curl -X POST http://localhost:3000/v1/transform \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $GUARDAI_API_KEY" \
  -d '{"input": "Patient MRN-04417829 admitted.", "policy": "acme"}'
# -> safe_text: "Patient {{custom:mrn:x_001:42f5f25fb8cc}} admitted."

real hard-ID (SSN/IBAN/passport)  >  policy hard-custom  >  built-in PII (email/address)
   >  request custom_patterns  >  NER (person/company/location)

pip install -r requirements.txt

# Full stack (server + Python NER detector)
GUARDAI_SESSION_SECRET=$(openssl rand -base64 32) \
  docker compose -f ../../deploy/docker/docker-compose.yml up -d

# Or the server alone (structured PII only; person tokens and the broker-over-NER case are missing).
# The shipped config binds loopback under dev auth, so both env vars make the mapped port reachable.
docker run -p 3000:3000 -e GUARDAI_HOST=0.0.0.0 -e GUARDAI_ALLOW_DEV_NON_LOOPBACK=1 \
  ghcr.io/oronts/oguardai/server:0.1.0

export GUARDAI_BASE_URL="http://localhost:3000"
export GUARDAI_API_KEY="<key>"          # only if the server enforces auth
python main.py

{
  "rheinmark": {
    "name": "Musterversicherung Nord AG",
    "policy": "german-support",
    "language": "de",
    "fnol_file": "fnol_rheinmark.txt",
    "custom_patterns": [
      { "entity_type": "claim_ref",     "pattern": "SCH-[0-9]{4}-[0-9]{1,8}\\b",              "confidence": 1.0 },
      { "entity_type": "policy_number", "pattern": "VS-[0-9]{2,6}-[0-9]{1,8}\\b",                 "confidence": 1.0 },
      { "entity_type": "adjuster_ref",  "pattern": "GUT-[0-9]{4}-[0-9]{1,8}\\b",              "confidence": 0.95 },
      { "entity_type": "handler_ref",   "pattern": "SB-[0-9]{4}-[0-9]{1,8}\\b",               "confidence": 0.95 },
      { "entity_type": "broker_agency", "pattern": "Maklerbüro ([A-Za-zÄÖÜäöüß]{2,40})\\b", "value_group": 1, "confidence": 0.95 },
      { "entity_type": "de_social_id",  "pattern": "[0-9]{2} [0-9]{6} [A-Z] [0-9]{3}\\b", "confidence": 1.0 }
    ]
  },
  "alpenverbund": {
    "name": "Musterversicherung Sued AG",
    "policy": "german-support",
    "language": "de",
    "fnol_file": "fnol_alpenverbund.txt",
    "custom_patterns": [
      { "entity_type": "claim_ref",     "pattern": "AV-CL-[0-9]{6}\\b",                   "confidence": 1.0 },
      { "entity_type": "policy_number", "pattern": "AVP-[0-9]{4}-[0-9]{1,8}\\b",              "confidence": 1.0 },
      { "entity_type": "adjuster_ref",  "pattern": "AVR-[0-9]{4}-[0-9]{1,8}\\b",              "confidence": 0.95 },
      { "entity_type": "broker_agency", "pattern": "Maklerbüro ([A-Za-zÄÖÜäöüß]{2,40})\\b", "value_group": 1, "confidence": 0.95 }
    ]
  }
}

Musterfirma: Erste Schadenmeldung (FNOL)

Mandant: Musterversicherung Nord AG
Eingang: 2026-07-06, telefonische Aufnahme durch die Hotline.

Versicherungsnehmerin: Erika Mustermann
Kontakt: erika.mustermann@kundenpost.example, Telefon 0170 5551234
Anschrift des Schadenorts: Lindenstrasse 12, 80331 München

Schaden: SCH-2026-000417
Versicherungsschein: VS-88-3320
Sparte: Wohngebäude, Leitungswasser
Gutachten: GUT-2026-19 (extern beauftragt)
Sachbearbeiter: SB-2026-07
Vermittelt durch Maklerbüro Musterbau.

Schilderung: In der Nacht auf den 5. Juli trat im Badezimmer Wasser aus einer
undichten Leitung aus. Betroffen sind Bodenbelag und Trockenbau. Die Kundin bittet
um schnelle Regulierung. Auszahlung bitte auf IBAN DE97 9900 0000 0123 4567 89.

Hinweis der Hotline: Zur Legitimation nannte die Kundin ungefragt ihre deutsche
Sozialversicherungsnummer 65 170839 K 003 sowie eine alte US-Nummer 123-45-6789 aus
ihrer Zeit im Ausland. Beides gehört nicht in die Akte und darf kein Modell erreichen.

Musterfirma: Erste Schadenmeldung (FNOL)

Mandant: Musterversicherung Sued AG
Eingang: 2026-07-07, E-Mail-Eingang.

Versicherungsnehmer: Max Mustermann
Kontakt: max.mustermann@example.de, Telefon 0151 5559876
Anschrift des Schadenorts: Amselweg 8, 82041 Deisenhofen

Schadenvorgang: AV-CL-004417
Vertrag: AVP-2026-0118
Sparte: Kfz-Kasko, Hagelschaden
Regulierer: AVR-2026-33
Vermittelt durch Maklerbüro Beispiel.

Schilderung: Beim Hagel am 3. Juli wurden Dach und Motorhaube des Fahrzeugs
eingedellt. Der Kunde bittet um Begutachtung. Auszahlung bitte auf IBAN
DE97 9900 0000 0123 4567 89.

"""Per-request custom patterns for a multi-carrier claims bureau (Python, raw HTTP).

THE PROBLEM. Musterfirma GmbH (a fictional Munich claims-processing bureau)
runs ONE OGuardAI server for several insurance carriers. A claims handler pastes an
inbound first-notice-of-loss (FNOL) report into an LLM to summarize it and draft a
German acknowledgment. Every report mixes two kinds of sensitive data:

  * Regulated PII the built-in detectors, NER, and the vertical policy already protect:
    the policyholder's name (gender-aware), email, phone, the damaged-property address,
    the payout IBAN, and the odd national ID a caller pasted by mistake.
  * Carrier-specific DOMAIN identifiers no built-in detector knows and that differ per
    carrier: the claim/Schaden number, the Versicherungsschein number, the adjuster and
    handler references, the broker agency. Musterversicherung Nord stamps `SCH-.../VS-...`; Musterversicherung Sued
    stamps `AV-CL-.../AVP-...`. Baking every tenant's regex into the server policy is
    impractical: the set is large, tenant-specific, and changes often.

THE FIX. Each request carries the tenant's identifiers as `custom_patterns`, read from a
per-carrier registry (`carriers.json`). They are validated on use, applied to that request
only, and never persisted. No policy edit, no redeploy, no server restart. A carrier's
scheme travels WITH its traffic.

THE CONTRACT (verified against the runtime, honest about precedence). A request-level
custom pattern is a SOFT detector. Highest-precedence first, the runtime resolves overlaps:
real hard-ID (SSN/IBAN/passport/...) > policy hard-custom > built-in PII (email/address/...)
> request custom_patterns > NER (person/company/location). So a custom pattern:
  * ADDS coverage for values nothing else claims (the carrier IDs), and
  * WINS the overlap against NER (it pins a broker name NER would mislabel), but
  * never SUPPRESSES a built-in PII span (it composes with them, it does not hide them).
`context_words` RAISE a match's confidence when they appear nearby; the hard context GATE
(`context_required`) and hard redaction (protection_level 1) are policy-level, not per-request.

Prerequisites:
    pip install requests
    # OGuardAI server with the NER detector (person/company/location + gender), e.g.:
    #   docker compose -f ../../deploy/docker/docker-compose.yml up -d

Usage:
    export GUARDAI_BASE_URL="http://localhost:3000"   # or GUARDAI_URL / GUARDAI_BASE
    export GUARDAI_API_KEY="<key>"                     # only if the server enforces auth
    export OPENAI_API_KEY="<key>"                      # optional; only flips a label. The
                                                       # provider is never contacted here.
    python main.py
"""

from __future__ import annotations

import json
import os
import re
import sys
from pathlib import Path

import requests

# Accept whichever base-URL var is set so the example drops into any of the repo's conventions.
BASE = (
    os.environ.get("GUARDAI_BASE_URL")
    or os.environ.get("GUARDAI_URL")
    or os.environ.get("GUARDAI_BASE")
    or "http://localhost:3000"
).rstrip("/")
API_KEY = os.environ.get("GUARDAI_API_KEY", "")

HEADERS = {"Content-Type": "application/json"}
if API_KEY:
    HEADERS["X-API-Key"] = API_KEY

HERE = Path(__file__).resolve().parent
TOKEN_RE = re.compile(r"\{\{([^}]+)\}\}")

# The model never sees raw PII; it reads OPENAI_API_KEY exactly like a real client would.
# To keep the example deterministic and offline, drafting fills a token-only German template;
# the real provider is never contacted. Setting the key only flips the printed label.
LLM_ENABLED = bool(os.environ.get("OPENAI_API_KEY"))

# Raw values from the Musterversicherung Nord FNOL that must never cross to the model. The built-ins own the
# structured identifiers, so a structured leak is a hard failure on every lane. The policyholder
# name and the broker agency depend on NER (the broker is the custom-over-NER case), so a name leak
# is a hard failure only when the runtime reports NER active, and a printed note otherwise.
STRUCTURED_SENTINELS = [
    "erika.mustermann@kundenpost.example",
    "0170 5551234",
    "DE97 9900 0000 0123 4567 89",
    "123-45-6789",
]
NER_SENTINELS = ["Erika Mustermann", "Musterbau"]


def post(path: str, body: dict) -> dict:
    resp = requests.post(f"{BASE}{path}", json=body, headers=HEADERS, timeout=60)
    # Fail closed: on any error we stop rather than fall back to processing raw text.
    # Surface the server's typed error code (GUARDAI_INVALID_INPUT, GUARDAI_POLICY_DENIED, ...).
    if resp.status_code >= 400:
        detail = resp.json() if resp.headers.get("content-type", "").startswith("application/json") else {}
        code = detail.get("code", f"HTTP_{resp.status_code}")
        # Never echo the raw upstream body: it can carry the request's PII. Trust only OGuardAI's
        # own structured error string; otherwise report the status code generically.
        error = detail.get("error")
        message = error if isinstance(error, str) else f"OGuardAI request failed (HTTP {resp.status_code})"
        raise GuardAIError(code, message, path)
    return resp.json()


class GuardAIError(RuntimeError):
    def __init__(self, code: str, message: str, path: str) -> None:
        super().__init__(f"{code} at {path}: {message}")
        self.code = code


def capabilities_ner_active() -> bool:
    """The one leak-exemption signal: /v1/capabilities.ner_active reports whether this runtime is
    configured to detect person names. If it cannot be read, treat NER as available so a name leak
    still fails closed: a protection example must never print an assurance it cannot justify."""
    try:
        resp = requests.get(f"{BASE}/v1/capabilities", headers=HEADERS, timeout=10)
    except requests.RequestException:
        return True
    if resp.status_code >= 400:
        return True
    try:
        body = resp.json()
    except ValueError:
        return True
    value = body.get("ner_active") if isinstance(body, dict) else None
    return value if isinstance(value, bool) else True


def check_boundary(text: str, ner_active: bool, *, where: str) -> list[str]:
    """Guard one string that crosses to the model. A structured identifier the built-ins own is a
    hard failure on every lane. A person or broker name is a hard failure when the runtime reports
    NER active, and a printed note otherwise, since running without NER is a valid deployment and the
    broker-agency custom-over-NER labeling degrades gracefully. Returns the name notes."""
    structured_leak = [value for value in STRUCTURED_SENTINELS if value in text]
    if structured_leak:
        raise SystemExit(f"FAIL: structured PII reached {where}: {structured_leak}")
    name_leak = [value for value in NER_SENTINELS if value in text]
    if not name_leak:
        return []
    if ner_active:
        raise SystemExit(f"FAIL: a name reached {where} while NER is active: {name_leak}")
    for value in name_leak:
        print(f"   NOTE: the name {value} reached {where} because this runtime runs without NER")
    return name_leak


def load_carriers() -> dict:
    return json.loads((HERE / "carriers.json").read_text(encoding="utf-8"))


def load_fnol(name: str) -> str:
    return (HERE / name).read_text(encoding="utf-8").strip()


def token_type(inner: str) -> str:
    """Type key from a token body: 'person:p_001:hash' -> 'person';
    'custom:claim_ref:x_001:hash' -> 'custom:claim_ref'."""
    return inner.rsplit(":", 2)[0] if inner.count(":") >= 2 else inner.split(":")[0]


def token_map(safe_text: str) -> dict[str, str]:
    """Map each entity type in one safe text to the exact token string (hash included) the
    LLM must echo. Short forms like {{person:p_001}} do NOT resolve; the rehydrator needs
    the full string it emitted."""
    out: dict[str, str] = {}
    for inner in TOKEN_RE.findall(safe_text):
        out.setdefault(token_type(inner), "{{" + inner + "}}")
    return out


def custom_types(safe_text: str) -> list[str]:
    """The carrier's domain identifier types present in one safe text, e.g. ['claim_ref', ...]."""
    seen: list[str] = []
    for inner in TOKEN_RE.findall(safe_text):
        t = token_type(inner)
        if t.startswith("custom:") and t not in seen:
            seen.append(t.split(":", 1)[1])
    return seen


def rehydrate(draft: str, session_state: str, *, restore_mode: str | None = None,
              channel: str | None = None) -> str:
    body: dict = {"output": draft, "session_state": session_state}
    if restore_mode:
        body["restore_mode"] = restore_mode
    if channel:
        body["output_channel"] = channel
    return post("/v1/rehydrate", body)["restored_text"]


def transform(text: str, carrier: dict, *, with_custom: bool = True) -> dict:
    body: dict = {"input": text, "language": carrier["language"], "policy": carrier["policy"]}
    if with_custom:
        body["custom_patterns"] = carrier["custom_patterns"]
    return post("/v1/transform", body)


# The person restore already inserts the honorific (Herr/Frau). The gender metadata only has
# to pick the adjective ending that AGREES with it: "geehrter" for Herr, "geehrte" for Frau.
# That agreement is exactly what a gender-blind drafter gets wrong.
SALUTATION = {"male": "Sehr geehrter", "female": "Sehr geehrte"}


def draft_ack(safe_text: str, entity_context: list[dict]) -> str:
    """Token-only German acknowledgment. Every {{...}} is a placeholder the rehydrator fills;
    the drafter never touches a raw value. The national-ID token is deliberately never echoed
    into a customer-facing reply, whatever the policy would allow on restore."""
    tok = token_map(safe_text)
    person = tok.get("person", "")
    gender = next((e.get("gender") for e in entity_context if e.get("token") == person), "unknown")
    opener = SALUTATION.get(gender, "Guten Tag")

    claim = tok.get("custom:claim_ref")
    iban = tok.get("iban")
    handler = tok.get("custom:handler_ref") or tok.get("custom:adjuster_ref")

    lead = f"{opener} {person}" if person else "Sehr geehrte Damen und Herren"
    ref = f" zu Ihrer Schadenmeldung {claim}" if claim else ""
    pay = f" Eine etwaige Auszahlung erfolgt ausschliesslich auf {iban}." if iban else ""
    contact = f" Rueckfragen beantwortet Ihr Sachbearbeiter unter {handler}." if handler else ""
    return (f"{lead}, wir bestaetigen den Eingang{ref} und pruefen den Vorgang."
            f"{pay}{contact}")


def rule(title: str) -> None:
    print("=" * 82)
    print(title)
    print("=" * 82)


# --- Section 1: the gap, then the per-request fix -------------------------------------------

def section_gap_and_fix(carrier: dict) -> dict:
    """Same FNOL, same policy, WITHOUT then WITH the carrier's custom_patterns. Without them
    the built-ins still protect the PII, but the carrier's domain identifiers leak raw. With
    them, on the very same request, those identifiers become typed tokens."""
    rule(f"1. THE GAP -> THE FIX  ({carrier['name']}, policy '{carrier['policy']}')")
    text = load_fnol(carrier["fnol_file"])

    without = transform(text, carrier, with_custom=False)
    with_c = transform(text, carrier, with_custom=True)

    leaked = [p["pattern"] for p in carrier["custom_patterns"]
              if re.search(p["pattern"], without["safe_text"])]
    gained = custom_types(with_c["safe_text"])

    print(f"   built-ins + NER alone: {without['stats']['entities_detected']} entities protected, "
          f"but {len(leaked)} carrier identifier pattern(s) still match RAW text:")
    print(f"     {without['safe_text']}\n")
    print(f"   + this request's custom_patterns: {with_c['stats']['entities_detected']} entities, "
          f"now protecting the carrier types {gained}:")
    print(f"     {with_c['safe_text']}\n")
    return with_c


# --- Section 2: pattern anatomy + fail-closed built-ins -------------------------------------

def section_pattern_anatomy(carrier: dict, transformed: dict) -> None:
    """Read the tokens the fix produced and name the three pattern shapes that made them,
    plus the two things the built-ins/policy did that a custom pattern is NOT for."""
    rule("2. PATTERN ANATOMY  (how each token was produced)")
    safe = transformed["safe_text"]
    by_type: dict[str, str] = {}
    for inner in TOKEN_RE.findall(safe):
        by_type.setdefault(token_type(inner), "{{" + inner + "}}")

    specs = {p["entity_type"]: p for p in carrier["custom_patterns"]}
    print("   carrier domain tokens (soft custom detectors, this request only):")
    for etype, spec in specs.items():
        token = by_type.get(f"custom:{etype}")
        if not token:
            continue
        shape = "value_group -> pins only the captured name, leaves the label untokenized" \
            if spec.get("value_group") is not None else "whole-match regex"
        print(f"     {token:44} <- /{spec['pattern']}/  ({shape}, confidence={spec['confidence']})")

    # broker_agency is the custom-wins-over-NER case: NER labels the surrounding phrase, the
    # value_group pins the actual agency name to the correct domain type.
    if by_type.get("company") and by_type.get("custom:broker_agency"):
        print("\n   custom over NER: the word 'Maklerbüro' is NER "
              f"{by_type['company']}, while the agency name is pinned to "
              f"{by_type['custom:broker_agency']} by the value_group pattern.")

    # A custom pattern never replaces the policy's own guarantees:
    if "[REDACTED:ssn]" in safe:
        print("   policy hard-redact: the pasted US SSN is dropped as [REDACTED:ssn] and never "
              "becomes a token; no custom pattern is needed or able to restore it.")
    if by_type.get("custom:de_social_id"):
        print("   safety net: the German social-insurance number, a national ID the built-ins do "
              f"not ship a matcher for in this spacing, is caught by a custom pattern "
              f"({by_type['custom:de_social_id']}) so it too leaves as a token, never raw.")
    print("   note: at request level context_words only BOOST confidence; the hard context gate "
          "and protection_level 1 are policy-level, not per-request.\n")


# --- Section 3: end-to-end, safe metadata -> gender-aware draft -> restore spectrum ---------

def section_end_to_end(carrier: dict, transformed: dict, ner_active: bool) -> list[str]:
    """The safe metadata (gender/formality) drives a correct German salutation; the LLM drafts
    on tokens; the same reply is restored per audience. The carrier claim ref restores in full
    for the handler and is masked/abstracted for downstream sinks, from ONE sealed session."""
    rule("3. END TO END  (safe metadata -> token-only draft -> restore spectrum)")
    safe, state = transformed["safe_text"], transformed["session_state"]
    ctx = transformed.get("entity_context", [])

    notes = check_boundary(safe, ner_active, where="the model")

    print("   metadata that left the boundary (drives grammar, never the raw value):")
    for ent in ctx:
        if ent.get("gender") not in (None, "unknown") or str(ent.get("token", "")).startswith("{{person"):
            print(f"     {ent['token'][:30]:32} gender={ent.get('gender'):8} "
                  f"formality={ent.get('formality'):8} lang={ent.get('language')}")

    model = "OpenAI (token-only)" if LLM_ENABLED else "offline template drafter"
    draft = draft_ack(safe, ctx)
    notes += check_boundary(draft, ner_active, where="the token-only draft")
    print(f"\n   drafting with: {model}")
    print(f"   token-only draft (what the model produced): {draft}\n")

    # One draft, three audiences, from the SAME sealed session:
    print("   per audience (one session, three channels):")
    print(f"     handler / customer (full) : {rehydrate(draft, state, restore_mode='full', channel='customer_email')}")
    print(f"     audit log (log_safe)      : {rehydrate(draft, state, channel='log_safe')}")
    print(f"     analytics (abstract)      : {rehydrate(draft, state, restore_mode='abstract')}\n")

    print("   the same reply under every restore mode (a mode only tightens what the policy "
          "allows, it never widens it):")
    for mode in ("full", "formatted", "masked", "partial", "abstract", "none"):
        print(f"     [{mode:9}] {rehydrate(draft, state, restore_mode=mode)}")
    print()
    return notes


# --- Section 4: multi-tenant on one server + fail-closed ------------------------------------

def section_multitenant(carriers: dict) -> None:
    """The whole point of per-request patterns: a second carrier with a completely different
    identifier scheme runs through the SAME server and the SAME policy with zero change, just
    a different custom_patterns set. Then a malformed pattern proves the fail-closed path."""
    rule("4. MULTI-TENANT, NO REDEPLOY  (a second carrier's scheme on the same server)")
    other = carriers["alpenverbund"]
    res = transform(load_fnol(other["fnol_file"]), other, with_custom=True)
    print(f"   {other['name']} (scheme {[p['entity_type'] for p in other['custom_patterns']]}):")
    print(f"     {res['safe_text']}")
    print(f"   protected carrier types: {custom_types(res['safe_text'])}  "
          f"(policy unchanged, server not restarted)\n")

    # Fail closed: a bad regex is rejected on use with a typed error; we never send raw text on.
    print("   fail-closed: a malformed custom pattern is rejected, the request does not proceed:")
    broken = {**other, "custom_patterns": [{"entity_type": "claim_ref", "pattern": "AV-CL-[0-9(", "confidence": 1.0}]}
    try:
        transform("Schaden AV-CL-004417.", broken, with_custom=True)
        raise SystemExit("fail-closed check failed: the runtime accepted an invalid regex")
    except GuardAIError as exc:
        print(f"     rejected with {exc.code} (raw text never left the client).\n")


def main() -> None:
    try:
        requests.get(f"{BASE}/v1/health", headers=HEADERS, timeout=10)
    except requests.RequestException as exc:
        raise SystemExit(f"Cannot reach OGuardAI at {BASE}: {exc}")
    ner_active = capabilities_ner_active()
    if not ner_active:
        print("WARNING: NER detector not active; person tokens, the gender-aware salutation, and "
              "the broker-agency (custom-over-NER) case will be missing. Start the full stack via "
              "docker compose.\n", file=sys.stderr)

    carriers = load_carriers()
    rheinmark = carriers["rheinmark"]

    try:
        transformed = section_gap_and_fix(rheinmark)
        section_pattern_anatomy(rheinmark, transformed)
        notes = section_end_to_end(rheinmark, transformed, ner_active)
        section_multitenant(carriers)
    except GuardAIError as exc:
        raise SystemExit(f"OGuardAI request failed: {exc}")

    if notes:
        leaked_names = sorted(set(notes))
        print("Done. Carrier identifiers and regulated PII stayed inside the runtime. The model saw "
              f"typed tokens for every structured value; the name(s) {leaked_names} reached it "
              "because this runtime runs without NER.")
    else:
        print("Done. Carrier identifiers and regulated PII both stayed inside the trusted zone; the model "
              "and every downstream sink saw typed tokens only, with no policy change per carrier.")


if __name__ == "__main__":
    main()

1. THE GAP -> THE FIX  (Musterversicherung Nord AG, policy 'german-support')
   built-ins + NER alone: 6 entities protected, but 5 carrier identifier pattern(s) still match RAW text:
     ... Schaden SCH-2026-000417 ... Versicherungsschein VS-88-3320 ... Maklerbüro Musterbau ...
   + this request's custom_patterns: 11 entities, now protecting the carrier types
     ['claim_ref', 'policy_number', 'adjuster_ref', 'handler_ref', 'broker_agency', 'de_social_id']:
     ... Schaden {{custom:claim_ref:x_001:...}} ... Versicherungsschein {{custom:policy_number:x_002:...}} ...

2. PATTERN ANATOMY  (how each token was produced)
   carrier domain tokens (soft custom detectors, this request only):
     {{custom:claim_ref:x_001:...}}     <- /SCH-[0-9]{4}-[0-9]{1,8}\b/  (whole-match regex, confidence=1.0)
     {{custom:broker_agency:x_005:...}} <- /Maklerbüro ([A-Za-z...]{2,40})\b/  (value_group -> pins only the captured name ...)
   custom over NER: the word 'Maklerbüro' is NER {{company:...}}, while the agency name is pinned to {{custom:broker_agency:...}} ...
   policy hard-redact: the pasted US SSN is dropped as [REDACTED:ssn] and never becomes a token ...
   safety net: the German social-insurance number ... is caught by a custom pattern ({{custom:de_social_id:...}}) ...

3. END TO END  (safe metadata -> token-only draft -> restore spectrum)
   metadata-driven salutation (gender=female): Sehr geehrte ...
   per audience (one session, three channels):
     handler / customer (full) : Sehr geehrte Frau Erika Mustermann, wir bestaetigen den Eingang zu Ihrer Schadenmeldung SCH-2026-000417 ...
     audit log (log_safe)      : Sehr geehrte [REDACTED], wir bestaetigen den Eingang zu Ihrer Schadenmeldung [REDACTED] ...
     analytics (abstract)      : Sehr geehrte (Versicherungsnehmerin), ...
   the same reply under every restore mode ...
     [full     ] ... [formatted] ... [masked   ] ... [partial  ] ... [abstract ] ... [none     ] ...

4. MULTI-TENANT, NO REDEPLOY  (a second carrier's scheme on the same server)
   Musterversicherung Sued AG (scheme ['claim_ref', 'policy_number', 'adjuster_ref', 'broker_agency']):
     Schadenvorgang {{custom:claim_ref:x_001:...}} ... Vertrag {{custom:policy_number:x_002:...}} ...
   fail-closed: a malformed custom pattern is rejected, the request does not proceed:
     rejected with GUARDAI_... (raw text never left the client).