OpenAI Drop-In Proxy

client = OpenAI(api_key="sk-...")
response = client.chat.completions.create(
    model="gpt-4",
    messages=[{"role": "user", "content": "Customer Erika Mustermann (erika.mustermann@example.com) needs help"}]
)
# Erika's name and email sent directly to OpenAI

client = OpenAI(
    api_key="sk-...",
    base_url="http://localhost:8081/v1",  # Point to OGuardAI proxy (port 8081)
    default_headers={"X-GuardAI-API-Key": os.environ["GUARDAI_PROXY_API_KEY"]},
)
response = client.chat.completions.create(
    model="gpt-4",
    messages=[{"role": "user", "content": "Contact erika.mustermann@example.com or call +49 30 12345678"}]
)
# OpenAI sees: "Contact {{email:e_001:1bcaef1a4aff}} or call {{phone:ph_001:71453119be53}}"
# Response automatically restored with original values

# Generate one proxy key; the proxy and every client must present the same value.
export GUARDAI_PROXY_API_KEY=$(openssl rand -hex 32)

# Start the OGuardAI proxy (with auth) from the published image, inheriting the exported key with a
# valueless -e. --network host serves it on the host's localhost:8081.
docker run --rm --network host \
  -e GUARDAI_SESSION_SECRET=$(openssl rand -base64 32) \
  -e GUARDAI_PROXY_API_KEY \
  ghcr.io/oronts/oguardai/proxy:0.1.0 \
  --target https://api.openai.com --policy default --port 8081 \
  --single-tenant --rate-limit-enabled

from openai import OpenAI
import os

client = OpenAI(
    base_url="http://localhost:8081/v1",
    default_headers={"X-GuardAI-API-Key": os.environ["GUARDAI_PROXY_API_KEY"]},
)

stream = client.chat.completions.create(
    model="gpt-4",
    messages=[...],
    stream=True  # Streaming works through proxy
)
for chunk in stream:
    print(chunk.choices[0].delta.content, end="")

import os
client = Anthropic(
    api_key="sk-ant-...",
    base_url="http://localhost:8081",
    default_headers={"X-GuardAI-API-Key": os.environ["GUARDAI_PROXY_API_KEY"]},
)

docker run --rm --network host \
  -e GUARDAI_SESSION_SECRET=$(openssl rand -base64 32) -e GUARDAI_PROXY_API_KEY \
  ghcr.io/oronts/oguardai/proxy:0.1.0 \
  --target https://api.mistral.ai --policy default --port 8081 --single-tenant --rate-limit-enabled
# or pass the target as an env var: -e GUARDAI_PROXY_TARGET=https://api.mistral.ai
# GUARDAI_PROXY_API_KEY is inherited from the value exported in Setup above.

docker run --rm --network host \
  -e GUARDAI_SESSION_SECRET=$(openssl rand -base64 32) -e GUARDAI_PROXY_API_KEY \
  ghcr.io/oronts/oguardai/proxy:0.1.0 \
  --provider azure \
  --target https://my-resource.openai.azure.com \
  --policy default --port 8081 --single-tenant --rate-limit-enabled

docker run --rm --network host \
  -e GUARDAI_SESSION_SECRET=$(openssl rand -base64 32) -e GUARDAI_PROXY_API_KEY \
  ghcr.io/oronts/oguardai/proxy:0.1.0 \
  --provider vertex-openai \
  --target https://us-central1-aiplatform.googleapis.com \
  --policy default --port 8081 --single-tenant --rate-limit-enabled

# NER sidecar, bound to loopback (it runs unauthenticated, so keep it on 127.0.0.1)
docker run -d --rm --network host -e GUARDAI_DETECTOR_ALLOW_INSECURE=true \
  --name oguardai-detector ghcr.io/oronts/oguardai/detector-py:0.1.0 \
  --host 127.0.0.1 --port 9090

# Proxy in advanced (NER-required) mode with the strict-pii policy. GUARDAI_PROXY_API_KEY is inherited
# from the value exported in Setup above.
docker run --rm --network host \
  -e GUARDAI_SESSION_SECRET=$(openssl rand -base64 32) -e GUARDAI_PROXY_API_KEY \
  -e GUARDAI_DETECTOR_MODE=advanced -e GUARDAI_DETECTOR_ADVANCED_URL=http://localhost:9090 \
  ghcr.io/oronts/oguardai/proxy:0.1.0 \
  --target https://api.openai.com --policy strict-pii --port 8081 --single-tenant --rate-limit-enabled

Your App
  |
  | (standard OpenAI SDK calls)
  v
OGuardAI Proxy (port 8081)
  |
  | 1. Transform: mask PII in request
  | 2. Forward: send safe request to OpenAI
  | 3. Rehydrate: restore tokens in response
  |
  v
OpenAI API (never sees real PII)

# Start the OGuardAI runtime (server + NER detector). NER is needed for person/address. The bundled
# stack requires these four secrets, and its client key ships least-privilege, so widen it to the
# customer-support-en policy and the channels this walkthrough restores on (user_output,
# internal_summary).
export GUARDAI_SESSION_SECRET=$(openssl rand -base64 32)
export GUARDAI_API_KEY_1=$(openssl rand -hex 32)
export GUARDAI_DETECTOR_API_KEY=$(openssl rand -hex 32)
export GUARDAI_REDIS_PASSWORD=$(openssl rand -hex 32)
export GUARDAI_API_KEY_1_ALLOWED_POLICIES=default,default-ner-required,german-support,customer-support-en
export GUARDAI_API_KEY_1_ALLOWED_OUTPUT_CHANNELS=user_output,internal_summary
docker compose -f deploy/docker/docker-compose.yml up -d

# Run the walkthrough. No OpenAI key, no proxy, no pip install required.
export GUARDAI_URL=http://localhost:3000
export GUARDAI_API_KEY="$GUARDAI_API_KEY_1"   # the bundled stack runs api_key auth
python main.py

From: erika.mustermann@example-mail.com
To: support@example.com
Subject: Wrong size delivered, order MO-2026-88214

Hello Musterfirma Support,

my name is Ms. Erika Mustermann (customer number CUST-583920). I ordered the
Ridgeline down jacket in medium, but order MO-2026-88214 arrived in extra small
and I would like to exchange it for the correct size.

You can reach me by email at erika.mustermann@example-mail.com or by phone at
+1 (415) 555-0182. My delivery address is 1420 Example Street, Portland, OR 97205.

If a refund turns out to be easier than an exchange, please send it to my bank
account, IBAN GB29 NWBK 6016 1331 9268 19.

Thanks for your help,
Erika Mustermann

POLICY = "customer-support-en"
LANGUAGE = "en"
HERE = Path(__file__).resolve().parent
ORDER_FILE = HERE / "order_issue.txt"

# System instruction the agent gives the model. It names no customer data: the model works entirely
# from tokens plus the metadata OGuardAI attaches to each one.
SYSTEM_PROMPT = (
    "You are a customer-support assistant for Musterfirma. Write a short, courteous reply "
    "in English that confirms the order, acknowledges the wrong-size delivery, and explains the "
    "exchange or refund next steps. The message contains {{type:id:cap}} placeholders that stand for "
    "real data you must not see. Copy every placeholder verbatim; never decode, translate, "
    "reformat, or invent one, and never write a real name, email, phone number, or IBAN yourself. "
    "Do not write a salutation word before a person placeholder: the runtime inserts the correct "
    "Mr./Ms. honorific itself. Open with 'Hello {{person:...}},'."
)

STRUCTURED_PII = {
    "customer email": "erika.mustermann@example-mail.com",
    "support email": "support@example.com",
    "phone": "+1 (415) 555-0182",
    "customer id": "CUST-583920",
    "order": "MO-2026-88214",
    "iban": "GB29 NWBK 6016 1331 9268 19",
}
NER_PII = {
    "name": "Erika Mustermann",
    "address": "1420 Example Street",
}

# The built-in order detector knows common prefixes, not this tenant's scheme, so the order id
# would reach the model raw. A custom pattern is how a deployment declares its own identifiers.
CUSTOM_PATTERNS = [
    {"entity_type": "order_ref", "pattern": r"\bMO-\d{4}-\d{5}\b", "confidence": 0.99}
]

def transform(
    text: str,
    policy: str,
    language: str | None = None,
    context: dict[str, Any] | None = None,
    custom_patterns: list[dict[str, Any]] | None = None,
) -> dict[str, Any]:
    """Detect + tokenize `text` under `policy`. Returns safe_text, session_state, entity_context."""
    payload: dict[str, Any] = {"input": text, "policy": policy}
    if language:
        payload["language"] = language
    if context:
        payload["context"] = context
    if custom_patterns:
        payload["custom_patterns"] = custom_patterns
    return _post("/v1/transform", payload)


def rehydrate(
    output: str,
    session_state: str,
    *,
    output_channel: str | None = None,
    restore_mode: str | None = None,
    restore_overrides: dict[str, str] | None = None,
) -> dict[str, Any]:
    """Restore tokens in `output` under the session, governed by channel / restore mode."""
    payload: dict[str, Any] = {"output": output, "session_state": session_state}
    if output_channel:
        payload["output_channel"] = output_channel
    if restore_mode:
        payload["restore_mode"] = restore_mode
    if restore_overrides:
        payload["restore_overrides"] = restore_overrides
    return _post("/v1/rehydrate", payload)

pip install -r requirements.txt   # OpenAI SDK, only needed for --live

# This example masks person names (and exposes gender/formality metadata), which needs NER, so run
# the detector in the host network namespace and put the proxy in `advanced` mode (NER required, fail
# closed on a sidecar outage). `customer-support-en` declares person and company detection as
# required, so the proxy refuses to start in `builtin` or `both` mode. `--host 127.0.0.1` keeps the
# unauthenticated detector bound to loopback, reachable by the proxy on the same host but not exposed
# on any other interface.
docker run -d --rm --network host -e GUARDAI_DETECTOR_ALLOW_INSECURE=true \
  --name oguardai-detector ghcr.io/oronts/oguardai/detector-py:0.1.0 \
  --host 127.0.0.1 --port 9090   # NER sidecar bound to loopback :9090

# Start the proxy in front of OpenAI, from the published image (the release archive ships the CLI and
# server only, not a proxy binary). --network host lets the proxy reach the detector on
# localhost:9090 and serve on the host's localhost:8081. GUARDAI_PROXY_API_KEY is the value the client
# sends as X-GuardAI-API-Key; the SDK's OPENAI_API_KEY bearer token is forwarded upstream unchanged.
# --policy pins the same policy the explain path uses, and GUARDAI_DETECTOR_CUSTOM declares the tenant
# order id pattern the explain path passes per request, so the proxy masks it too.
export GUARDAI_SESSION_SECRET=$(openssl rand -base64 32)
export GUARDAI_PROXY_API_KEY=$(openssl rand -hex 32)
export GUARDAI_DETECTOR_MODE=advanced
export GUARDAI_DETECTOR_ADVANCED_URL=http://localhost:9090
export GUARDAI_DETECTOR_CUSTOM='[{"entity_type":"order_ref","pattern":"\\bMO-\\d{4}-\\d{5}\\b","confidence":0.99}]'
docker run --rm --network host \
  -e GUARDAI_SESSION_SECRET -e GUARDAI_PROXY_API_KEY \
  -e GUARDAI_DETECTOR_MODE -e GUARDAI_DETECTOR_ADVANCED_URL -e GUARDAI_DETECTOR_CUSTOM \
  ghcr.io/oronts/oguardai/proxy:0.1.0 \
  --port 8081 --target https://api.openai.com --policy customer-support-en \
  --single-tenant --rate-limit-enabled

# In another shell, point the SDK at the proxy and run for real.
export OPENAI_API_KEY="sk-..."             # your real OpenAI key, read from the environment
export GUARDAI_PROXY_API_KEY="<same-as-above>"
export GUARDAI_MODEL="gpt-4o-mini"          # optional, via OPENAI_MODEL
python main.py --live

def run_live(order: str) -> int:
    # Imported lazily so the explain path needs no third-party packages.
    try:
        from openai import OpenAI
    except ImportError:
        print("Live mode needs the OpenAI SDK: pip install openai", file=sys.stderr)
        return 2

    proxy_url = os.environ.get("GUARDAI_PROXY_URL", "http://localhost:8081") + "/v1"
    proxy_key = os.environ.get("GUARDAI_PROXY_API_KEY", "")
    if not os.environ.get("OPENAI_API_KEY"):
        print("Live mode needs OPENAI_API_KEY (forwarded by the proxy to OpenAI).", file=sys.stderr)
        return 2

    # The only change from a normal OpenAI integration: base_url points at the proxy, and the
    # proxy's own auth key rides in X-GuardAI-API-Key. The SDK still sends OPENAI_API_KEY as its
    # bearer token, which the proxy forwards upstream. Everything else is stock OpenAI.
    client = OpenAI(
        base_url=proxy_url,
        default_headers={"X-GuardAI-API-Key": proxy_key},
    )
    model = os.environ.get("OPENAI_MODEL", "gpt-4o-mini")

    print(RULE)
    print(f"LIVE MODE: OpenAI SDK -> OGuardAI proxy ({proxy_url}) -> OpenAI ({model})")
    print(RULE)
    completion = client.chat.completions.create(
        model=model,
        messages=[
            {"role": "system", "content": SYSTEM_PROMPT},
            {"role": "user", "content": order},
        ],
    )
    # The model saw only tokens; the proxy restored real values on the user_output channel before
    # this response reached the SDK.
    print("\nRestored draft returned by the proxy:\n")
    print(completion.choices[0].message.content)
    return 0

openai>=1.0.0

[1] What leaves your network (sent to OpenAI):
    ... my name is {{person:p_001:...}} (customer number {{customer_id:cid_001:...}}) ...
    ... order {{order:o_001:...}} ... email at {{email:e_001:...}} ... phone at {{phone:ph_001:...}} ...
    ... IBAN {{iban:ib_001:...}}.
[1b] Leak check on the outbound text:
    PASS, none of the 8 raw values are present. detector: builtin_and_ner

[2] Safe metadata the model receives with the tokens:
    type          gender    formality   role        lang
    email         -         -           customer    en
    person        female    formal      customer    en
    ...

[4] What your OpenAI client receives back (user_output restore):
    Hello Ms. Erika Mustermann, ...  (IBAN stays masked)

[5] Restore-mode ladder on the salutation (same session, same draft):
    full       -> Hello Erika Mustermann,
    formatted  -> Hello Ms. Erika Mustermann,
    partial    -> Hello E. Mustermann,
    masked     -> Hello E**** *********n,
    none       -> Hello [REDACTED],

[6] Role-gated tightening (caller_role=support_agent, internal_summary channel):
    agent console sees -> Hello E. Mustermann,

[7] Fail-closed guards:
    tampered session -> rejected with GUARDAI_INVALID_INPUT (HTTP 400); no raw value returned
    forged token     -> resolved=0 unresolved=['{{iban:ib_999:deadbeef0000}}'] (left verbatim, never guessed)

# Start the OGuardAI runtime (the product under test). NER is needed for person/company/address. The
# bundled stack requires these four secrets, and its client key ships least-privilege, so widen it to
# the crm-sales policy and the channels this walkthrough restores on (user_output, crm_sync,
# sales_export, log_safe).
export GUARDAI_SESSION_SECRET=$(openssl rand -base64 32)
export GUARDAI_API_KEY_1=$(openssl rand -hex 32)
export GUARDAI_DETECTOR_API_KEY=$(openssl rand -hex 32)
export GUARDAI_REDIS_PASSWORD=$(openssl rand -hex 32)
export GUARDAI_API_KEY_1_ALLOWED_POLICIES=default,default-ner-required,german-support,crm-sales
export GUARDAI_API_KEY_1_ALLOWED_OUTPUT_CHANNELS=user_output,crm_sync,sales_export,log_safe
docker compose -f deploy/docker/docker-compose.yml up -d

# Run the walkthrough. No OpenAI key, no proxy, no npm install of openai required.
export GUARDAI_URL=http://localhost:3000
export GUARDAI_API_KEY="$GUARDAI_API_KEY_1"   # the bundled stack runs api_key auth
npx tsx index.ts

From: erika.mustermann@example.com
To: max.mustermann@example.com
Subject: Re: Musterfirma proposal, opportunity OPP-2026-4471

Hi Max,

thanks for the walkthrough yesterday. This is Erika Mustermann, VP Operations at
Beispielfirma and the economic buyer on our side.

We are moving forward internally on opportunity OPP-2026-4471 against account
ACCT-88213. Our lead score in your system is lead score: 82, which sounds about
right given our timeline.

Could you send a follow-up summarizing the enterprise tier and next steps? You can
reach me at erika.mustermann@example.com or on +49 89 4455123.

Best,
Erika

Quick internal note before the call: the prospect accidentally pasted a corporate
card, 4111 1111 1111 1111, into the email thread for opportunity OPP-2026-4471.
Please scrub it from the record.

const POLICY = "crm-sales";
const LANGUAGE = "en";
const HERE = dirname(fileURLToPath(import.meta.url));

// System instruction the rep gives the model. It names no prospect data: the model works entirely
// from tokens plus the metadata OGuardAI attaches to each one.
const SYSTEM_PROMPT = [
  "You are a B2B sales copilot for Musterfirma. Draft a concise, friendly follow-up email to a",
  "prospect that summarizes the enterprise tier and proposes next steps. The message contains",
  "{{type:id:cap}} placeholders that stand for real data you must not see. Copy every placeholder",
  "verbatim; never decode, translate, reformat, or invent one, and never write a real name, company,",
  "email, or deal id yourself. Do not write a salutation word before a person placeholder: the",
  "runtime inserts the correct honorific. Open with 'Hi {{person:...}},'.",
].join(" ");

// Structured identifiers the runtime detects deterministically: builtin regex for the emails and
// phone, and the crm-sales custom_patterns for the opportunity and account ids. They must never
// reach the model on any deployment, so their presence in the outbound text is a hard failure.
const STRUCTURED_PII = [
  "erika.mustermann@example.com",
  "max.mustermann@example.com",
  "+49 89 4455123",
  "OPP-2026-4471",
  "ACCT-88213",
];

// Prospect and account names. These are NER-only: the regex floor detects no names, so a runtime
// without NER cannot tokenize them. crm-sales lists person and company under detection.required_for,
// so such a runtime refuses the request instead of leaking them.
const NER_PII = ["Erika Mustermann", "Beispielfirma"];

export function transform(
  input: string,
  opts: { policy: string; language?: string; context?: TransformContext },
): Promise<TransformResult> {
  return post<TransformResult>("/v1/transform", {
    input,
    input_type: "text",
    policy: opts.policy,
    language: opts.language,
    context: opts.context,
  });
}

export function rehydrate(opts: {
  output: string;
  sessionState: string;
  channel?: string;
  restoreMode?: string;
}): Promise<RehydrateResult> {
  return post<RehydrateResult>("/v1/rehydrate", {
    output: opts.output,
    session_state: opts.sessionState,
    output_channel: opts.channel,
    restore_mode: opts.restoreMode,
  });
}

npm install   # installs the openai SDK (declared in package.json), only needed for --live

# In another shell, point the SDK at the proxy and run for real.
export OPENAI_API_KEY="sk-..."             # your real OpenAI key, read from the environment
export GUARDAI_PROXY_API_KEY="<same-as-above>"
export OPENAI_MODEL="gpt-4o-mini"           # optional
npx tsx index.ts --live

async function runLive(): Promise<number> {
  const proxyUrl = `${process.env.GUARDAI_PROXY_URL ?? "http://localhost:8081"}/v1`;
  const proxyKey = process.env.GUARDAI_PROXY_API_KEY ?? "";
  if (!process.env.OPENAI_API_KEY) {
    console.error("Live mode needs OPENAI_API_KEY (forwarded by the proxy to OpenAI).");
    return 2;
  }

  // Imported lazily so the explain path needs no third-party packages.
  const { default: OpenAI } = await import("openai");

  // The only change from a normal OpenAI integration: baseURL points at the proxy, and the proxy's
  // own auth key rides in X-GuardAI-API-Key. The SDK still sends OPENAI_API_KEY as its bearer token,
  // which the proxy forwards upstream. Everything else is stock OpenAI.
  const client = new OpenAI({
    baseURL: proxyUrl,
    defaultHeaders: { "X-GuardAI-API-Key": proxyKey },
  });
  const model = process.env.OPENAI_MODEL ?? "gpt-4o-mini";

  console.log(RULE);
  console.log(`LIVE MODE: OpenAI SDK -> OGuardAI proxy (${proxyUrl}) -> OpenAI (${model})`);
  console.log(RULE);
  const completion = await client.chat.completions.create({
    model,
    messages: [
      { role: "system", content: SYSTEM_PROMPT },
      { role: "user", content: fixture("prospect_inbound.txt") },
    ],
  });
  // The model saw only tokens; the proxy restored real values on the user_output channel before
  // this response reached the SDK.
  console.log("\nRestored draft returned by the proxy:\n");
  console.log(completion.choices[0]?.message.content ?? "");
  return 0;
}

{
  "name": "guardai-openai-proxy-node",
  "version": "1.0.0",
  "description": "OpenAI Node SDK with OGuardAI transparent PII proxy",
  "type": "module",
  "scripts": {
    "typecheck": "tsc --noEmit",
    "test": "npx tsx --test og_runtime.test.ts",
    "start": "npx tsx index.ts",
    "explain": "npx tsx index.ts --explain",
    "live": "npx tsx index.ts --live"
  },
  "dependencies": {
    "openai": "^4.0.0"
  },
  "devDependencies": {
    "@types/node": "^20",
    "tsx": "^4.0",
    "typescript": "^5.5"
  }
}

[1] What leaves your network (sent to OpenAI):
    ... This is {{person:p_001:...}}, VP Operations at {{company:c_001:...}} ...
    ... opportunity {{custom:deal_id:x_001:...}} against account {{custom:account_id:x_002:...}} ...
    ... lead score: {{custom:lead_score:x_003:...}} ... reach me at {{email:e_001:...}} or on {{phone:ph_001:...}}.
[1b] Leak check on the outbound text:
    PASS, none of the 7 raw values are present. detector: builtin_and_ner

[4] One session, four readers (same draft, different restore):
    --- channel=user_output  (...) ---     opportunity OPP-2026-4471 for Beispielfirma, real email
    --- channel=crm_sync     (...) ---     ids and contacts masked
    --- channel=sales_export (...) ---     names abstracted, contacts dropped
    --- channel=log_safe     (...) ---     everything redacted

[5] Role-gated deal id (user_output channel, same inbound):
    caller_role=sales_rep -> ... opportunity OPP-2026-4471 ...
    no role               -> ... opportunity ******** ...

[6] Fail-closed guards:
    a) tampered session -> rejected with GUARDAI_INVALID_INPUT (HTTP 400); no raw value returned
    b) forged token     -> resolved=0 unresolved=["{{custom:deal_id:x_999:deadbeef0000}}"] (left verbatim, never guessed)
    c) pasted card      -> whole request blocked: GUARDAI_POLICY_DENIED (HTTP 403); the model was never called

# The bundled stack requires these four secrets, and its client key ships least-privilege, so widen it
# to the insurance-de policy and the channels this walkthrough restores on (user_output,
# customer_email, reinsurer_export, log_safe).
export GUARDAI_SESSION_SECRET=$(openssl rand -base64 32)
export GUARDAI_API_KEY_1=$(openssl rand -hex 32)
export GUARDAI_DETECTOR_API_KEY=$(openssl rand -hex 32)
export GUARDAI_REDIS_PASSWORD=$(openssl rand -hex 32)
export GUARDAI_API_KEY_1_ALLOWED_POLICIES=default,default-ner-required,german-support,insurance-de
export GUARDAI_API_KEY_1_ALLOWED_OUTPUT_CHANNELS=user_output,customer_email,reinsurer_export,log_safe
docker compose -f deploy/docker/docker-compose.yml up -d

export GUARDAI_BASE_URL=http://localhost:3000
export GUARDAI_API_KEY="$GUARDAI_API_KEY_1"   # the bundled stack runs api_key auth
python main.py

Von: erika.mustermann@example-mail.de
An: schaden@example.de
Betreff: Schadenmeldung Kaskoversicherung, Auffahrunfall vom 04.07.2026

Sehr geehrte Damen und Herren,

ich, Frau Dr. Erika Mustermann, Versicherungsnehmerin, moechte einen Schaden
melden. Am 04.07.2026 ist mir auf der A9 ein Fahrzeug aufgefahren.

Meine Kontaktdaten fuer Rueckfragen: E-Mail erika.mustermann@example-mail.de,
Telefon +49 89 1122334. Anschrift: Musterstrasse 47, 80331 Muenchen.

Zum Vertrag: Versicherungsschein-Nr. VS-4820091, Schadennummer SCH-2026-55831.
Meine Steuer-Identifikationsnummer lautet 86 095 742 719.
Betroffen ist mein Fahrzeug, Fahrgestellnummer WVWZZZ1KZAW008421,
amtliches Kennzeichen M-KV 2847.

Bitte ueberweisen Sie eine etwaige Erstattung auf meine IBAN
DE97 9900 0000 0123 4567 89. Nach Einschaetzung meiner Werkstatt liegt der
Schaden bei rund 18.500 EUR.

Bitte bestaetigen Sie mir kurz den Eingang und die weiteren Schritte.

Mit freundlichen Gruessen
Dr. Erika Mustermann

POLICY = "insurance-de"
LANGUAGE = "de"
HERE = Path(__file__).resolve().parent
CLAIM_FILE = HERE / "claim_email.txt"

# System instruction the agent gives Claude. It intentionally names no customer data: the model
# works entirely from tokens plus the metadata OGuardAI attaches to each one.
SYSTEM_PROMPT = (
    "Du bist die Schadenassistenz der Musterversicherung AG. Formuliere eine kurze, formelle "
    "Eingangsbestaetigung auf Deutsch (Sie-Form). Sprich die Person mit korrekter Anrede an, "
    "nenne Versicherungsschein- und Schadennummer, bestaetige die hinterlegte Bankverbindung fuer "
    "eine etwaige Erstattung und kuendige die Pruefung an. Behandle jeden {{typ:id:pruefsumme}}-Platzhalter als "
    "unveraenderlichen Baustein: niemals dekodieren, umschreiben oder erfinden."
)

STRUCTURED_PII = [
    "erika.mustermann@example-mail.de",
    "schaden@example.de",
    "+49 89 1122334",
    "86 095 742 719",
    "DE97 9900 0000 0123 4567 89",
    "18.500",
    "VS-4820091",
    "SCH-2026-55831",
    "WVWZZZ1KZAW008421",
    "M-KV 2847",
]
NER_PII = [
    "Erika Mustermann",
]

def transform(text: str, policy: str, language: str | None = None) -> dict[str, Any]:
    """Detect + tokenize `text` under `policy`. Returns safe_text, session_state, entity_context."""
    payload: dict[str, Any] = {"input": text, "policy": policy}
    if language:
        payload["language"] = language
    return _post("/v1/transform", payload)


def rehydrate(
    output: str,
    session_state: str,
    *,
    output_channel: str | None = None,
    restore_mode: str | None = None,
    restore_overrides: dict[str, str] | None = None,
) -> str:
    """Restore tokens in `output` under the session, governed by channel / restore mode."""
    payload: dict[str, Any] = {"output": output, "session_state": session_state}
    if output_channel:
        payload["output_channel"] = output_channel
    if restore_mode:
        payload["restore_mode"] = restore_mode
    if restore_overrides:
        payload["restore_overrides"] = restore_overrides
    return _post("/v1/rehydrate", payload)["restored_text"]

export GUARDAI_SESSION_SECRET=$(openssl rand -base64 32)
export GUARDAI_PROXY_API_KEY=$(openssl rand -hex 32)
export GUARDAI_DETECTOR_MODE=advanced
export GUARDAI_DETECTOR_ADVANCED_URL=http://localhost:9090

# NER detector in the host network namespace, from the published image. `--host 127.0.0.1` keeps the
# unauthenticated detector bound to loopback, reachable by the proxy on the same host (localhost:9090)
# but not exposed on any other interface.
docker run -d --rm --network host -e GUARDAI_DETECTOR_ALLOW_INSECURE=true \
  --name oguardai-detector ghcr.io/oronts/oguardai/detector-py:0.1.0 \
  --host 127.0.0.1 --port 9090

# The proxy runs from the published image (the release archive ships the CLI and server only, not a
# proxy binary). --network host lets it reach the detector on localhost:9090 and serve on
# localhost:8081.
docker run --rm --network host \
  -e GUARDAI_SESSION_SECRET -e GUARDAI_PROXY_API_KEY \
  -e GUARDAI_DETECTOR_MODE -e GUARDAI_DETECTOR_ADVANCED_URL \
  ghcr.io/oronts/oguardai/proxy:0.1.0 \
  --provider anthropic --target https://api.anthropic.com \
  --port 8081 --policy insurance-de --single-tenant --rate-limit-enabled

pip install -r requirements.txt
export ANTHROPIC_API_KEY=sk-ant-...
export GUARDAI_PROXY_API_KEY=<same value the proxy was started with>
export GUARDAI_PROXY_URL=http://localhost:8081
python main.py --live

def run_live(claim: str) -> int:
    # Imported lazily so the explain path needs no third-party packages.
    try:
        import anthropic
    except ImportError:
        print("Live mode needs the Anthropic SDK: pip install anthropic", file=sys.stderr)
        return 2

    proxy_url = os.environ.get("GUARDAI_PROXY_URL", "http://localhost:8081")
    proxy_key = os.environ.get("GUARDAI_PROXY_API_KEY", "")
    if not os.environ.get("ANTHROPIC_API_KEY"):
        print("Live mode needs ANTHROPIC_API_KEY (forwarded by the proxy to Claude).", file=sys.stderr)
        return 2

    # The only change from a normal Anthropic integration: base_url points at the proxy, and the
    # proxy's own auth key rides in X-GuardAI-API-Key. The SDK still sends ANTHROPIC_API_KEY, which
    # the proxy forwards upstream. Everything else is stock Anthropic.
    client = anthropic.Anthropic(
        base_url=proxy_url,
        default_headers={"X-GuardAI-API-Key": proxy_key},
    )
    model = os.environ.get("ANTHROPIC_MODEL", "claude-sonnet-4-5")

    print(RULE)
    print(f"LIVE MODE: Anthropic SDK -> OGuardAI proxy ({proxy_url}) -> Claude ({model})")
    print(RULE)
    message = client.messages.create(
        model=model,
        max_tokens=512,
        system=SYSTEM_PROMPT,
        messages=[{"role": "user", "content": claim}],
    )
    text = "".join(block.text for block in message.content if block.type == "text")
    # The model saw only tokens; the proxy restored real values on the user_output channel before
    # this response reached the SDK.
    print("\nRestored draft returned by the proxy:\n")
    print(text)
    return 0

anthropic>=0.40

[1] What leaves your network (sent to Claude):
... ich, Frau Dr. {{person:p_001:...}}, Versicherungsnehmerin, ...
Versicherungsschein-Nr. {{custom:policy_number:x_001:...}}, Schadennummer {{custom:claim_id:x_002:...}}.
Meine Steuer-Identifikationsnummer lautet {{custom:de_tax_id:x_003:...}}.

[1b] Leak check on the outbound text:
    PASS, none of the 11 raw values are present. detector: builtin_and_ner

[2] Safe metadata Claude receives with the tokens:
    type                  gender    formality   role          lang
    person                female    formal      policyholder  de
    ...

[4] Restoration is governed per destination (same session, different reader):
    --- channel=customer_email ---
    ... Versicherungsschein-Nr. VS-4820091 ... Bankverbindung D*** **** **** **** **** *0 ...
        Rueckstellung liegt bei moderate (5k-50k).
    --- channel=reinsurer_export ---
    ... Versicherungsschein-Nr. V********1 ... Bankverbindung [REDACTED] ...
    --- channel=log_safe ---
    Sehr geehrte [REDACTED], ... Versicherungsschein-Nr. [REDACTED] ...

[5] Fail-closed: a tampered session must not restore anything:
    PASS, rejected with GUARDAI_INVALID_INPUT (HTTP 400); no raw value returned