Transformation Rules

Transformation rules let you rewrite HTTP request and response bodies using regular expressions. They are direction-aware: outbound rules apply before a request leaves the sandbox, and inbound rules apply before a response reaches your agent code. Use them to strip credentials from outbound headers, mask tokens in logs, or remove known injection patterns from responses.

Basic configuration

from declaw import Sandbox, SecurityPolicy, TransformationRule

sbx = Sandbox.create(
    security=SecurityPolicy(
        transformations=[
            TransformationRule(
                direction="outbound",
                match=r"Authorization:\s*Bearer\s+sk-\w+",
                replace="Authorization: Bearer [REDACTED]",
            ),
        ]
    )
)

TransformationRule model

Field	Type	Description
`direction`	`TransformDirection`	`"outbound"`, `"inbound"`, or `"both"`
`match`	`str`	Python `re`-compatible regex pattern
`replace`	`str`	Replacement string; supports capture group backreferences (`\1`, `\2`)

TransformDirection enum

Value	When applied
`outbound`	Applied to request bodies before they leave the sandbox
`inbound`	Applied to response bodies before they reach the workload
`both`	Applied in both directions

Multiple rules

Rules are applied in the order they are listed.

policy = SecurityPolicy(
    transformations=[
        # Strip Bearer tokens from Authorization headers
        TransformationRule(
            direction="outbound",
            match=r"(Authorization:\s*Bearer\s+)[A-Za-z0-9\-._~+/]+=*",
            replace=r"\1[REDACTED]",
        ),
        # Remove API key query parameters
        TransformationRule(
            direction="outbound",
            match=r"api_key=[A-Za-z0-9]+",
            replace="api_key=[REDACTED]",
        ),
        # Strip injection patterns from inbound content
        TransformationRule(
            direction="inbound",
            match=r"(?i)ignore\s+(all\s+)?previous\s+instructions[^.]*\.",
            replace="[CONTENT_REMOVED]",
        ),
    ]
)

Common patterns

Strip API keys from Authorization headers

TransformationRule(
    direction="outbound",
    match=r"(Authorization:\s*Bearer\s+)(sk-[A-Za-z0-9]+)",
    replace=r"\1[REDACTED]",
)

Mask database connection strings

TransformationRule(
    direction="outbound",
    match=r"(postgres://[^:]+:)[^@]+(@)",
    replace=r"\1[PASSWORD]\2",
)

Remove prompt injection patterns from responses

TransformationRule(
    direction="inbound",
    match=r"(?i)(ignore|disregard|forget)\s+(all\s+)?(previous|prior)\s+(instructions?|commands?|prompts?)",
    replace="[INJECTION_REMOVED]",
)

Strip system prompt extraction attempts

TransformationRule(
    direction="inbound",
    match=r"(?i)(print|reveal|show|display|output)\s+(your\s+)?(system\s+prompt|instructions|context)",
    replace="[INJECTION_REMOVED]",
)

TransformationRule(
    direction="both",
    match=r"\b\d{3}-\d{2}-\d{4}\b",
    replace="[SSN_REDACTED]",
)

For SSN redaction with response rehydration, use PIIConfig instead. Transformation rules are one-way and do not support rehydration.

Remove invisible Unicode injection characters

Attackers sometimes embed invisible Unicode characters in text to manipulate LLM context windows.

TransformationRule(
    direction="inbound",
    match=r"[\u200b\u200c\u200d\u2060\ufeff\u00ad]",
    replace="",
)

Combining with PII redaction

Transformation rules complement PII redaction. Use PII redaction for structured sensitive data (SSNs, credit cards) that benefits from response rehydration, and transformation rules for patterns that should be permanently removed.

policy = SecurityPolicy(
    pii=PIIConfig(
        enabled=True,
        types=["ssn", "credit_card"],
        action="redact",
        rehydrate_response=True,   # SSNs come back in responses
    ),
    transformations=[
        # API keys are permanently stripped — no rehydration needed
        TransformationRule(
            direction="outbound",
            match=r"OPENAI_API_KEY=['\"]?[A-Za-z0-9\-]+['\"]?",
            replace="OPENAI_API_KEY=[REDACTED]",
        ),
    ],
)

When TLS interception activates

Transformation rules require reading the request or response body, which means the security proxy must decrypt HTTPS traffic. TLS interception (Stage 3 of the pipeline) activates automatically when any transformation rules are configured. A per-sandbox CA certificate is generated at creation time and injected into the VM trust store. The proxy terminates TLS from the sandbox, applies transformations, and re-encrypts to the real destination. The agent code sees the destination’s certificate as usual.

Regex patterns use Go’s regexp package syntax, which is RE2-compatible. Backtracking patterns like (.+)+ are not supported. Test your patterns at regex101.com with the Go flavor selected.

Order of operations

When both PII redaction and transformation rules are active:

Outbound: Transformation rules apply first, then PII scanning on the transformed body.
Inbound: Injection defense runs, then transformation rules, then PII rehydration restores tokens.

This means transformation rules can be used to pre-process content before PII scanning, and PII rehydration always runs last so tokens are correctly restored in the final response.

Getting Started

Core Features

CLI

Security

Platform

Deployment

Architecture

Transformation Rules

Basic configuration

TransformationRule model

TransformDirection enum

Multiple rules

Common patterns

Combining with PII redaction

When TLS interception activates

Order of operations

​Basic configuration

​TransformationRule model

​TransformDirection enum

​Multiple rules

​Common patterns

​Combining with PII redaction

​When TLS interception activates

​Order of operations

Basic configuration

TransformationRule model

TransformDirection enum

Multiple rules

Common patterns

Combining with PII redaction

When TLS interception activates

Order of operations