Transformation Rules

Transformation rules let you rewrite HTTP request and response bodies using regular expressions. They are direction-aware: outbound rules apply before a request leaves the sandbox, and inbound rules apply before a response reaches your agent code. Use them to strip credentials from outbound headers, mask tokens in logs, or remove known injection patterns from responses.

Basic configuration

from declaw import Sandbox, SecurityPolicy, TransformationRule

sbx = Sandbox.create(
    security=SecurityPolicy(
        transformations=[
            TransformationRule(
                direction="outbound",
                match=r"Authorization:\s*Bearer\s+sk-\w+",
                replace="Authorization: Bearer [REDACTED]",
            ),
        ]
    )
)

TransformationRule model

Field	Type	Description
`direction`	`TransformDirection`	`"outbound"`, `"inbound"`, or `"both"`
`match`	`str`	Python `re`-compatible regex pattern
`replace`	`str`	Replacement string; supports capture group backreferences (`\1`, `\2`)

TransformDirection enum

Value	When applied
`outbound`	Applied to request bodies before they leave the sandbox
`inbound`	Applied to response bodies before they reach the workload
`both`	Applied in both directions

Multiple rules

Rules are applied in the order they are listed.

policy = SecurityPolicy(
    transformations=[
        # Strip Bearer tokens from Authorization headers
        TransformationRule(
            direction="outbound",
            match=r"(Authorization:\s*Bearer\s+)[A-Za-z0-9\-._~+/]+=*",
            replace=r"\1[REDACTED]",
        ),
        # Remove API key query parameters
        TransformationRule(
            direction="outbound",
            match=r"api_key=[A-Za-z0-9]+",
            replace="api_key=[REDACTED]",
        ),
        # Strip injection patterns from inbound content
        TransformationRule(
            direction="inbound",
            match=r"(?i)ignore\s+(all\s+)?previous\s+instructions[^.]*\.",
            replace="[CONTENT_REMOVED]",
        ),
    ]
)

Common patterns

Strip API keys from Authorization headers

TransformationRule(
    direction="outbound",
    match=r"(Authorization:\s*Bearer\s+)(sk-[A-Za-z0-9]+)",
    replace=r"\1[REDACTED]",
)

Mask database connection strings

TransformationRule(
    direction="outbound",
    match=r"(postgres://[^:]+:)[^@]+(@)",
    replace=r"\1[PASSWORD]\2",
)

Remove prompt injection patterns from responses

TransformationRule(
    direction="inbound",
    match=r"(?i)(ignore|disregard|forget)\s+(all\s+)?(previous|prior)\s+(instructions?|commands?|prompts?)",
    replace="[INJECTION_REMOVED]",
)

Strip system prompt extraction attempts

TransformationRule(
    direction="inbound",
    match=r"(?i)(print|reveal|show|display|output)\s+(your\s+)?(system\s+prompt|instructions|context)",
    replace="[INJECTION_REMOVED]",
)

TransformationRule(
    direction="both",
    match=r"\b\d{3}-\d{2}-\d{4}\b",
    replace="[SSN_REDACTED]",
)

For SSN redaction with response rehydration, use PIIConfig instead. Transformation rules are one-way and do not support rehydration.

Remove invisible Unicode injection characters

Attackers sometimes embed invisible Unicode characters in text to manipulate LLM context windows.

TransformationRule(
    direction="inbound",
    match=r"[\u200b\u200c\u200d\u2060\ufeff\u00ad]",
    replace="",
)

Combining with PII redaction

Transformation rules complement PII redaction. Use PII redaction for structured sensitive data (SSNs, credit cards) that benefits from response rehydration, and transformation rules for patterns that should be permanently removed.

policy = SecurityPolicy(
    pii=PIIConfig(
        enabled=True,
        types=["ssn", "credit_card"],
        action="redact",
        rehydrate_response=True,   # SSNs come back in responses
    ),
    transformations=[
        # API keys are permanently stripped — no rehydration needed
        TransformationRule(
            direction="outbound",
            match=r"OPENAI_API_KEY=['\"]?[A-Za-z0-9\-]+['\"]?",
            replace="OPENAI_API_KEY=[REDACTED]",
        ),
    ],
)

When TLS interception activates

Transformation rules require reading the request or response body, which means the security proxy must decrypt HTTPS traffic. TLS interception (Stage 3 of the pipeline) activates automatically when any transformation rules are configured. A per-sandbox CA certificate is generated at creation time and injected into the VM trust store. The proxy terminates TLS from the sandbox, applies transformations, and re-encrypts to the real destination. The agent code sees the destination’s certificate as usual.

Regex patterns use Go’s regexp package syntax, which is RE2-compatible. Backtracking patterns like (.+)+ are not supported. Test your patterns at regex101.com with the Go flavor selected.

Order of operations

When both PII redaction and transformation rules are active:

Outbound (sandbox → destination): invisible-text stripping, then PII redaction, then transformation rules last.
Inbound (destination → sandbox): untrusted-content capture (for the optional LLM judge’s session store — this observes, it does not block), then PII rehydration, then transformation rules last.

In both directions transformation rules run last, on a body that PII has already rewritten.

Transformation rules cannot pre-process content before PII scanning. By the time an outbound rule runs, PII redaction has already replaced matching values with tokens such as REDACTED_EMAIL_ADDRESS_1.A rule written to match text that PII also matches — an API key, an email, an account number — may therefore never fire, because the value it targets is no longer there. If a rule must see the original text, do not rely on ordering: narrow the PII scanner’s types, or scope it to different domains, so the two are not competing for the same content.

Streaming (SSE) responses

Inbound transformation rules are not applied to text/event-stream responses. Only PII rehydration is supported on SSE, because applying transformations would require buffering an unbounded stream. The same exception applies to untrusted-content capture: a streamed response is not recorded in the LLM judge’s session store, so indirect injection delivered over SSE will not arm the indirect trigger. Direct-egress injection defense still applies to the agent’s subsequent outbound requests. This matters because most LLM chat APIs stream by default. If you configure direction="inbound" rules to process model output, they will silently not run on a streamed response — there is no error and no log entry indicating the rule was skipped.

Do not rely on inbound transformation rules as a control on streamed LLM responses. Either request a non-streaming response from the upstream API, or enforce the requirement outbound instead, where transformations always apply.

Getting Started

Core Features

CLI

Security

Platform

Deployment

Architecture

Transformation Rules

Basic configuration

TransformationRule model

TransformDirection enum

Multiple rules

Common patterns

Combining with PII redaction

When TLS interception activates

Order of operations

Streaming (SSE) responses

​Basic configuration

​TransformationRule model

​TransformDirection enum

​Multiple rules

​Common patterns

​Combining with PII redaction

​When TLS interception activates

​Order of operations

​Streaming (SSE) responses

Basic configuration

TransformationRule model

TransformDirection enum

Multiple rules

Common patterns

Combining with PII redaction

When TLS interception activates

Order of operations

Streaming (SSE) responses