You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
description: "Suppress false-positive findings with exclusion rules: expression criteria, the built-in library, and one-click creation from Watchdog."
3
+
description: "Suppress false-positive findings with exclusion rules: expression criteria, AI-drafted suggestions, the built-in library, and one-click creation from findings."
The **Exclusion Rules** tab manages the rules that suppress false-positive findings. Open it from **Secure > Guardrails** in the dashboard and select the **Exclusion Rules** tab.
8
+
Exclusion rules suppress findings that a [guardrail policy](/docs/ai-control-plane/secure/guardrails) correctly matched but that aren't real risk: a shared test account, a documentation sample, a rule that misfires on an internal identifier format. They are a post-filter, so the policy keeps its detection coverage while the known-safe noise disappears.
9
9
10
-
Exclusions suppress findings that a [guardrail policy](/docs/ai-control-plane/secure/guardrails) correctly matched but that aren't real risk: a shared test account, a documentation sample, a rule that misfires on an internal identifier format. They are a post-filter, so the policy keeps its detection coverage while the known-safe noise disappears. When whole classes of message are irrelevant to a policy, narrow its [detection scope](/docs/ai-control-plane/secure/guardrails#detection-scope) instead, which removes the scanning work along with the noise.
11
-
12
-
## Access requirements
10
+
Manage them on the **Exclusion Rules** tab of the Risk Policies page, under **Secure > Risk Policies** in the dashboard.
13
11
14
12
<Callouttype="info">
15
-
Viewing this tab and creating, editing, or deleting exclusions require the `org:admin` scope. Access is included in the default [Admin role](/docs/ai-control-plane/org-admin/roles-and-permissions) but not the Member role.
13
+
Viewing the tab and creating, editing, or deleting exclusions require the `org:admin` scope.
16
14
</Callout>
17
15
18
-
## How exclusions behave
16
+
This page covers:
17
+
18
+
<CardGrid
19
+
cards={[
20
+
{
21
+
icon: "help-circle",
22
+
title: "How exclusions behave",
23
+
description: "Retroactive and forward suppression, and what exclusions can't filter",
24
+
href: "#how-exclusions-behave",
25
+
},
26
+
{
27
+
icon: "pen-tool",
28
+
title: "Creating an exclusion",
29
+
description: "Set the scope and criteria, with an AI draft or by hand",
30
+
href: "#creating-an-exclusion",
31
+
},
32
+
{
33
+
icon: "file-code",
34
+
title: "Exclusion criteria",
35
+
description: "The expression clauses and their limits",
36
+
href: "#exclusion-criteria",
37
+
},
38
+
{
39
+
icon: "list-checks",
40
+
title: "Managing exclusions",
41
+
description: "Enable, disable, edit, or delete an exclusion from the table",
42
+
href: "#managing-exclusions",
43
+
},
44
+
{
45
+
icon: "book-open",
46
+
title: "Built-in exclusion library",
47
+
description: "The read-only presets that suppress published test values",
48
+
href: "#built-in-exclusion-library",
49
+
},
50
+
{
51
+
icon: "octagon-alert",
52
+
title: "Creating exclusions from findings",
53
+
description: "Prefill the criteria from a finding that shouldn't have fired",
54
+
href: "#creating-exclusions-from-findings",
55
+
},
56
+
]}
57
+
/>
19
58
20
-
Because exclusions filter on the matched value, they apply to the deterministic detectors. Prompt-based policies produce a judged verdict rather than a reproducible match, so tune those through the guardrail and its detection scope instead.
59
+
## How exclusions behave
21
60
22
-
An exclusion applies both retroactively and going forward. Saving one suppresses matching findings that already exist, and deleting one restores them. Exclusions never re-run analysis — they filter findings rather than change detection — and the retroactive sweep runs asynchronously, so counts across the dashboard settle a moment after saving.
61
+
An exclusion applies both retroactively and going forward. Saving one suppresses matching findings that already exist, and deleting one restores them. Exclusions never re-run analysis: they filter findings rather than change detection, and the retroactive sweep runs asynchronously, so counts across the dashboard settle a moment after saving.
23
62
24
63
Each exclusion is scoped either globally, across every policy in the project, or to a single policy.
25
64
65
+
Because exclusions filter on the matched value, they apply to the deterministic detectors. Prompt-based policies produce a judged verdict rather than a reproducible match, so tune those through the [guardrail and its detection scope](/docs/ai-control-plane/secure/guardrails#prompt-based-policies) instead. The same split applies to scope: when whole classes of message are irrelevant to a policy, narrow its [detection scope](/docs/ai-control-plane/secure/guardrails) instead, which removes the scanning work along with the noise.
66
+
67
+
## Creating an exclusion
68
+
69
+
1. On the **Exclusion Rules** tab, select **Set up Exclusion Rule**. The exclusion sheet opens.
70
+
71
+
72
+
73
+
2. Set the **Scope**: global, applying to all policies in the project, or a single policy selected from the list.
74
+
3. Describe what to stop flagging and select **Suggest with AI**, or write the [criteria expression](#exclusion-criteria) directly in the **Exclusion criteria** field.
75
+
76
+
77
+
78
+
4. Review the criteria expression. The examples under the field show each clause form.
79
+
80
+
81
+
82
+
5. Select **Create**. The exclusion appears in the table, enabled, and the retroactive sweep starts.
83
+
84
+
85
+
26
86
## Exclusion criteria
27
87
28
88
Criteria are written as an expression. A single primary clause selects what to suppress:
@@ -41,14 +101,29 @@ A `rule_id` or `source` clause can be joined to the primary clause with `&&` to
41
101
match == "jane.doe@acme.com" && rule_id == "pii.email_address"
42
102
```
43
103
44
-
**Suggest with AI** drafts the expression from a plain-language description of what to stop flagging, leaving it editable before saving. Each scope allows up to 50 enabled regex exclusions; disabled drafts don't count against the limit.
104
+
Each scope allows up to 50 enabled regex exclusions; disabled drafts don't count against the limit.
45
105
46
106
Exclusion values are redacted in [audit logs](/docs/ai-control-plane/org-admin/audit-logs) and outbound webhook payloads, since an exact match value is often the sensitive string being suppressed.
47
107
108
+
## Managing exclusions
109
+
110
+
The table shows each exclusion's criteria, type, scope, status, and creation date.
111
+
112
+
- To enable or disable an exclusion, use the toggle in its row.
113
+
- To edit or delete an exclusion, open its row actions. Deleting an exclusion restores the findings it suppressed.
114
+
115
+
116
+
48
117
## Built-in exclusion library
49
118
50
-
Speakeasy ships a curated preset library that suppresses common false positives — published test credentials, documentation examples, and other known-safe values — before they reach a project's own exclusions. **View library** lists every preset with its reasoning and sample values. The library is read-only and needs no configuration.
119
+
Speakeasy ships a curated preset library that suppresses common false positives before they reach a project's own exclusions: published test credit card numbers, documentation example keys, and other known-safe values. The library is read-only and needs no configuration.
120
+
121
+
To review what it covers, select **View library**. Each preset lists its reasoning and the sample values it suppresses.
122
+
123
+
124
+
125
+
## Creating exclusions from findings
51
126
52
-
## Creating exclusions from past sessions
127
+
The fastest way to write an exclusion is from a finding that shouldn't have fired. A finding opened from a [Watchdog](/docs/ai-control-plane/secure/watchdog) signal or an [agent session](/docs/ai-control-plane/observe/agent-sessions) transcript offers an exclusion action that prefills the criteria: the matched span where there is one, otherwise the rule or the source. The policy that raised the finding is preselected as the scope.
53
128
54
-
The fastest way to write an exclusion is from a finding that shouldn't have fired. Opening a finding from a [Watchdog](/docs/ai-control-plane/secure/watchdog) signal or an [agent session](/docs/ai-control-plane/observe/agent-sessions) transcript offers an exclusion action that prefills the criteria from that finding — the matched span where there is one, otherwise the rule or the source — and preselects the policy that raised it as the scope. Reviewing findings and suppressing the noise in place is usually a better way to tune a policy than writing criteria from scratch.
129
+
Reviewing findings and suppressing the noise in place is usually a better way to tune a policy than writing criteria from scratch.
0 commit comments