Policies
Categories, actions, lists, custom rules and testing.
Your region's gateway address: resolving…
Categories and actions
For each category the policy sets an action: allow, warn, generalize (a range, not restored), pseudonymize (restored) or block. The allowed actions depend on the category: passwords and tokens, for instance, can only be blocked or warned about.
Templates
Start from a template: “Baseline”, “Finance & banking”, “Legal”, “Healthcare”, “HR & recruiting”, “Strict (M&A, audit)”. A template is a starting point, not a compliance guarantee.
Allow-lists, block-lists, dictionaries and patterns
The allow-list lets permitted values through (e.g. a public product name). Block-lists and dictionaries find your own terms — including Russian word forms. Custom regular expressions (RE2) describe any identifier you need.
Application, trademark and patent numbers
An application or registration number of a trademark, patent or certificate points to its holder, but no built-in category covers it. Enable the ready-made rule: add this fragment to the policy's custom_patterns. The rule finds a number of 5–14 digits after the words «заявка», «товарный знак», «знак обслуживания», «патент», «свидетельство» or «международная регистрация» and a № sign (or an RU prefix), and replaces it with a restorable [РЕГ_НОМЕР_N] placeholder. A number without such a word and a № is left alone. Test the policy on your own documents in the editor before saving it.
{
"custom_patterns": [
{
"id": "registry-id",
"label": "РЕГ_НОМЕР",
"description": "Номер заявки, товарного знака, патента или свидетельства после ключевого слова и знака № (или RU)",
"pattern": "(?:заявк[а-яё]*|товарн[а-яё]* знак[а-яё]*|знак[а-яё]* обслуживания|патент[а-яё]*|свидетельств[а-яё]*|международн[а-яё]* регистраци[а-яё]*)[^0-9\\n]{0,40}?(?:№ ?(?:RU ?)?|RU ?)([0-9](?:[0-9]| [0-9]){4,13}(?: ?[ABCSU][0-9])?)",
"whole_word": true,
"group": 1,
"action": "pseudonymize"
}
]
}
Who it applies to
A policy can target the whole organization, groups, members or individual API keys, and can be active only for a period — for example during a deal. When several policies match, the stricter action wins.
Failure handling
on_detector_error decides what happens when name recognition is unavailable: block (reject) or patterns_only (continue with patterns only). unknown_fields: reject rejects requests with fields the gateway does not classify.
Example rules
Rules are stored as JSON and validated against a schema. Before saving, test the policy on sample text in the editor — the test shows this policy's result on its own, not merged with other policies.
{
"schema_version": 1,
"categories": {
"PERSON": {"action": "pseudonymize"},
"MONEY": {"action": "generalize"},
"CARD": {"action": "block"},
"MEDICAL": {"action": "block"}
},
"allowlist": [{"type": "exact", "value": "Айтечество"}],
"dictionaries": [
{"id": "projects", "label": "ПРОЕКТ", "terms": ["Северный поток", "Альфа-2"], "action": "pseudonymize", "morphology": true}
],
"attachments": {"images": "block", "documents": "block", "audio": "block"},
"on_detector_error": "block"
}