intutic_guardrail Cloud

A policy guardrail written as code, managed through /api/v1/policy-guardrails/guardrails. It is held to the Guardrail IR and the validator a guardrail extracted from a policy document passes, without the checks that compare a model's output with the passage it cites. A new guardrail starts PROPOSED, like an extracted one: it enforces and measures nothing until a member approves it for shadow, and promotion to ENFORCING waits on shadow evidence through the same review actions (the dashboard, intutic guardrails approve-shadow and promote). Terraform manages the rule, not its lifecycle. Changing name or description edits the guardrail in place and keeps its evidence. Changing any IR attribute creates the next version under a new id, PROPOSED with no evidence, and retires this one (undoing what it wrote, if it was an enforcing allowed-models or egress guardrail); the plan shows the new version and status before you apply. Destroying it retires it; its history is kept. The plan also asks the API to run the full validator, so a rule the API would refuse fails at plan time. Needs an OWNER or ADMIN key.

Example Usage

# A hook rule: the harness gates block `terraform apply` once the guardrail
# is enforcing. It starts PROPOSED; approve it for shadow and promote it on
# evidence in the guardrail review (or with `intutic guardrails`).
resource "intutic_guardrail" "reviewed_apply" {
  name         = "Reviewed terraform apply"
  description  = "Production applies need a reviewed plan."
  kind         = "hook_rule"
  title        = "Reviewed plan before terraform apply"
  tools        = ["Bash"]
  arg_contains = ["terraform apply"]
}

# A front-matter rule the proxy enforces, for contractors only.
resource "intutic_guardrail" "no_web_fetch" {
  name  = "No web fetch for contractors"
  kind  = "deny_tools"
  tools = ["WebFetch"]
  roles = ["contractor"]
}

# A workspace setting: on promotion it narrows the workspace's allowed models.
resource "intutic_guardrail" "approved_models" {
  name   = "Approved models"
  kind   = "allowed_models"
  models = ["claude-sonnet-4-5", "gpt-4o"]
}

Schema

Required

• kind (String) The IR kind: allowed_models, deny_tools, egress_allow, forbid_after, forbid_with, hook_rule, max_calls, requires_before, review_before, wasm_predicate. The attributes below say which kinds take them.
• name (String) One-line label, at most 80 characters, without surrounding whitespace.

Optional

• arg_contains (List of String) hook_rule: fire only when the serialised tool input contains every one of these literals (at most 4, each 1 to 64 characters, no tab, newline, double quote or backslash).
• arg_not_contains (List of String) hook_rule: fire only when the tool input contains none of these literals (same limits as arg_contains).
• description (String) What the rule is for, at most 480 characters. A hook rule's block message carries it where an extracted rule carries its quote (the name stands there when this is unset).
• first (String) requires_before, forbid_after (required): the first token; differs from then.
• hosts (List of String) egress_allow (required, 1 to 32): hosts (api.example.com), suffixes (.example.com) or IPv4 addresses and CIDRs no wider than /8.
• limit (Number) max_calls (required): the most calls allowed, 1 to 1000.
• models (List of String) allowed_models (required, 1 to 32): model ids, compared exactly as the proxy compares them.
• predicate (String) wasm_predicate (required): the predicate in the closed rule DSL, as JSON (jsonencode({ all = [...] })). Its verdict is always re-ask.
• rationale (String) wasm_predicate (required): why the rule re-asks, at most 480 characters.
• roles (List of String) Every kind but allowed_models and egress_allow: the lower-case roles the rule applies to (at most 8). Unset, it applies to everyone.
• taint (String) forbid_with (required): secrets() or pii().
• then (String) requires_before, forbid_after (required): the second token.
• title (String) hook_rule, wasm_predicate (required): the title, 1 to 80 characters, that starts the block message.
• token (String) max_calls, forbid_with (required): the tool name or action token.
• tokens (List of String) review_before (required, 1 to 16): tool names or action tokens.
• tools (List of String) hook_rule (required, 1 to 8), deny_tools (required, 1 to 16): tool names (Bash, mcp__github__create_issue) or action tokens. A known harness tool is written in its canonical case (WebFetch, not webfetch).

Read-Only

• enforcing_fires (Number) Times this version acted while enforcing.
• id (String) The guardrail id (pgr_…). Changes when an IR change creates the next version.
• provenance (String) Always authored. An extracted guardrail cannot be managed or imported by this resource.
• shadow_evaluations (Number) Shadow evaluations this version has accumulated; promotion needs the threshold the API reports.
• shadow_would_act (Number) Shadow evaluations on which this version would have acted.
• status (String) PROPOSED, SHADOW, ENFORCING or REJECTED. Moved by the review actions, never by Terraform.
• supersedes (String) The id of the version this one replaced, or null.
• target (String) The enforcer the rule is projected into: hook_rule, sop_front_matter, wasm_rule or workspace_setting.
• version (Number) 1 for a new guardrail; each IR change creates the next.

Import

# Import an authored guardrail by id. An extracted guardrail cannot be imported.
terraform import intutic_guardrail.reviewed_apply pgr_0123456789abcdef