Chio/Docs

PlatformFoundations

Default Pipeline

The kernel's default seven-guard pipeline runs inexpensive checks first and denies a request when any guard denies it.

Registration Order

From crates/guards/chio-guards/src/pipeline.rs:

crates/guards/chio-guards/src/pipeline.rs
/// Create a default pipeline with all implemented guards using their
/// default configurations.
pub fn default_pipeline() -> Self {
    let mut pipeline = Self::new();
    pipeline.add(Box::new(crate::ForbiddenPathGuard::new()));
    pipeline.add(Box::new(crate::ShellCommandGuard::new()));
    pipeline.add(Box::new(crate::EgressAllowlistGuard::new()));
    pipeline.add(Box::new(crate::PathAllowlistGuard::new()));
    pipeline.add(Box::new(crate::McpToolGuard::new()));
    pipeline.add(Box::new(crate::SecretLeakGuard::new()));
    pipeline.add(Box::new(crate::PatchIntegrityGuard::new()));
    pipeline
}
#GuardPurpose
1ForbiddenPathGuardGlob match against forbidden filesystem patterns. Cheap; runs first so denials short-circuit before more expensive checks.
2ShellCommandGuardRegex match against forbidden shell-command patterns extracted from the request arguments.
3EgressAllowlistGuardDomain allowlist for outbound network requests. Wildcard host patterns; default action is block.
4PathAllowlistGuardAllowlist for filesystem read, write, and patch operations. Empty allowlist means no filesystem access.
5McpToolGuardPer-tool access control. Allow/block lists for tool names plus a max argument size and a require-confirmation list.
6SecretLeakGuardPattern match against tool arguments for known secret formats (AWS keys, GitHub tokens, private keys, generic patterns).
7PatchIntegrityGuardValidates patches: max additions, max deletions, forbidden content patterns, addition/deletion balance.

Two defaults, not one

default_pipeline() registers the seven stateless guards above. default_runtime_guard_profile() (below) is a separate default that adds internal-network, agent-velocity, and the response sanitizer. Guards outside both ( velocity, jailbreak, prompt-injection, data-flow, and the external adapters) are explicit opt-ins because they have ordering, dependency, or cost characteristics that operators should choose deliberately.

Ordering Rationale

Conjunctive combination means ordering does not change correctness, but it does change cost. Cheap stateless checks are at the top so the common-case denial finishes work before any guard touches a regex compile, an argument-tree walk, or a patch parser.

  • Forbidden path is first because a glob match on a small list is among the cheapest checks the catalog has.
  • Tool access (mcp-tool) runs mid-pipeline. Requests that pass path checks but fail the tool allowlist are less common, so this order optimizes the expected denial distribution.
  • Patch integrity is last because patch parsing is the most expensive check in the default. By the time it runs, the cheap denials are already gone.

The Runtime Guard Profile

default_pipeline() is not the only default. A second builder, default_runtime_guard_profile(), returns a RuntimeGuardProfile the standard runtime installs. It is a different guard set from default_pipeline(), and neither is a superset of the other.

crates/guards/chio-guards/src/lib.rs
pub fn default_runtime_guard_profile() -> RuntimeGuardProfile {
    let mut post_invocation_pipeline = PostInvocationPipeline::new();
    post_invocation_pipeline.add(Box::new(SanitizerHook::new()));

    RuntimeGuardProfile {
        pre_invocation_guards: vec![
            Box::new(InternalNetworkGuard::new()),
            Box::new(AgentVelocityGuard::new(AgentVelocityConfig::default())),
            Box::new(AdvisoryPipeline::new(PromotionPolicy::new())),
        ],
        post_invocation_pipeline,
    }
}

Three guards operators might expect to wire in by hand are already installed by this profile: InternalNetworkGuard (SSRF prevention), AgentVelocityGuard (cross-capability rate limiting), and ResponseSanitizationGuard through the post-invocation SanitizerHook. The AdvisoryPipeline is installed too, but empty: the session-journal advisory guards that would populate it stay operator-wired.

What Neither Default Installs

The full chio-guards catalog ships more than the two defaults cover. The guards below stay operator-wired even with the runtime profile enabled. Each row is a Kernel page.

GuardWhy opt-in
JailbreakGuard (heuristic + statistical + ML)ML inference cost and false-positive risk vary by deployment; operators should review thresholds before enabling.
PromptInjectionGuardPattern detection on incoming text. Useful but noisy; operators tune the signal set.
BehavioralProfileGuardReads receipt feed history; needs a configured feed source and baseline windows before it has anything to compare against.
DataFlowGuard, BehavioralSequenceGuardSession-aware: depend on a configured session journal. Not every edge maintains one.
VelocityGuardPer-window, per-grant invocation cap; operators should pick a window and limit, not inherit a default that may not match their workload.
External adapters (Bedrock, Azure, Vertex, Safe Browsing, VirusTotal, Snyk)Network dependency, credentials, latency cost; only enable per External Guards.
chio-data-guards (SqlQueryGuard, VectorDbGuard, WarehouseCostGuard, QueryResultGuard)A separate crate; neither default references it. Depends on a configured data-store connection and a table/column allowlist policy. QueryResultGuard is a post-invocation hook over returned rows.
AnomalyAdvisoryGuard, DataTransferAdvisoryGuardThe runtime profile installs an empty AdvisoryPipeline shell; these session-journal advisory guards, and any promotion rules, stay operator-wired.
CUA guards (computer_use, browser_automation, remote_desktop, input_injection, embedding_anomaly)Only relevant for deployments that mediate computer use; off by default elsewhere.
code_execution, content_review, memory_governanceDomain-specific; operators wire them in only where the corresponding tool interface exists.
WASM custom guardsLoaded from operator-authored modules at start-up; the kernel does not ship with default WASM guards baked in.

Extending the Default

Start from the default and append. Anything you add runs after the default seven, which is the right place for guards that are more expensive or that depend on session state.

rust
use chio_guards::{
    GuardPipeline, AgentVelocityGuard, AgentVelocityConfig,
    DataFlowGuard, DataFlowConfig,
};
use chio_guards::response_sanitization::ResponseSanitizationGuard;

let mut pipeline = GuardPipeline::default_pipeline();

// AgentVelocityGuard keeps its own in-memory rate buckets.
pipeline.add(Box::new(AgentVelocityGuard::new(
    AgentVelocityConfig::default(),
)));
// DataFlowGuard is session-aware and needs a journal handle.
pipeline.add(Box::new(DataFlowGuard::new(
    journal.clone(),
    DataFlowConfig::default(),
)));

// Custom guards last.
pipeline.add(Box::new(BusinessHoursGuard::new(9, 17)));

kernel.add_guard(Box::new(pipeline));

Authoring custom guards is covered in Custom Guards. For the response-side phase, register a PostInvocationPipeline separately on the kernel; see Sanitization.

Opting Out

Build the pipeline by hand to omit one or more of the seven default guards. The kernel accepts a manually registered pipeline.

rust
use chio_guards::{
    GuardPipeline, ForbiddenPathGuard, PathAllowlistGuard,
    McpToolGuard, SecretLeakGuard, PatchIntegrityGuard,
};

// A pipeline without ShellCommandGuard or EgressAllowlistGuard,
// for a deployment that has no shell or network surface to begin with.
let mut pipeline = GuardPipeline::new();
pipeline.add(Box::new(ForbiddenPathGuard::new()));
pipeline.add(Box::new(PathAllowlistGuard::new()));
pipeline.add(Box::new(McpToolGuard::new()));
pipeline.add(Box::new(SecretLeakGuard::new()));
pipeline.add(Box::new(PatchIntegrityGuard::new()));

kernel.add_guard(Box::new(pipeline));

Removing a guard removes the protection

Each default guard exists because its absence opens a class of attack. Confirm the corresponding interface is closed by another control (network sandbox, immutable filesystem, no shell tool) before omitting the guard.

Catalog Pages by Category

Where to Go Next