Polygraf

Polygraf offers a state-of-the-art PII Detection & Masking API designed to help identify and protect sensitive information in your text.

This integration enables the NeMo Guardrails library to detect or mask PII on user input, bot output, and/or retrieved documents.

Setup

First, you need an API key from Polygraf. Once you have it, set it as an environment variable:

export POLYGRAF_API_KEY="your-polygraf-api-key"

Also, you’ll need the endpoint where the Polygraf PII detection API is hosted.

• For Polygraf cloud, use https://governance.api.polygraf.ai/gcp/pii/text-detect.

• For self-hosted deployments, set this to your service endpoint (the default local example is typically http://localhost:8000/v1/pii/text-detect).

Configuration

To activate the Polygraf integration, configure the polygraf block in config.yml and include the relevant flows.

To use it for PII detection, your config.yml should look like this:

rails:
  config:
    polygraf:
      server_endpoint: "https://governance.api.polygraf.ai/gcp/pii/text-detect"
      input:
        entities:
          - Email
          - Person
          - Phone
      output:
        entities:
          - Email
          - Person
          - Phone

  input:
    flows:
      - polygraf detect pii on input

  output:
    flows:
      - polygraf detect pii on output

To use it for PII masking, use the polygraf mask pii ... flows instead:

rails:
  config:
    polygraf:
      server_endpoint: "https://governance.api.polygraf.ai/gcp/pii/text-detect"
      input:
        entities:
          - Email
          - Person
          - Phone
      output:
        entities:
          - Email
          - Person
          - Phone

  input:
    flows:
      - polygraf mask pii on input

  output:
    flows:
      - polygraf mask pii on output

Retrieval Flows

To detect or mask PII in retrieved documents, configure the retrieval entities and enable the retrieval flow variant:

rails:
  config:
    polygraf:
      server_endpoint: "https://governance.api.polygraf.ai/gcp/pii/text-detect"
      retrieval:
        entities:
          - Email
          - Person
          - Phone

  retrieval:
    flows:
      - polygraf detect pii on retrieval
      # or for masking:
      # - polygraf mask pii on retrieval

Entity Types

You can configure which entities to detect or mask by specifying them in the entities list. If you omit the entities list for detection, any detected PII will trigger the detection flow. For masking, if you omit the entities list, it will mask all detected PII.

Entity labels should match the labels returned by your Polygraf deployment. Common entities you might want to detect/mask include:

• Person

• Email

• Phone

For a complete list of supported entity types, please refer to the Polygraf documentation.