version: 1
mode: default_deny_sensitive

actions:
  allow: keep
  mask: redact_and_keep
  quarantine: move_to_review
  drop: discard

indexing:
  include_paths:
    - knowledge/entities/**
    - knowledge/projects/**
    - knowledge/playbooks/**
    - knowledge/daily/**
  exclude_paths:
    - knowledge/archive/raw/**
    - knowledge/archive/quarantine/**
    - knowledge/archive/secrets/**

categories:
  hard_block:
    - api_keys
    - auth_tokens
    - passwords
    - private_keys
    - seed_phrases
    - payment_cards
    - bank_accounts
    - routing_numbers
    - ssn_tax_ids
    - drivers_license_passport
    - medical_record_ids
    - exact_home_address
    - personal_phone_email_if_not_owner
  soft_block:
    - legal_matters
    - medical_conditions
    - financial_balances
    - family_identifiers
    - confidential_work_details
    - minors_info

rules:
  - id: openai_key
    pattern: '(?i)sk-[a-z0-9]{20,}'
    action: mask
    replacement: '[REDACTED_API_KEY]'

  - id: generic_token
    pattern: '(?i)(api[_-]?key|token|secret|password)\\s*[:=]\\s*\\S+'
    action: mask
    replacement: '[REDACTED_SECRET]'

  - id: private_key_block
    pattern: '-----BEGIN (RSA|EC|OPENSSH|PGP) PRIVATE KEY-----[\\s\\S]+?-----END (RSA|EC|OPENSSH|PGP) PRIVATE KEY-----'
    action: quarantine

  - id: credit_card
    pattern: '\\b(?:\\d[ -]*?){13,19}\\b'
    validator: luhn
    action: mask
    replacement: '[REDACTED_CARD]'

  - id: bank_routing
    pattern: '\\b\\d{9}\\b'
    context_keywords: ['routing', 'aba', 'account']
    action: quarantine

  - id: ssn
    pattern: '\\b\\d{3}-?\\d{2}-?\\d{4}\\b'
    action: mask
    replacement: '[REDACTED_SSN]'

  - id: dob
    pattern: '\\b(?:dob|date of birth)\\b.*\\b\\d{1,2}[/-]\\d{1,2}[/-]\\d{2,4}\\b'
    action: mask
    replacement: '[REDACTED_DOB]'

  - id: passport_dl
    pattern: "(?i)\\b(passport|driver['’]s license|dl#)\\b[:\\s]*[a-z0-9-]+"
    action: quarantine

  - id: email
    pattern: '\\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\\.[A-Z]{2,}\\b'
    flags: 'i'
    action: mask
    replacement: '[REDACTED_EMAIL]'

  - id: phone
    pattern: '(?:(?:\\+?1\\s*(?:[.-]\\s*)?)?(?:\\(\\s*\\d{3}\\s*\\)|\\d{3})\\s*(?:[.-]\\s*)?)?\\d{3}\\s*(?:[.-]\\s*)\\d{4}'
    action: mask
    replacement: '[REDACTED_PHONE]'
