>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3577506. --> Reported by: [breidert](https://www.drupal.org/user/135619) >>> <p>[Tracker]<br> <strong>Update Summary: </strong>[One-line status update for stakeholders]<br> <strong>Check-in Date: </strong>MM/DD/YYYY<br> <strong>Additional Collaborators: </strong><br> <em>Metadata is used by the <a href="https://www.drupalstarforge.ai/" title="AI Tracker">AI Tracker.</a> Docs and additional fields <a href="https://www.drupalstarforge.ai/ai-dashboard/docs" title="AI Issue Tracker Documentation">here</a>.</em><br> [/Tracker]</p> <h2>Overview</h2> <p>This meta issue covers the creation of a Drupal Recipe (<code>ai_recipe_guardrails_prompt_safety</code>) that ships sensible default guardrail configuration for protecting AI interactions against prompt attacks and off-topic or high-liability content.</p> <p>The recipe builds on the guardrail plugin system introduced in <a href="https://www.drupal.org/project/ai/issues/3518963">#3518963</a> and combines two complementary guardrail types:</p> <ul> <li><strong>Regex guardrails</strong> for detecting structurally identifiable attack patterns &mdash; deterministic, zero LLM cost, negligible latency.</li> <li><strong>Topic guardrails</strong> for detecting the intent behind a prompt &mdash; using AI classification to catch semantic attacks and off-topic or high-liability content that no regex pattern could reliably identify. </li> </ul> <p>Once the recipe is installed, AI interactions are immediately protected against the most common categories of adversarial input and liability-relevant content, without requiring any configuration.</p> <h2>Use Cases</h2> <h3>Structural attack detection (regex)</h3> <ul> <li><strong>Script and code injection:</strong> A user embeds executable code or script tags in their input in an attempt to manipulate how the output is rendered or processed downstream &mdash; particularly relevant when AI output is written into content fields or rendered in a browser context. Regex detection is reliable and cost-free for these<br> structurally well-defined patterns.</li> </ul> <h3>Semantic prompt attack detection (topic filter)</h3> <p>Jailbreak attempts and prompt injection attacks are constantly evolving in their phrasing. A regex pattern cannot reliably keep up with creative variations such as indirect framings, roleplay setups, or obfuscated instructions. A topic-based guardrail &mdash; which has an AI classify the intent of the input against a list of known attack categories &mdash; is significantly more robust.</p> <ul> <li><strong>Prompt injection and system prompt override:</strong> The user attempts to instruct the AI to ignore, forget, or override its configured system prompt and instructions.</li> <li><strong>Role hijacking:</strong> The user attempts to redefine the AI's identity or role &mdash; for example by claiming it is now a different assistant with different rules, or that a special unrestricted mode has<br> been activated.</li> <li><strong>Jailbreak attempts:</strong> Common patterns used to circumvent AI safety instructions, such as hypothetical framings, roleplay scenarios designed to bypass guardrails, or requests to behave<br> as an AI without restrictions.</li> </ul> <h3>Off-topic and liability content (topic filter)</h3> <p>Many sites need to ensure their AI interactions stay within a defined scope and do not venture into areas that carry legal or reputational risk. </p> <p>The following topic guardrails are broadly applicable regardless of site type and are included as ready-to-use defaults:</p> <ul> <li><strong>Medical advice block:</strong> Prevents the AI from responding to requests for medical diagnosis, treatment recommendations, or medication guidance. Relevant for almost any public-facing AI<br> interaction.</li> <li><strong>Legal advice block:</strong> Prevents the AI from providing legal opinions, contract interpretation, or litigation guidance.</li> <li><strong>Sensitive topics block:</strong> Prevents the AI from engaging with socially divisive or politically charged subjects where any response carries reputational risk for the site owner. Covered topics include politics, race, religion, war, ethnicity, immigration, abortion, gun control, capital punishment, euthanasia, terrorism, genocide, sexual orientation, gender identity, drug legalisation, extremism, and human trafficking.</li> </ul> <h3 id="summary-ai-usage">AI usage (if applicable)</h3> <p>[x] AI Assisted Issue<br> This issue was generated with AI assistance, but was reviewed and<br> refined by the creator.</p> <p>[ ] AI Assisted Code<br> This code was mainly generated by a human, with AI autocompleting or<br> parts AI generated, but under full human supervision.</p> <p>[ ] AI Generated Code<br> This code was mainly generated by an AI with human guidance, and<br> reviewed, tested, and refined by a human.</p> <p>[ ] Vibe Coded<br> This code was generated by an AI and has only been functionally tested.</p>