Detectors

A detector finds something in the content and says so. It never denies anything and never rewrites anything. That is what the rules are for. So choosing between the six types is a question about cost and evidence, not about strictness.

Six types, cheapest first

type	what it is	typical cost	reach for it when
pii	103 recognizers with checksums and context words, plus your own patterns	microseconds	the thing has a shape, a card, an IBAN, a national id, an API key
nlp	a token-classification checkpoint from the Hub	milliseconds, CPU	the thing has no shape, a person’s name
classify	a sequence classifier scoring the whole segment	milliseconds, CPU	prompt injection or content safety, at request rate
embed	an embedding model and your own example sentences	milliseconds, CPU	topics you define, in languages you did not train for
llm	a chat model asked whether a policy in prose applies	a provider call	the policy is easier to write than to specify
remote	a presidio-analyzer you already run	a network hop	you have one and it is already tuned

The first two both annotate pii. classify and llm both annotate injection, and embed annotates topic. A rule matches on that category, so two detectors of different types can corroborate one finding. That also means dropping one can quietly lower the score of a finding the other made. Every namespace, and everything else an annotation can say, is in the annotation reference.

The pii detector is named for the bulk of what it finds rather than all of it. Its credential rows annotate credential, so a rule written against that namespace covers API keys and private key material without naming a single entity type.

The guides, by what you are trying to catch

Prompt injection and jailbreaks. A classifier is the default, a checkpoint on a CPU, in milliseconds. Stop prompt injection with a classifier also says when to reach past it for the judge.

Subjects the assistant must not discuss. Write example sentences rather than rules, in whatever language your users type. → Keep the assistant on topic with examples

A policy that is easier to state than to specify. Prose, judged per turn, through a provider you already have, and what it costs. → Judge with a model

Names. The one common entity with no shape to match, so it takes a model. → Detect names with a model from the HuggingFace Hub

Your own identifiers. An employee-id format, a codename list, a customer reference. → Add your own recognizer

Gulf identifiers. Saudi, Emirati, Qatari, Kuwaiti, Bahraini and Omani ids, IBANs and phone numbers are built in and on by default. → Find Gulf identifiers

Before you trust any of it

Every number above is somebody else’s until you have run it on your own text. pistra guardrails eval scores a detector at byte offsets against labelled data, per entity type, and sweeps for a threshold rather than letting you guess one. → Measure a detector

A detector you are not yet sure of can annotate without enforcing, see Guardrails.