Keyboard shortcuts

Press or to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Allowlists & Scope

Two per-rule blocks let you tame false positives and target a rule at the data you care about: [rules.allowlist] for value-level exceptions, and [rules.scope] for restricting where the rule runs.

Allowlist

The allowlist filters out matches after they’re produced by the regex, built-in detector, or script. If a match equals an allowlisted value or matches an allowlisted pattern, it’s silently dropped.

[[rules]]
type        = "builtin"
id          = "email-address"
description = "Email addresses (production)"
category    = "PII"
severity    = "high"
builtin     = "email"

[rules.allowlist]
description = "System and test addresses"
values = ["noreply@example.com", "no-reply@example.com"]
patterns = [
    '.*@example\.com$',
    '.*@test\.com$',
    '^noreply@',
    '^postmaster@',
]
FieldEffect
valuesExact-match list — the matched substring must equal an entry.
patternsRegex patterns; if any pattern matches the matched substring, the finding is suppressed.
descriptionFree-form text, included in compile-time logging.

Scope

Scope limits where the rule runs in terms of schemas, tables, and columns. Unlike the global scan filter, scope is per-rule.

[[rules]]
type        = "builtin"
id          = "ssn-users-only"
description = "SSN detection in user-facing tables only"
category    = "PII"
severity    = "critical"
builtin     = "ssn"

[rules.scope]
include_tables  = ["users", "employee*"]   # exact + glob
exclude_columns = ["*_hash"]

All scope fields support exact strings and glob patterns (*, ?):

FieldEffect
include_schemasIf non-empty, only run in these schemas.
include_tablesIf non-empty, only run in these tables.
exclude_tablesSkip these tables.
include_columnsIf non-empty, only run on these columns.
exclude_columnsSkip these columns.

Important

A table or column listed in both include_* and exclude_* is rejected at rules-file load — the engine refuses to compile a rule with that ambiguity. Pick one or the other.

Allowlist + scope interaction

The two are independent. Scope decides whether the rule runs at all on a given column; the allowlist filters individual matches. They compose naturally:

[rules.scope]
include_schemas = ["public"]
exclude_tables  = ["audit_*"]

[rules.allowlist]
patterns = ['^test_.*@example\.com$']