The rule, the owner’s words, the record’s mapped fields (up to 20 lines), lookup context, the fields of an unmapped call as sent, all PII-redacted
Router
An unmapped call with more than one candidate map
The app, tool name and description, the call’s arguments (PII-redacted), the candidate maps’ names, steps and rules
Tool mapper
Once per new write tool
The tool’s description and input schema; your maps’ names, short descriptions and facts
Scope drafter
Once per map publish
Each rule’s text, quote and step
Policy drafter
Once per uploaded policy
The document’s text
Connector mining
After a connector sync or an import: unmined decision items, reverts and corrections first, in batches of 20 (the first 40, then the rest in the background)
Each item’s text (up to 1,500 characters), its source and kind, PII-redacted like a check (emails, phones, keys… become [EMAIL] etc.). The people involved are sent only as stable placeholders ([person 3]): their handles, emails and @mentions are replaced before the call and mapped back on the server to name the rule’s owner. Items from private channels are sent too (redacted); who can see them only limits who sees the proposed rule
Learning from corrections (opt-in per person)
A person’s prompt to their coding agent that the local classifier marks a correction (getclaros --learn-corrections)
The correction and the agent action it corrects (tool, paths, a short diff or summary), redacted on the machine and again on the server; to the vision model, the example images it references (unless the person chose no images), told to describe the example as checkable properties and never write out personal data or secrets. Ordinary prompts never leave the machine
Add a rule
When a person types a rule
Nothing when it’s saved. At check time the rule’s text goes to the judge like any rule; Try sends the sample action through the judge, PII-redacted
Override and precedent drafters
After enough reports or approvals on one rule
The rule, the map’s name, fields and steps, and the reports’ reasons or the approved actions’ summaries
Before the judge or router sees a record (the fields the agent sent and the records the guard read), every text value goes through the same PII redaction as screen text: names, emails, phones, IBANs, cards, tax and national IDs and secrets become placeholders like [EMAIL]. Numbers, dates, codes and record ids are kept.
Precise rules use the original values. They run on the server before any model call; the originals never leave it.
A rule whose facts are personal data (a person’s name, an address) can’t be judged from the redacted record, so the judge answers can’t tell: a stop-level rule then asks a person. Make such rules precise if you need them decided.
Added latency: under 0.2 ms a check with the rules layer (the hosted and self-hosted servers). With the local PII model loaded, about 70 ms the first time a free-text value is seen, nothing on repeats.
Redaction is a strong filter, not a guarantee: it misses some addresses and unusual name formats. Map only the fields your rules need.
To turn model steps off on a server: CLAROS_JUDGE=off, CLAROS_ROUTER=off, CLAROS_TOOL_MAPPER=off, CLAROS_SCOPE=off.
