Why does my pattern work elsewhere but not here?

Almost always lookahead, lookbehind or a backreference. RE2 does not support them.

Is a pattern check free?

It costs nothing per evaluation, unlike an LLM-backed check. That makes it the right choice wherever it can do the job.

Can one control hold several patterns?

A pattern can express alternation. Whether that is clearer than two controls depends on whether they should share a name and an action.

Introduction

When you can describe exactly what you are looking for, a pattern beats a classifier. It costs nothing to evaluate, it behaves identically every time, and its false positives are entirely your own doing — which means you can fix them.

What it detects

"A raw pattern (RE2 syntax) matched against the input."

RE2 is the important word. It is a regular-expression syntax that guarantees linear-time matching, which is why it is safe to run on every input an agent handles. The trade-off is that RE2 does not support backreferences or lookaround assertions — the features that make catastrophic backtracking possible.

If a pattern you are porting uses (?=…), (?!…) or \1, it will not work here and will need rewriting.

One control can hold several patterns: add one or more named patterns (Name + Pattern) with Add pattern.

What it is good for

Internal identifiers — Employee numbers, ticket references, account formats — anything with a shape your organisation defined.
Structured secrets with a known prefix — Where you know the exact format, a pattern is more precise than a classifier.
Narrow, high-confidence cases — Where a classifier's judgement is not wanted and an exact match is.

It is a poor fit for anything requiring judgement. A pattern cannot tell whether a topic was discussed or whether an answer was fabricated.

Where to run it

All four points are supported, and the choice depends on what the pattern describes.

Applied on	Typical use
`User input`	Identifiers users should not be pasting in
`Agent output`	Internal references leaking into a customer-facing answer
`Tool input`	Structured data leaving the boundary
`Tool output`	Identifiers arriving from a system that should not be returning them

Actions

A pattern match knows exactly where it matched, so all three actions are available — and this is the check where Mask works best, because the boundary of the match is unambiguous.

A common shape is the same pattern deployed three times with different actions on different assets: mask it on the support agent, block it on the external-facing one, flag it everywhere else. Those are three controls, and that is the correct way to express it.

Writing patterns that hold up

Anchor where you can — An unanchored pattern for a six-digit number matches inside every longer number in your traffic.
Prefer specific over clever — A pattern nobody can read is one nobody can tune when it misfires.
Test both directions — Use Test this control with something that should match and something that should not. The second test is the one that catches over-broad patterns.
Name the control for the pattern's intent — Block internal ticket refs in agent output, not Regex 4.

Known limitations

No backreferences or lookaround — RE2 excludes them by design. Patterns relying on them must be rewritten.
Exact matching only — A deliberately obfuscated value — spaces inserted, characters substituted — will not match.
No context — The pattern matches wherever it appears, including in content quoting or explaining it.

Regex pattern