The model does not need your customer’s passport to write them a reply

The model does not need the real data

People take a customer’s letter, a CRM export, a log with a password in the stack trace to the model. A ban does not work — the work moves to a personal ChatGPT. A blocking filter does not work either — it is the same ban, with irritation added. Guardrails starts from a simple observation: to write a customer a reply, the model only needs to know that a name stands here and a phone number there. So the gateway blocks nothing: it replaces the data with numbered placeholders, hands the text to the model and puts the real values back into the answer.

This is a real run through the small gemma3:4b model on a CPU. The same person in the letter is the same placeholder, so the model reasons about them consistently and restoring is unambiguous. The house number did reach the model: the basic recogniser sees names, not numbers — the accurate model covers those too, more below.

Documents by rules with checksums, names and addresses by a model

A neural network does not know the SNILS checksum algorithm and may take an order number for an INN. A rule knows: the checksum adds up — it is an INN, it does not — it is not. So documents, cards, phones, e-mail addresses, keys and passwords are found by rules in ten milliseconds. Names and addresses cannot be described by rules — a recognition model finds them, and you pick it at install time: the fast spaCy or the accurate ruBERT. When the model and a rule disagree, the rule wins.

Demo: paste a text and see what would reach the model

A demo page is installed with the gateway: paste any text, see the masked version and the list of what was found with its types, switch between eight ready-made sets — support, HR, banking, code, logs, a contract, corporate data — and, with a model configured, run the text through it and get an answer with the data restored.

Three commands and three questions

The install script asks which model to use — run one on this machine, point at yours or do without one for now — how thoroughly to look for names and addresses, and which ports to open the gateway and the demo on. Then it downloads and starts everything itself and checks its own work: masks a test letter, passes it through the gateway and makes sure everything came back restored.

git clone https://github.com/buffsystems/buff-guardrails.git
cd buff-guardrails
./install.sh

The gateway speaks the Anthropic and OpenAI APIs. Claude Code needs three environment variables:

export ANTHROPIC_BASE_URL=http://localhost:4000
export ANTHROPIC_AUTH_TOKEN=sk-...
export ANTHROPIC_MODEL=default

Claude Desktop and Cowork, Buff Code and any SDK connect the same way — step by step for Windows, macOS and Linux, with settings export for handing out to employees: docs/clients.md

What the gateway does, and what it does not

The weak spot of the basic option is addresses: spaCy sees street and city names in Russian, but not house numbers. On real chats it finds 60 names and 51 addresses out of a hundred, the accurate ruBERT model — 92 and 98, at 150 milliseconds per request instead of 11. If your people work with customer requests, choose ruBERT — it is one item in the installer.

• It does not block requests and keeps no incident register: it is not a DLP but a layer between the employee and the model that makes everyday work safe.
• It does not replace the legal basis for processing: it removes the transfer of data to a third party, the rest is your policies.
• It does not promise a hundred percent: the numbers are measured on open datasets and reproduced with make bench in the repository.
• Open source under the MIT licence: what exactly is masked and how can be checked rather than taken on trust.