Skip to content

Add guide - Enable PgBouncer in Turbot Guardrails #356

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 10 commits into from
Closed
1 change: 1 addition & 0 deletions docs/concepts/guardrails/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@ there are many guardrails that are common and consistent across resources.
| [Discovery](concepts/guardrails/discovery) | Mechanism by which Guardrails initially adds a resource to the CMDB. |
| [Encryption at Rest](concepts/guardrails/encryption-at-rest) | A mechanism to manage data encryption at rest (i.e. AWS S3 Buckets). |
| [Encryption in Transit](concepts/guardrails/encryption-in-transit) | A mechanism to manage data encryption in transit (i.e. AWS S3 Buckets). |
| [Intelligent Assessment](concepts/guardrails/intelligent-assessment) | AI-powered resource assessment to evaluate compliance using natural language.
| [Public Access](concepts/guardrails/public-access) | Configure public access settings on cloud resources. |
| [Scheduling](concepts/guardrails/scheduling) | Define schedules to control cloud resource usage. |
| [Stacks/ Configured](concepts/guardrails/configured) | [DEPRECATED] Manage resource configuration using Terraform. |
Expand Down
79 changes: 79 additions & 0 deletions docs/concepts/guardrails/intelligent-assessment.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,79 @@
---
title: Intelligent Assessment Guardrails
sidebar_label: Intelligent Assessment
---

# Intelligent Assessment Guardrails

## Overview

**Intelligent Assessment** introduces an AI-powered way to define and evaluate governance policies in Turbot Guardrails.

Instead of crafting complex calculated policies, you can describe the check you want — in plain natural language — and let Guardrails interpret and check it.

This unlocks flexible, free-form compliance use cases that would otherwise require significant coding or multiple traditional guardrails.

Intelligent Assessment is complementary to existing controls (e.g., **Approved** and **Active**).

Where those controls rely on structured sub-policies, Intelligent Assessment excels when you need bespoke logic, conditional checks, or multi-step reasoning.

The primary Intelligent Assessment policy has a consistent form:
`{provider} > {service} > {resource} > Intelligent Assessment`

<div className="example">
<ul>
<li><code>AWS > S3 > Bucket > Intelligent Assessment</code></li>
<li><code>AWS > SNS > Topic > Intelligent Assessment</code></li>
<li><code>AWS > EC2 > Instance > Intelligent Assessment</code></li>
</ul>
</div>

The Intelligent Assessment guardrail and policy have a number of sub-settings to determine the
attributes of the assessment. The format of these policy types is
`{provider} > {service} > {resource} > Intelligent Assessment > {Items}`:

```
{provider} > {service} > {resource} > Intelligent Assessment > Context
{provider} > {service} > {resource} > Intelligent Assessment > User Prompt
```

The `Context` sub-policy includes the resource metadata by default but can be updated to include additional data.
The `User Prompt` sub-policy is where you would define a prompt to assess the resource.

As part of the evaluation, the AI provider will respond with `State` and `Reason`.

The `State` attribute is either:

- `OK` - Evaluation matches the given user prompt
- `Alarm` - Evaluation does not match the given user prompt
- `Error` - User prompt is empty or AI cannot determine the outcome based on the user prompt and context

### Example Guardrail: AWS > S3 > Bucket > Intelligent Assessment

The `AWS > S3 > Bucket > Intelligent Assessment` policy determines the action to take on a resource. You can set the policy to skip (don't run at all), or to check whether the resource is compliant per the user prompt.

The Intelligent Assessment sub-policies allow you to set the context and the user prompt:

<div className="example">
<ul>
<li><code>AWS > S3 > Bucket > Intelligent Assessment > Context</code></li>
<li><code>AWS > S3 > Bucket > Intelligent Assessment > User Prompt</code></li>
</ul>
</div>

Let's assume that an S3 bucket has tags `"Environment": "Non-Compliant Tag"`, and has versioning disabled.

```yaml
Tags:
- Key: Environment
Value: Non-Compliant Tag
Versioning:
MFADelete: Disabled
Status: Suspended
```

To check if the bucket has the correct `Environment` tag value and has versioning enabled:

- Set `AWS > S3 > Bucket > Intelligent Assessment > User Prompt`: `The bucket must have an Environment tag value of staging and versioning must be enabled`

The control will then evaluate the result using AI, and go to alarm with the response `The current tag Environment has a value of Non-Compliant Tag which is incorrect. Versioning is not enabled and set to Suspended`.
12 changes: 12 additions & 0 deletions docs/developers/developers-sidebar.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
{
"type": "category",
"id": "developers",
"link": "developers",
"items": [
"developers/install-mcp",
"developers/policy-pack-development",
"developers/graphql",
"developers/nunjucks",
"developers/fix-calc-policy-evaluation-errors"
]
}
Original file line number Diff line number Diff line change
Expand Up @@ -22,55 +22,55 @@ However, calculated policies can sometimes encounter errors due to misconfigurat

Log into the Guardrails console with provided local credentials or by using any SAML based login and Select **Policies** from the top navigation menu.

![Navigate to Reports](/images/docs/guardrails/guides/using-guardrails/troubleshooting/fix-calc-policy-evaluation-errors/guardrails-select-policies.png)
![Navigate to Reports](./guardrails-select-policies.png)

## Step 2: Select Policy Value

Select the calculated policy in an error state that needs to be resolved. This redirects to the Policy Value page, where the error message is displayed.

Here, the error occurs due to `TypeError: Cannot read properties of undefined (reading 'toString')`, indicating that the referenced property is undefined and cannot be converted to a string.

![Select Calculated Policy](/images/docs/guardrails/guides/using-guardrails/troubleshooting/fix-calc-policy-evaluation-errors/guardrails-select-calc-policy-in-error.png)
![Select Calculated Policy](./guardrails-select-calc-policy-in-error.png)

## Step 3: Select Calculated Policy

Select the **Calculated** policy, with an ✅ `EFFECTIVE SETTING`.

![Effective Setting](/images/docs/guardrails/guides/using-guardrails/troubleshooting/fix-calc-policy-evaluation-errors/guardrails-select-effective-calc-policy.png)
![Effective Setting](./guardrails-select-effective-calc-policy.png)

## Step 4: Edit Policy Setting

Select **Edit** from the top right corner.

![Select Edit](/images/docs/guardrails/guides/using-guardrails/troubleshooting/fix-calc-policy-evaluation-errors/guardrails-select-edit.png)
![Select Edit](./guardrails-select-edit.png)

Choose **Launch calculated policy builder**.

![Launch Calculated Policy Builder](/images/docs/guardrails/guides/using-guardrails/troubleshooting/fix-calc-policy-evaluation-errors/guardrails-launch-policy-builder.png)
![Launch Calculated Policy Builder](./guardrails-launch-policy-builder.png)

This displays the `GraphQL` query and `Jinja2/Nunjucks` template used in the calculated policy, providing insight into how the policy value is generated.

![Calculated Policy Builder Page](/images/docs/guardrails/guides/using-guardrails/troubleshooting/fix-calc-policy-evaluation-errors/calc-policy-builder-page.png)
![Calculated Policy Builder Page](./calc-policy-builder-page.png)

## Step 5: Resolve Calculated Policy

Select the `Test Resource`, update the corrected Jinja2/Nunjucks template, and view the real-time output to verify if the fix is successful. Choose **Update**.

![Resolve Error](/images/docs/guardrails/guides/using-guardrails/troubleshooting/fix-calc-policy-evaluation-errors/guardrails-resolve-cal-policy.png)
![Resolve Error](./guardrails-resolve-cal-policy.png)

Select **Update** from the Update Policy Setting page.

![Select Update](/images/docs/guardrails/guides/using-guardrails/troubleshooting/fix-calc-policy-evaluation-errors/guardrails-update-policy.png)
![Select Update](./guardrails-update-policy.png)

## Step 6: Review

- [ ] Verify that the policy value transitions to an `OK` state, confirming the issue has been resolved successfully.

![Policy Value State](/images/docs/guardrails/guides/using-guardrails/troubleshooting/fix-calc-policy-evaluation-errors/guardrails-policy-value-ok.png)
![Policy Value State](./guardrails-policy-value-ok.png)

- [ ] Verify that the affected control transitions to an `OK` state.

![Control State](/images/docs/guardrails/guides/using-guardrails/troubleshooting/fix-calc-policy-evaluation-errors/guardrails-control-ok-state.png)
![Control State](./guardrails-control-ok-state.png)

## Troubleshooting

Expand Down
16 changes: 16 additions & 0 deletions docs/developers/index.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
---
title: Developers
sidebar_label: Developers
---

# Developing guardrails for Guardrails

This section covers the various AI-powered features available in Guardrails.

| Section | Description
| - | -
| [Install Guardrails MCP](/guardrails/docs/developers/install-mcp) | Learn how Guardrails Model Context Protocol (MCP) server is enabled.
| [Policy Pack Development](/guardrails/docs/developers/policy-pack-development) | Learn how to use AI to develop and validate policy packs.
| [GraphQL](/guardrails/docs/developers/graphql) | Tips and Tricks for GraphQL
| [Nunjucks](/guardrails/docs/developers/nunjucks) | Tips and tricks for using Nunjucks, including troubleshooting
| [Resolve Calculated Policy Errors](/guardrails/docs/developers/fix-calc-policy-evaluation-errors) | Troubleshooting calc policy errors
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
---
title: AI Tools (MCP)
sidebar_label: AI Tools (MCP)
title: Install Guardrails MCP
sidebar_label: Install MCP for AI
---

# Configure Guardrails MCP Server
# Install the Guardrails' MCP Server for AI Assisted Development

In this guide, you will:

Expand Down
Loading