core: add more boolean operations to branching on_result

[gdozortsev]

Description

Result in branch-chains only check exact equality. This equality check happens in filter/src/results.rs on line 117:

pub fn matches(&self, key: &str, value: &str) -> bool {
        self.get(key).is_some_and(|v| v == value)
    }

This makes it difficult to take an action based on multiple outputs. This issue proposes to add the ability to use more boolean operations to branch, including

• if response contains result
• if response is anything but result
• if response is any of result1, result2, result3, ...., resultN

Motivation

This change will allow Praxis to support more types of guardrails.

Lakera Guard

This equals matching works for Lakera guard, as it always returns "true" or "false" for whether its been flagged, so we check for "true" in the result. For eg.

branch_chains:
          - name: block_flagged
            on_result:
              filter: http_callout
              key: flagged
              result: "true"

LlamaGuard

However, LlamaGuard returns "safe" for safe request and "unsafe01", "unsafe02", .... "unsafe13", where the number after unsafe represents the severity code (the reason for rejection). So, checking for result: "unsafe" would give a false negative. Ideally, we should be able to check if the result contains a particular keyword (for example, "unsafe03" contains "unsafe", so it would reject), or we should be able to check for anything except a certain condition (for example, if the result is anything but "safe", reject).

Azure Content Safety

Azure Content Safety is similar to LlamaGuard in that it has multiple outputs for unsafe. However, it uses just numbers:

• Returns “0” when the message content is safe
• Anything else is unsafe (uses “2”, “4”, and “6”)
  So, checking for containing a certain keyword would not work. We would need to check either if its in {“2”, “4”, “6“} for rejection, or check that its not "0"

Alternatives Considered

1. (Current workaround for LlamaGuard), there is a control character after "unsafe" before the severity number, so just strip after the control character for exact equality to result: "unsafe". This does not work for Azure Content Safety as it only has the numbers
2. Have a branch chain for each condition of rejection (for example, reject on “2”, “4”, and “6”). This will make the config pretty lengthy/repetitive (LlamaGuard has 13 codes for rejection), but works with what we already have.

Area

Core / Config

Parent Epic (optional)

No response

[praxis-bot]

We're closing this issue because we've moved all proposals to praxis-proxy/enhancements. Please see our announcement for more details.

We apologize for any inconvenience. Please re-file this as a proposal in the new repository and let us know if you need any help. 🖖