{
 "schema_version": 1,
 "generated": "2026-10-23",
 "id": "ghuntley-preflight--tune-detection-rules-in-advisory-mode",
 "repo": "ghuntley/preflight",
 "repo_url": "https://github.com/ghuntley/preflight",
 "repo_slug": "ghuntley-preflight",
 "title": "Tune detection rules in advisory mode first",
 "page_title": "How to tune detection rules in advisory mode first with Preflight",
 "summary": "Run advisory mode to log findings without changing traffic, then switch to enforcement.",
 "who": "A platform engineer who must confirm false positives are low before enforcing redaction across a team's agent traffic.",
 "problem": "Enforcing rules too early can break legitimate prompts, but staying silent means secrets flow unchecked.",
 "outcome": "The team sees which rules fire on real traffic and can add stopwords or a carnet before switching to redact or no-go.",
 "steps": [
  "Set `mode = \"advisory\"` in a config file (inferred, check the README)",
  "Validate it with `preflight check --config /path/to/config.toml` (inferred, check the README)",
  "Start the proxy with `preflight serve --config /path/to/config.toml`",
  "Review `inspection.finding` events and rule IDs in the JSON logs",
  "Add exact exemptions to `stopwords` or hashes to `carnet`, then switch mode to `redact`"
 ],
 "agent_prompt": "Using the preflight repo at github.com/ghuntley/preflight, set the mode to advisory in a config file, run preflight check, and send <N> sample prompts through the proxy. Report each rule_id that fired and whether it was a true or false positive, and verify that the forwarded content matches the original.",
 "agents": [
  "any"
 ],
 "difficulty": "Advanced",
 "time": "45 minutes",
 "basis": "readme",
 "caveat": "The README says advisory mode is useful for tuning but that detected secrets can reach the model in that mode, so keep it away from sensitive repositories.",
 "category": "Software and DevOps",
 "tags": [
  "Software and DevOps"
 ],
 "lang": "rust",
 "requirements": [
  "A running underclass instance on 127.0.0.1:8080",
  "Nix (for `nix run`) or devenv and Cargo for a local checkout",
  "A coding harness or client that can change its base URL to http://127.0.0.1:8081/v1",
  "Bubblewrap available for the default sandboxed attachment workers"
 ],
 "risk": "none",
 "seen_in_the_wild": false,
 "mentioned_publicly": false,
 "risks": [
  {
   "tag": "credentials",
   "notice": "Advisory mode forwards the original content, so detected secrets can reach the model while you tune rules."
  }
 ],
 "best": false,
 "score": 0.7,
 "evidence": [],
 "url": "https://dedupedai.com/use-cases/ghuntley-preflight/tune-detection-rules-in-advisory-mode/",
 "md": "https://dedupedai.com/use-cases/ghuntley-preflight/tune-detection-rules-in-advisory-mode/index.md",
 "disclaimer": "Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked \"Seen in the wild\", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email hello@dedupedai.com and we will look at it promptly.",
 "api": "https://dedupedai.com/api/v1/usecases/ghuntley-preflight--tune-detection-rules-in-advisory-mode.json",
 "api_version": "v1"
}