Conditions

Open Protect → Policies → Detection rules (/rule-engine) and select a rule of kind Match to open its detail page. A rule’s matching logic lives in its Condition Groups section there. Conditions are organized into groups: each group has its own AND/OR operator for the conditions inside it, and the rule’s top-level Group Operator (set when you created the rule, editable from Edit Details) decides how the groups themselves are combined.

Adding groups and conditions

• On a rule with no conditions yet, you’ll see “No condition groups yet.” and an Add First Group button.
• On a rule that already has groups, click Add Group to add another one.
• Inside a group, click Add Condition to add a condition. Each group shows its own AND/OR choice, labeled “within group”, for combining the conditions inside it.
• When you’re done, click Save Conditions to persist your changes.

Fields, operators, and values

Each condition has three parts:

• Field - a dropdown. You choose from a fixed list of fields (there’s no way to type an arbitrary custom field name).
• Operator - a dropdown whose options depend on the field’s data type (string or number - see below). The dropdown shows symbols for comparisons (=, ≠, >, ≥, <, ≤); the tables below also give each operator’s stored name.
• Value - a text input. Every string field offers suggestions labeled “Top 100 values from traces. Press Enter to add a custom value.” Number fields take a typed number.

Available fields

All fields come from your trace/telemetry data. Hover the info icon beside a field in the dropdown to see its description.

Field	Attribute it matches	Type	What it holds
Service Name	ServiceName	string	The service name reported by the SDK
Span Name	SpanName	string	The operation or span name
Span Kind	SpanKind	string	CLIENT, SERVER, INTERNAL and so on
Duration (ms)	Duration	number	Span duration in milliseconds
Status Code	StatusCode	string	Span status: OK, ERROR or UNSET
Deployment Env	deployment.environment	string	Deployment environment, such as production or staging
Service Name (OTel)	service.name	string	The OpenTelemetry resource attribute service.name
Gen AI System	gen_ai.system	string	AI provider identifier, such as openai or anthropic
Model	gen_ai.request.model	string	Model name, such as gpt-4o
Input Tokens	gen_ai.usage.input_tokens	number	Prompt (input) tokens used
Output Tokens	gen_ai.usage.output_tokens	number	Completion (output) tokens generated
Total Cost ($)	gen_ai.usage.total_cost	number	Total cost of the request in USD
Temperature	gen_ai.request.temperature	number	Sampling temperature used for the request (0–2)
Tool name	gen_ai.tool.name	string	The tool name on tool or function-call spans
Tool call name	gen_ai.tool.call.name	string	The name of an individual tool invocation
Agent client	coding_agent.client	string	The coding agent that sent the span, such as cursor, claude_code or codex
Permission mode	coding_agent.policy.permission_mode	string	The coding agent’s permission mode, such as default, plan, acceptEdits or bypassPermissions
Content capture mode	coding_agent.content_capture_mode	string	How much content the collector kept: minimal, metadata_only or full
User classification	coding_agent.user.classification	string	How the session was classified: work, personal or disputed
Session outcome	coding_agent.session.outcome	string	How the coding session ended, such as completed, abandoned or cancelled
Agent tool	coding_agent.tool.name	string	The tool name on coding-agent tool spans

A condition is checked against the value the rule is given under the field’s attribute name. When you call the Evaluate API yourself, use the attribute name (for example gen_ai.request.model) as the key in fields.

String field operators

Operator	Description
equals	Exact match
not_equals	Does not match
contains	Substring match
not_contains	Substring not present
starts_with	Prefix match
ends_with	Suffix match
regex	Regular expression match
in	Value is one of a comma-separated list
not_in	Value is not one of a comma-separated list

Number field operators

Operator	Description
equals	Exact numeric match
not_equals	Does not match numerically
gt	Greater than
gte	Greater than or equal to
lt	Less than
lte	Less than or equal to
between	Inclusive range, entered as min,max

Note

There’s currently no boolean-type field in the condition builder, so boolean operators aren’t reachable from the UI today. The underlying evaluation logic does support an equals check for boolean values at the API level, but that’s a forward-looking detail rather than something you can build visually yet.

Worked example

Say you want a rule to match requests to a specific, more expensive model where the cost is also high - a candidate for a cost alert:

1. Click Add First Group (or Add Group if the rule already has one).
2. Leave the group’s “within group” operator on AND.
3. Click Add Condition, choose Field = Model, Operator = equals, Value = the model name (e.g. gpt-4).
4. Click Add Condition again, choose Field = Total Cost ($), Operator = gt, Value = 1000.
5. Click Save Conditions.

This group now matches any request where Model equals your chosen model AND Total Cost is greater than 1000. If you add a second group, the rule’s top-level Group Operator decides whether both groups must match (AND) or either one is enough (OR).

---

Preview

Test your saved conditions against recent traces before relying on them

Linked Entities

Connect the rule to a Context, Prompt, or Evaluation Type