Generating security guardrails for AI code agents

Use the AI chatbot in AppScan on Cloud to generate a tailored set of security guardrails for use by developers within IDEs. Guardrails ensure that any code generated by an AI agent does not introduce vulnerabilities into the application.

To generate guardrails:
  1. In AppScan on Cloud, open an application.
  2. On the Applications page, click on the AI assistant icon ().
  3. Either:
    • Click "Help me build a security instructions file for my IDE's LLM," or
    • Write your own prompt.

      For example, "Help me create security guardrails for my application."

  4. Confirm that the application for which you want to create guardrails is the current application.
  5. Respond to four primary questions in the AI assistant.
    1. What language, framework, and runtime version are you using?
    2. Does this application connect to a database or execute system-level commands? If yes, which database and driver/ORM?
    3. How does the app handle authenticatoin and authorization?
    4. Does the app include any high-risk features I should guardrtail explicitly?

    If your responses are not clear to the the AI assitant, it will ask clarifying questions.

    The AI assistant generates a security policy that you can save as a markdown file or can be copied to the relevant file within the IDE.

  6. Add the policy to the following locations based on the target agent used to create the code:
    Target agent Repository location and required filename Notes/requirements
    Cursor <root directory>/.cursorrules Alternatively, the file can reside in .cursor/rules/; however the root file is best for Phase 1 MVP simplicity.
    Claude code <root directory>/CLAUDE.md Anthropic's native standing-orders format. Instructions must note to append to this file if it already exists.
    GitHub CoPilot <root directory>/copilot-instructions.md Parsed automatically at the start of every Copilot chat session.
    Windsurf (Cascade) <root directory>/.windsurfrules Requires simple markdown headers to ensure Cascade's memory layers latch onto it.
    Universal Fallback <root directory>/AGENTS.md Emerging cross-compatible ecosystem standard supported by multiple open-source agent frameworks.

Sample output

# AI Coding Security Policy — FastAPI / Python 3.12

> Security policies for AI coding assistants in this repository.
> Save as `.appscan/policy.md` in the repo root.

## Anti-Hallucination Rules

- NEVER invent library names, package names, framework APIs, middleware, or configuration flags not present in this stack.
- NEVER suggest packages you cannot confirm are real and actively maintained for Python 3.12.
- If uncertain whether a function or package exists in Python 3.12 — say so explicitly.
- NEVER fabricate security controls or framework features.

## Security Baseline

- NEVER disable or bypass FastAPI, Starlette, or server security controls for convenience.
- NEVER hardcode credentials, API keys, JWT secrets, or connection strings in source code or version-controlled files.
- ALWAYS validate and sanitize all external input at the API boundary using explicit request models and strict typing.
- NEVER silently swallow security-related exceptions.
- REQUIRED: apply least privilege to service accounts, MongoDB users, and any backing services.
- REQUIRED: use Python 3.12 standard-library security-safe primitives where available; prefer `secrets` over `random` for security-sensitive values.

## NoSQL Injection Prevention

- NEVER pass user input as MongoDB query operators, filters, or document keys without strict validation.
- MUST validate all query inputs are scalar values unless a specific structured schema is explicitly required.
- REQUIRED: reject objects containing `$`-prefixed keys or unsafe operator injection from client input.
- REQUIRED: use ODM / typed access-layer methods exclusively for query construction.
- NEVER use `$where` with user input; use explicit field matching only.

## JWT Security

- NEVER accept tokens without verifying the cryptographic signature server-side.
- MUST allowlist signing algorithms such as `RS256` or `ES256`; NEVER permit `alg: "none"`.
- REQUIRED: validate `exp`, `iss`, `aud`, and `nbf` on every protected request.
- NEVER trust client-decoded JWT claims without server-side re-verification.
- NEVER store tokens in browser-accessible storage; prefer `HttpOnly`, `Secure` cookies when feasible.
- REQUIRED: centralize token validation in FastAPI dependencies or middleware and enforce authorization on every protected route.

## Sensitive Data / PII Handling

- TREAT all PII as high-sensitivity data and collect only fields required for the business purpose.
- NEVER log PII, authentication tokens, or raw request bodies containing personal data.
- REQUIRED: mask or redact PII in application logs, error messages, traces, and monitoring events.
- REQUIRED: encrypt PII in transit and at rest using approved platform controls.
- NEVER return unnecessary PII fields in API responses; use response models to minimize exposure.
- REQUIRED: enforce server-side authorization checks before any read, update, export, or deletion of PII.
- REQUIRED: define retention and deletion behavior for PII; NEVER keep personal data indefinitely by default.

## Supply Chain Control

- MUST pin or constrain security-critical dependency versions; avoid unbounded ranges.
- NEVER introduce dependencies with known unpatched CVEs without security review.
- REQUIRED: run vulnerability scanning in CI using tools appropriate for Python dependencies.