Sign in Dashboard Get started
  1. Packages
  2. Packages
  3. Grafana Cloud
  4. API Docs
  5. agento11y
  6. HookRule
Viewing docs for Grafana v2.38.0
published on Friday, Aug 7, 2026 by pulumiverse
Schema (JSON)
pulumiverse/pulumi-grafana

grafana.agento11y.HookRule

grafana logo
Viewing docs for Grafana v2.38.0
published on Friday, Aug 7, 2026 by pulumiverse
Schema (JSON)
pulumiverse/pulumi-grafana

    Manages a Grafana Agent Observability hook (guard) rule. Hook rules run synchronously on the request path and can deny or warn on matching generations, block tool calls, or redact content.

    At least one of evaluatorIds, blockedTools, or redact must be set. Requires a Grafana instance with the grafana-agento11y-app plugin installed. Writes require a user or service account with the grafana-agento11y-app.eval:write permission, which only the Admin basic role grants by default.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as grafana from "@pulumiverse/grafana";

const example = new grafana.agento11y.HookRule("example", {
    ruleId: "block_destructive_tools",
    phase: "preflight",
    actionOnFail: "deny",
    blockedTools: [
        "delete_*",
        "drop_*",
    ],
    redacts: [{
        id: "emails",
        regex: "[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+",
    }],
});

    import pulumi
import pulumiverse_grafana as grafana

example = grafana.agento11y.HookRule("example",
    rule_id="block_destructive_tools",
    phase="preflight",
    action_on_fail="deny",
    blocked_tools=[
        "delete_*",
        "drop_*",
    ],
    redacts=[{
        "id": "emails",
        "regex": "[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+",
    }])

    package main

import (
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	"github.com/pulumiverse/pulumi-grafana/sdk/v2/go/grafana/agento11y"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := agento11y.NewHookRule(ctx, "example", &agento11y.HookRuleArgs{
			RuleId:       pulumi.String("block_destructive_tools"),
			Phase:        pulumi.String("preflight"),
			ActionOnFail: pulumi.String("deny"),
			BlockedTools: pulumi.StringArray{
				pulumi.String("delete_*"),
				pulumi.String("drop_*"),
			},
			Redacts: agento11y.HookRuleRedactArray{
				&agento11y.HookRuleRedactArgs{
					Id:    pulumi.String("emails"),
					Regex: pulumi.String("[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+"),
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Grafana = Pulumiverse.Grafana;

return await Deployment.RunAsync(() => 
{
    var example = new Grafana.Agento11y.HookRule("example", new()
    {
        RuleId = "block_destructive_tools",
        Phase = "preflight",
        ActionOnFail = "deny",
        BlockedTools = new[]
        {
            "delete_*",
            "drop_*",
        },
        Redacts = new[]
        {
            new Grafana.Agento11y.Inputs.HookRuleRedactArgs
            {
                Id = "emails",
                Regex = "[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+",
            },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.grafana.agento11y.HookRule;
import com.pulumi.grafana.agento11y.HookRuleArgs;
import com.pulumi.grafana.agento11y.inputs.HookRuleRedactArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new HookRule("example", HookRuleArgs.builder()
            .ruleId("block_destructive_tools")
            .phase("preflight")
            .actionOnFail("deny")
            .blockedTools(            
                "delete_*",
                "drop_*")
            .redacts(HookRuleRedactArgs.builder()
                .id("emails")
                .regex("[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+")
                .build())
            .build());

    }
}

    resources:
  example:
    type: grafana:agento11y:HookRule
    properties:
      ruleId: block_destructive_tools
      phase: preflight
      actionOnFail: deny
      blockedTools:
        - delete_*
        - drop_*
      redacts:
        - id: emails
          regex: '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+'

    Example coming soon!

    Create HookRule Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new HookRule(name: string, args: HookRuleArgs, opts?: CustomResourceOptions);
    @overload
def HookRule(resource_name: str,
             args: HookRuleArgs,
             opts: Optional[ResourceOptions] = None)

@overload
def HookRule(resource_name: str,
             opts: Optional[ResourceOptions] = None,
             rule_id: Optional[str] = None,
             action_on_fail: Optional[str] = None,
             blocked_tools: Optional[Sequence[str]] = None,
             enabled: Optional[bool] = None,
             evaluator_ids: Optional[Sequence[str]] = None,
             match: Optional[str] = None,
             phase: Optional[str] = None,
             priority: Optional[int] = None,
             redacts: Optional[Sequence[HookRuleRedactArgs]] = None,
             selector: Optional[str] = None,
             short_circuit: Optional[bool] = None)
    func NewHookRule(ctx *Context, name string, args HookRuleArgs, opts ...ResourceOption) (*HookRule, error)
    public HookRule(string name, HookRuleArgs args, CustomResourceOptions? opts = null)
    public HookRule(String name, HookRuleArgs args)
public HookRule(String name, HookRuleArgs args, CustomResourceOptions options)

    type: grafana:agento11y:HookRule
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "grafana_agento11y_hook_rule" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args HookRuleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args HookRuleArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args HookRuleArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args HookRuleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args HookRuleArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var hookRuleResource = new Grafana.Agento11y.HookRule("hookRuleResource", new()
{
    RuleId = "string",
    ActionOnFail = "string",
    BlockedTools = new[]
    {
        "string",
    },
    Enabled = false,
    EvaluatorIds = new[]
    {
        "string",
    },
    Match = "string",
    Phase = "string",
    Priority = 0,
    Redacts = new[]
    {
        new Grafana.Agento11y.Inputs.HookRuleRedactArgs
        {
            Regex = "string",
            Id = "string",
        },
    },
    Selector = "string",
    ShortCircuit = false,
});

    example, err := agento11y.NewHookRule(ctx, "hookRuleResource", &agento11y.HookRuleArgs{
	RuleId:       pulumi.String("string"),
	ActionOnFail: pulumi.String("string"),
	BlockedTools: pulumi.StringArray{
		pulumi.String("string"),
	},
	Enabled: pulumi.Bool(false),
	EvaluatorIds: pulumi.StringArray{
		pulumi.String("string"),
	},
	Match:    pulumi.String("string"),
	Phase:    pulumi.String("string"),
	Priority: pulumi.Int(0),
	Redacts: agento11y.HookRuleRedactArray{
		&agento11y.HookRuleRedactArgs{
			Regex: pulumi.String("string"),
			Id:    pulumi.String("string"),
		},
	},
	Selector:     pulumi.String("string"),
	ShortCircuit: pulumi.Bool(false),
})

    resource "grafana_agento11y_hook_rule" "hookRuleResource" {
  lifecycle {
    create_before_destroy = true
  }
  rule_id        = "string"
  action_on_fail = "string"
  blocked_tools  = ["string"]
  enabled        = false
  evaluator_ids  = ["string"]
  match          = "string"
  phase          = "string"
  priority       = 0
  redacts {
    regex = "string"
    id    = "string"
  }
  selector      = "string"
  short_circuit = false
}

    var hookRuleResource = new HookRule("hookRuleResource", HookRuleArgs.builder()
    .ruleId("string")
    .actionOnFail("string")
    .blockedTools("string")
    .enabled(false)
    .evaluatorIds("string")
    .match("string")
    .phase("string")
    .priority(0)
    .redacts(HookRuleRedactArgs.builder()
        .regex("string")
        .id("string")
        .build())
    .selector("string")
    .shortCircuit(false)
    .build());

    hook_rule_resource = grafana.agento11y.HookRule("hookRuleResource",
    rule_id="string",
    action_on_fail="string",
    blocked_tools=["string"],
    enabled=False,
    evaluator_ids=["string"],
    match="string",
    phase="string",
    priority=0,
    redacts=[{
        "regex": "string",
        "id": "string",
    }],
    selector="string",
    short_circuit=False)

    const hookRuleResource = new grafana.agento11y.HookRule("hookRuleResource", {
    ruleId: "string",
    actionOnFail: "string",
    blockedTools: ["string"],
    enabled: false,
    evaluatorIds: ["string"],
    match: "string",
    phase: "string",
    priority: 0,
    redacts: [{
        regex: "string",
        id: "string",
    }],
    selector: "string",
    shortCircuit: false,
});

    type: grafana:agento11y:HookRule
properties:
    actionOnFail: string
    blockedTools:
        - string
    enabled: false
    evaluatorIds:
        - string
    match: string
    phase: string
    priority: 0
    redacts:
        - id: string
          regex: string
    ruleId: string
    selector: string
    shortCircuit: false

    HookRule Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The HookRule resource accepts the following input properties:

    RuleId string
    Tenant-unique identifier of the hook rule. Changing this forces a new resource.
    ActionOnFail string
    Action taken when the hook fails. One of deny, warn. Defaults to deny.
    BlockedTools List<string>
    Glob patterns of tool call names to block (for example ["delete_*"]).
    Enabled bool
    Whether the hook rule is enabled. Defaults to true.
    EvaluatorIds List<string>
    IDs of the evaluators to run synchronously. Optional when blockedTools or redact is set.
    Match string
    Optional JSON object of match filters (for example {"agentName":"checkout-*"}). Omit to match everything.
    Phase string
    When the hook runs. One of preflight, postflight. Defaults to preflight.
    Priority int
    Evaluation priority; lower priority rules run first. Defaults to 0.
    Redacts List<Pulumiverse.Grafana.Agento11y.Inputs.HookRuleRedact>
    Ordered regex redaction patterns applied to request/response text.
    Selector string
    Which generations the hook applies to. One of all, userVisibleTurn, allAssistantGenerations, toolCallSteps, erroredGenerations. Defaults to all.
    ShortCircuit bool
    When true (default), stop at the first failed rule. When false, run all evaluators and deny if any failed.
    RuleId string
    Tenant-unique identifier of the hook rule. Changing this forces a new resource.
    ActionOnFail string
    Action taken when the hook fails. One of deny, warn. Defaults to deny.
    BlockedTools []string
    Glob patterns of tool call names to block (for example ["delete_*"]).
    Enabled bool
    Whether the hook rule is enabled. Defaults to true.
    EvaluatorIds []string
    IDs of the evaluators to run synchronously. Optional when blockedTools or redact is set.
    Match string
    Optional JSON object of match filters (for example {"agentName":"checkout-*"}). Omit to match everything.
    Phase string
    When the hook runs. One of preflight, postflight. Defaults to preflight.
    Priority int
    Evaluation priority; lower priority rules run first. Defaults to 0.
    Redacts []HookRuleRedactArgs
    Ordered regex redaction patterns applied to request/response text.
    Selector string
    Which generations the hook applies to. One of all, userVisibleTurn, allAssistantGenerations, toolCallSteps, erroredGenerations. Defaults to all.
    ShortCircuit bool
    When true (default), stop at the first failed rule. When false, run all evaluators and deny if any failed.
    rule_id string
    Tenant-unique identifier of the hook rule. Changing this forces a new resource.
    action_on_fail string
    Action taken when the hook fails. One of deny, warn. Defaults to deny.
    blocked_tools list(string)
    Glob patterns of tool call names to block (for example ["delete_*"]).
    enabled bool
    Whether the hook rule is enabled. Defaults to true.
    evaluator_ids list(string)
    IDs of the evaluators to run synchronously. Optional when blockedTools or redact is set.
    match string
    Optional JSON object of match filters (for example {"agentName":"checkout-*"}). Omit to match everything.
    phase string
    When the hook runs. One of preflight, postflight. Defaults to preflight.
    priority number
    Evaluation priority; lower priority rules run first. Defaults to 0.
    redacts list(object)
    Ordered regex redaction patterns applied to request/response text.
    selector string
    Which generations the hook applies to. One of all, userVisibleTurn, allAssistantGenerations, toolCallSteps, erroredGenerations. Defaults to all.
    short_circuit bool
    When true (default), stop at the first failed rule. When false, run all evaluators and deny if any failed.
    ruleId String
    Tenant-unique identifier of the hook rule. Changing this forces a new resource.
    actionOnFail String
    Action taken when the hook fails. One of deny, warn. Defaults to deny.
    blockedTools List<String>
    Glob patterns of tool call names to block (for example ["delete_*"]).
    enabled Boolean
    Whether the hook rule is enabled. Defaults to true.
    evaluatorIds List<String>
    IDs of the evaluators to run synchronously. Optional when blockedTools or redact is set.
    match String
    Optional JSON object of match filters (for example {"agentName":"checkout-*"}). Omit to match everything.
    phase String
    When the hook runs. One of preflight, postflight. Defaults to preflight.
    priority Integer
    Evaluation priority; lower priority rules run first. Defaults to 0.
    redacts List<HookRuleRedact>
    Ordered regex redaction patterns applied to request/response text.
    selector String
    Which generations the hook applies to. One of all, userVisibleTurn, allAssistantGenerations, toolCallSteps, erroredGenerations. Defaults to all.
    shortCircuit Boolean
    When true (default), stop at the first failed rule. When false, run all evaluators and deny if any failed.
    ruleId string
    Tenant-unique identifier of the hook rule. Changing this forces a new resource.
    actionOnFail string
    Action taken when the hook fails. One of deny, warn. Defaults to deny.
    blockedTools string[]
    Glob patterns of tool call names to block (for example ["delete_*"]).
    enabled boolean
    Whether the hook rule is enabled. Defaults to true.
    evaluatorIds string[]
    IDs of the evaluators to run synchronously. Optional when blockedTools or redact is set.
    match string
    Optional JSON object of match filters (for example {"agentName":"checkout-*"}). Omit to match everything.
    phase string
    When the hook runs. One of preflight, postflight. Defaults to preflight.
    priority number
    Evaluation priority; lower priority rules run first. Defaults to 0.
    redacts HookRuleRedact[]
    Ordered regex redaction patterns applied to request/response text.
    selector string
    Which generations the hook applies to. One of all, userVisibleTurn, allAssistantGenerations, toolCallSteps, erroredGenerations. Defaults to all.
    shortCircuit boolean
    When true (default), stop at the first failed rule. When false, run all evaluators and deny if any failed.
    rule_id str
    Tenant-unique identifier of the hook rule. Changing this forces a new resource.
    action_on_fail str
    Action taken when the hook fails. One of deny, warn. Defaults to deny.
    blocked_tools Sequence[str]
    Glob patterns of tool call names to block (for example ["delete_*"]).
    enabled bool
    Whether the hook rule is enabled. Defaults to true.
    evaluator_ids Sequence[str]
    IDs of the evaluators to run synchronously. Optional when blockedTools or redact is set.
    match str
    Optional JSON object of match filters (for example {"agentName":"checkout-*"}). Omit to match everything.
    phase str
    When the hook runs. One of preflight, postflight. Defaults to preflight.
    priority int
    Evaluation priority; lower priority rules run first. Defaults to 0.
    redacts Sequence[HookRuleRedactArgs]
    Ordered regex redaction patterns applied to request/response text.
    selector str
    Which generations the hook applies to. One of all, userVisibleTurn, allAssistantGenerations, toolCallSteps, erroredGenerations. Defaults to all.
    short_circuit bool
    When true (default), stop at the first failed rule. When false, run all evaluators and deny if any failed.
    ruleId String
    Tenant-unique identifier of the hook rule. Changing this forces a new resource.
    actionOnFail String
    Action taken when the hook fails. One of deny, warn. Defaults to deny.
    blockedTools List<String>
    Glob patterns of tool call names to block (for example ["delete_*"]).
    enabled Boolean
    Whether the hook rule is enabled. Defaults to true.
    evaluatorIds List<String>
    IDs of the evaluators to run synchronously. Optional when blockedTools or redact is set.
    match String
    Optional JSON object of match filters (for example {"agentName":"checkout-*"}). Omit to match everything.
    phase String
    When the hook runs. One of preflight, postflight. Defaults to preflight.
    priority Number
    Evaluation priority; lower priority rules run first. Defaults to 0.
    redacts List<Property Map>
    Ordered regex redaction patterns applied to request/response text.
    selector String
    Which generations the hook applies to. One of all, userVisibleTurn, allAssistantGenerations, toolCallSteps, erroredGenerations. Defaults to all.
    shortCircuit Boolean
    When true (default), stop at the first failed rule. When false, run all evaluators and deny if any failed.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the HookRule resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing HookRule Resource

    Get an existing HookRule resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: HookRuleState, opts?: CustomResourceOptions): HookRule
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        action_on_fail: Optional[str] = None,
        blocked_tools: Optional[Sequence[str]] = None,
        enabled: Optional[bool] = None,
        evaluator_ids: Optional[Sequence[str]] = None,
        match: Optional[str] = None,
        phase: Optional[str] = None,
        priority: Optional[int] = None,
        redacts: Optional[Sequence[HookRuleRedactArgs]] = None,
        rule_id: Optional[str] = None,
        selector: Optional[str] = None,
        short_circuit: Optional[bool] = None) -> HookRule
    func GetHookRule(ctx *Context, name string, id IDInput, state *HookRuleState, opts ...ResourceOption) (*HookRule, error)
    public static HookRule Get(string name, Input<string> id, HookRuleState? state, CustomResourceOptions? opts = null)
    public static HookRule get(String name, Output<String> id, HookRuleState state, CustomResourceOptions options)
    resources:  _:    type: grafana:agento11y:HookRule    get:      id: ${id}
    import {
  to = grafana_agento11y_hook_rule.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    ActionOnFail string
    Action taken when the hook fails. One of deny, warn. Defaults to deny.
    BlockedTools List<string>
    Glob patterns of tool call names to block (for example ["delete_*"]).
    Enabled bool
    Whether the hook rule is enabled. Defaults to true.
    EvaluatorIds List<string>
    IDs of the evaluators to run synchronously. Optional when blockedTools or redact is set.
    Match string
    Optional JSON object of match filters (for example {"agentName":"checkout-*"}). Omit to match everything.
    Phase string
    When the hook runs. One of preflight, postflight. Defaults to preflight.
    Priority int
    Evaluation priority; lower priority rules run first. Defaults to 0.
    Redacts List<Pulumiverse.Grafana.Agento11y.Inputs.HookRuleRedact>
    Ordered regex redaction patterns applied to request/response text.
    RuleId string
    Tenant-unique identifier of the hook rule. Changing this forces a new resource.
    Selector string
    Which generations the hook applies to. One of all, userVisibleTurn, allAssistantGenerations, toolCallSteps, erroredGenerations. Defaults to all.
    ShortCircuit bool
    When true (default), stop at the first failed rule. When false, run all evaluators and deny if any failed.
    ActionOnFail string
    Action taken when the hook fails. One of deny, warn. Defaults to deny.
    BlockedTools []string
    Glob patterns of tool call names to block (for example ["delete_*"]).
    Enabled bool
    Whether the hook rule is enabled. Defaults to true.
    EvaluatorIds []string
    IDs of the evaluators to run synchronously. Optional when blockedTools or redact is set.
    Match string
    Optional JSON object of match filters (for example {"agentName":"checkout-*"}). Omit to match everything.
    Phase string
    When the hook runs. One of preflight, postflight. Defaults to preflight.
    Priority int
    Evaluation priority; lower priority rules run first. Defaults to 0.
    Redacts []HookRuleRedactArgs
    Ordered regex redaction patterns applied to request/response text.
    RuleId string
    Tenant-unique identifier of the hook rule. Changing this forces a new resource.
    Selector string
    Which generations the hook applies to. One of all, userVisibleTurn, allAssistantGenerations, toolCallSteps, erroredGenerations. Defaults to all.
    ShortCircuit bool
    When true (default), stop at the first failed rule. When false, run all evaluators and deny if any failed.
    action_on_fail string
    Action taken when the hook fails. One of deny, warn. Defaults to deny.
    blocked_tools list(string)
    Glob patterns of tool call names to block (for example ["delete_*"]).
    enabled bool
    Whether the hook rule is enabled. Defaults to true.
    evaluator_ids list(string)
    IDs of the evaluators to run synchronously. Optional when blockedTools or redact is set.
    match string
    Optional JSON object of match filters (for example {"agentName":"checkout-*"}). Omit to match everything.
    phase string
    When the hook runs. One of preflight, postflight. Defaults to preflight.
    priority number
    Evaluation priority; lower priority rules run first. Defaults to 0.
    redacts list(object)
    Ordered regex redaction patterns applied to request/response text.
    rule_id string
    Tenant-unique identifier of the hook rule. Changing this forces a new resource.
    selector string
    Which generations the hook applies to. One of all, userVisibleTurn, allAssistantGenerations, toolCallSteps, erroredGenerations. Defaults to all.
    short_circuit bool
    When true (default), stop at the first failed rule. When false, run all evaluators and deny if any failed.
    actionOnFail String
    Action taken when the hook fails. One of deny, warn. Defaults to deny.
    blockedTools List<String>
    Glob patterns of tool call names to block (for example ["delete_*"]).
    enabled Boolean
    Whether the hook rule is enabled. Defaults to true.
    evaluatorIds List<String>
    IDs of the evaluators to run synchronously. Optional when blockedTools or redact is set.
    match String
    Optional JSON object of match filters (for example {"agentName":"checkout-*"}). Omit to match everything.
    phase String
    When the hook runs. One of preflight, postflight. Defaults to preflight.
    priority Integer
    Evaluation priority; lower priority rules run first. Defaults to 0.
    redacts List<HookRuleRedact>
    Ordered regex redaction patterns applied to request/response text.
    ruleId String
    Tenant-unique identifier of the hook rule. Changing this forces a new resource.
    selector String
    Which generations the hook applies to. One of all, userVisibleTurn, allAssistantGenerations, toolCallSteps, erroredGenerations. Defaults to all.
    shortCircuit Boolean
    When true (default), stop at the first failed rule. When false, run all evaluators and deny if any failed.
    actionOnFail string
    Action taken when the hook fails. One of deny, warn. Defaults to deny.
    blockedTools string[]
    Glob patterns of tool call names to block (for example ["delete_*"]).
    enabled boolean
    Whether the hook rule is enabled. Defaults to true.
    evaluatorIds string[]
    IDs of the evaluators to run synchronously. Optional when blockedTools or redact is set.
    match string
    Optional JSON object of match filters (for example {"agentName":"checkout-*"}). Omit to match everything.
    phase string
    When the hook runs. One of preflight, postflight. Defaults to preflight.
    priority number
    Evaluation priority; lower priority rules run first. Defaults to 0.
    redacts HookRuleRedact[]
    Ordered regex redaction patterns applied to request/response text.
    ruleId string
    Tenant-unique identifier of the hook rule. Changing this forces a new resource.
    selector string
    Which generations the hook applies to. One of all, userVisibleTurn, allAssistantGenerations, toolCallSteps, erroredGenerations. Defaults to all.
    shortCircuit boolean
    When true (default), stop at the first failed rule. When false, run all evaluators and deny if any failed.
    action_on_fail str
    Action taken when the hook fails. One of deny, warn. Defaults to deny.
    blocked_tools Sequence[str]
    Glob patterns of tool call names to block (for example ["delete_*"]).
    enabled bool
    Whether the hook rule is enabled. Defaults to true.
    evaluator_ids Sequence[str]
    IDs of the evaluators to run synchronously. Optional when blockedTools or redact is set.
    match str
    Optional JSON object of match filters (for example {"agentName":"checkout-*"}). Omit to match everything.
    phase str
    When the hook runs. One of preflight, postflight. Defaults to preflight.
    priority int
    Evaluation priority; lower priority rules run first. Defaults to 0.
    redacts Sequence[HookRuleRedactArgs]
    Ordered regex redaction patterns applied to request/response text.
    rule_id str
    Tenant-unique identifier of the hook rule. Changing this forces a new resource.
    selector str
    Which generations the hook applies to. One of all, userVisibleTurn, allAssistantGenerations, toolCallSteps, erroredGenerations. Defaults to all.
    short_circuit bool
    When true (default), stop at the first failed rule. When false, run all evaluators and deny if any failed.
    actionOnFail String
    Action taken when the hook fails. One of deny, warn. Defaults to deny.
    blockedTools List<String>
    Glob patterns of tool call names to block (for example ["delete_*"]).
    enabled Boolean
    Whether the hook rule is enabled. Defaults to true.
    evaluatorIds List<String>
    IDs of the evaluators to run synchronously. Optional when blockedTools or redact is set.
    match String
    Optional JSON object of match filters (for example {"agentName":"checkout-*"}). Omit to match everything.
    phase String
    When the hook runs. One of preflight, postflight. Defaults to preflight.
    priority Number
    Evaluation priority; lower priority rules run first. Defaults to 0.
    redacts List<Property Map>
    Ordered regex redaction patterns applied to request/response text.
    ruleId String
    Tenant-unique identifier of the hook rule. Changing this forces a new resource.
    selector String
    Which generations the hook applies to. One of all, userVisibleTurn, allAssistantGenerations, toolCallSteps, erroredGenerations. Defaults to all.
    shortCircuit Boolean
    When true (default), stop at the first failed rule. When false, run all evaluators and deny if any failed.

    Supporting Types

    HookRuleRedact, HookRuleRedactArgs

    Regex string
    Regular expression to redact.
    Id string
    Optional stable identifier for the pattern.
    Regex string
    Regular expression to redact.
    Id string
    Optional stable identifier for the pattern.
    regex string
    Regular expression to redact.
    id string
    Optional stable identifier for the pattern.
    regex String
    Regular expression to redact.
    id String
    Optional stable identifier for the pattern.
    regex string
    Regular expression to redact.
    id string
    Optional stable identifier for the pattern.
    regex str
    Regular expression to redact.
    id str
    Optional stable identifier for the pattern.
    regex String
    Regular expression to redact.
    id String
    Optional stable identifier for the pattern.

    Import

    terraform import grafana_agento11y_hook_rule.name "{{ rule_id }}"

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    grafana pulumiverse/pulumi-grafana
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the grafana Terraform Provider.
    grafana logo
    Viewing docs for Grafana v2.38.0
    published on Friday, Aug 7, 2026 by pulumiverse
    Schema (JSON)
    pulumiverse/pulumi-grafana

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial