# PatternContentGuardOptions

> Tracon documentation. Tracon is a .NET package family that adds a control
> plane on Microsoft Agent Framework, published as NuGet packages that run
> inside your own ASP.NET Core application.
>
> Page: https://tracon.dev/api/tracon.patterncontentguardoptions/
> Summary: PatternContentGuardOptions: Settings for the built-in pattern-based guard.

<div class="api-provenance">Namespace Tracon · Assembly <code>Tracon.Core.dll</code></div>

Settings for the built-in pattern-based guard.

```csharp
public sealed class PatternContentGuardOptions
```

<dl class="api-relations"><dt>Inheritance</dt><dd><a href="https://learn.microsoft.com/dotnet/api/system.object">object</a> ← <a href="/api/tracon.patterncontentguardoptions/">PatternContentGuardOptions</a></dd><dt>Inherited Members</dt><dd><a href="https://learn.microsoft.com/dotnet/api/system.object.gettype">object.GetType()</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.tostring">object.ToString()</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.equals#system-object-equals(system-object)">object.Equals(object?)</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.equals#system-object-equals(system-object-system-object)">object.Equals(object?, object?)</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.referenceequals">object.ReferenceEquals(object?, object?)</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.gethashcode">object.GetHashCode()</a></dd></dl>

## Remarks

Read from the `Tracon:ContentGuard:Pattern` configuration section.

This class deliberately **has no** `Enabled` flag. The no-surprises rule's
gate is the registration itself: `AddTracon` does not register the
built-in guard, so in a default setup the inspection wrapper is never added
to the pipeline and the cost is *exactly* zero. Adding an
`Enabled` flag would require the guard to be registered but turned off;
then the claim "if no guard is registered the cost is zero" would become
unmeasurable.

If you need to keep the guard running but temporarily disable it, empty
[PatternContentGuardOptions.DeniedTerms](/api/tracon.patterncontentguardoptions/#Tracon_PatternContentGuardOptions_DeniedTerms) and set [PatternContentGuardOptions.MaskedPii](/api/tracon.patterncontentguardoptions/#Tracon_PatternContentGuardOptions_MaskedPii) to
[PiiPatterns.None](/api/tracon.piipatterns/): the guard then sees no rule and returns
[ContentGuardResult.Allow](/api/tracon.contentguardresult/#Tracon_ContentGuardResult_Allow) on the first inspection.

## Constructors

### <a id="Tracon_PatternContentGuardOptions__ctor"></a> PatternContentGuardOptions\(\)

```csharp
public PatternContentGuardOptions()
```

## Fields

### <a id="Tracon_PatternContentGuardOptions_SectionName"></a> SectionName

The configuration section name.

```csharp
public const string SectionName = "Tracon:ContentGuard:Pattern"
```

#### Field Value

 [string](https://learn.microsoft.com/dotnet/api/system.string)

## Properties

### <a id="Tracon_PatternContentGuardOptions_DeniedTerms"></a> DeniedTerms

Denied terms. A match produces [ContentGuardAction.Block](/api/tracon.contentguardaction/).

```csharp
public IList<string> DeniedTerms { get; }
```

#### Property Value

 [IList](https://learn.microsoft.com/dotnet/api/system.collections.generic.ilist\-1)<[string](https://learn.microsoft.com/dotnet/api/system.string)\>

#### Remarks

The comparison is case-insensitive and searches for a word fragment
(`IndexOf`); it is not a regex, so a value the consumer writes
carries no ReDoS risk.

### <a id="Tracon_PatternContentGuardOptions_MaskReplacement"></a> MaskReplacement

The text written in place of a masked match. Default `[redacted]`.

```csharp
public string MaskReplacement { get; set; }
```

#### Property Value

 [string](https://learn.microsoft.com/dotnet/api/system.string)

### <a id="Tracon_PatternContentGuardOptions_MaskedPii"></a> MaskedPii

The built-in PII patterns to turn on. A match produces
[ContentGuardAction.Mask](/api/tracon.contentguardaction/). Default [PiiPatterns.None](/api/tracon.piipatterns/).

```csharp
public PiiPatterns MaskedPii { get; set; }
```

#### Property Value

 [PiiPatterns](/api/tracon.piipatterns/)

#### Remarks

In configuration, a comma-separated list of names (`"Email,CreditCard"`).
An empty value leaves the setting unset. A value that is not such a list stops
the application at startup with an `Options.OptionsValidationException`
that names the value as written; one misspelled name used to turn masking off
for the whole list without a word.

A value with a bit that no [PiiPatterns](/api/tracon.piipatterns/) member defines (for
example `(PiiPatterns)64`) stops the application too, whether it comes
from configuration or from code. A value set in code after binding replaces
the configured one, so it also clears a configuration error.