Add claims agent guardrails (5 categories + policy template)

litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/categories/claims_fraud_coaching.yaml

@@ -0,0 +1,146 @@
+# Claims Fraud Coaching Detection
+# Detects attempts to get the chatbot to coach users on filing fraudulent claims,
+# exaggerating injuries, forging documents, or gaming the claims system.
+#
+# Uses conditional matching: BLOCK when a fraud ACTION word appears in the same
+# sentence as a claims CONTEXT word. This avoids false positives on legitimate
+# claims inquiries that use similar vocabulary.
+category_name: "claims_fraud_coaching"
+description: "Detects coaching on fraudulent insurance claims including exaggeration, fabrication, and document forgery"
+default_action: "BLOCK"
+
+# Identifier words — fraud/deception verbs and actions
+identifier_words:
+  - "exaggerate"
+  - "exaggerating"
+  - "inflate"
+  - "inflating"
+  - "fabricate"
+  - "fabricating"
+  - "fake"
+  - "faking"
+  - "forge"
+  - "forging"
+  - "falsify"
+  - "falsifying"
+  - "misrepresent"
+  - "misrepresenting"
+  - "stage"
+  - "staging"
+  - "coach me"
+  - "trick"
+  - "tricking"
+  - "double-bill"
+  - "double bill"
+  - "unbundle"
+  - "alter"
+  - "duplicate claim"
+  - "phantom"
+  - "get away with"
+
+# Block words — claims context that combined with fraud verbs = block
+additional_block_words:
+  - "claim"
+  - "claims"
+  - "injury"
+  - "injuries"
+  - "payout"
+  - "settlement"
+  - "insurance"
+  - "medical bills"
+  - "medical records"
+  - "disability"
+  - "workers comp"
+  - "adjuster"
+  - "diagnosis"
+  - "symptoms"
+  - "documentation"
+  - "benefits"
+  - "reimbursement"
+  - "pre-existing"
+  - "accident"
+  - "whiplash"
+  - "back injury"
+  - "billing"
+  - "date of service"
+  - "condition"
+  - "damage"
+
+# Always-block keywords — explicit fraud phrases blocked regardless of context
+always_block_keywords:
+  - keyword: "file a fraudulent claim"
+    severity: "high"
+  - keyword: "fraudulent workers comp"
+    severity: "high"
+  - keyword: "fake documentation"
+    severity: "high"
+  - keyword: "forge medical records"
+    severity: "high"
+  - keyword: "stage a car accident"
+    severity: "high"
+  - keyword: "stage an accident"
+    severity: "high"
+  - keyword: "false claim look legitimate"
+    severity: "high"
+  - keyword: "bill for treatments I never received"
+    severity: "high"
+  - keyword: "bill for treatments that weren't"
+    severity: "high"
+  - keyword: "services that weren't provided"
+    severity: "high"
+  - keyword: "easiest type of insurance fraud"
+    severity: "high"
+  - keyword: "insurance fraud"
+    severity: "high"
+  - keyword: "claim fraud"
+    severity: "high"
+  - keyword: "fraudulent claim"
+    severity: "high"
+  - keyword: "injuries are hardest for insurance companies to disprove"
+    severity: "high"
+  - keyword: "hardest to disprove"
+    severity: "high"
+  - keyword: "higher settlement"
+    severity: "high"
+  - keyword: "bigger payout"
+    severity: "high"
+  - keyword: "without getting caught"
+    severity: "high"
+  - keyword: "diagnosis codes pay out the most"
+    severity: "high"
+  - keyword: "pay out the most"
+    severity: "high"
+  - keyword: "get reimbursed for a procedure that wasn't medically necessary"
+    severity: "high"
+  - keyword: "look like it was caused by"
+    severity: "high"
+  - keyword: "write a note saying my injury is worse"
+    severity: "high"
+  - keyword: "saying my injury is worse"
+    severity: "high"
+  - keyword: "worse than it is"
+    severity: "high"
+
+# Phrase patterns — regex for paraphrased fraud requests
+phrase_patterns:
+  - '\b(?:how|help|can you|tell me)\b.{0,30}\b(?:exaggerate|inflate|fake|forge|fabricate)\b.{0,30}\b(?:claim|injury|damage|disability|medical)\b'
+  - '\b(?:make|look|appear)\b.{0,20}\b(?:worse|more severe|legitimate)\b.{0,20}\b(?:claim|injury|settlement|payout)\b'
+  - '\b(?:what|which)\b.{0,15}\b(?:symptoms|injuries|diagnosis)\b.{0,20}\b(?:tell|say|put down|write)\b'
+
+# Exceptions — legitimate claims operations
+exceptions:
+  - "fraud detection"
+  - "fraud prevention"
+  - "anti-fraud"
+  - "report fraud"
+  - "reporting fraud"
+  - "suspected fraud"
+  - "investigate fraud"
+  - "fraud investigation"
+  - "fraud awareness"
+  - "how does our fraud"
+  - "detect fraud"
+  - "prevent fraud"
+  - "fraud protection"
+
+keywords: []

litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/categories/claims_medical_advice.yaml

@@ -0,0 +1,165 @@
+# Claims Medical Advice Detection
+# Detects requests for medical advice, diagnosis, or treatment recommendations
+# in a claims agent context. Unlike the generic denied_medical_advice category,
+# this allows legitimate claims-related medical term usage (code lookups,
+# coverage questions, claim filing).
+#
+# Uses conditional matching: BLOCK when a medical ADVICE-SEEKING phrase appears
+# in the same sentence as a medical TOPIC word. This avoids false positives
+# on "What does diagnosis code M54.5 mean?" while blocking "What treatment
+# do you recommend for my herniated disc?"
+category_name: "claims_medical_advice"
+description: "Detects medical advice requests while allowing legitimate claims-related medical terminology"
+default_action: "BLOCK"
+
+# Identifier words — advice-seeking and recommendation verbs/phrases
+identifier_words:
+  - "should I"
+  - "do you think"
+  - "do you recommend"
+  - "what do you recommend"
+  - "recommend"
+  - "is it safe"
+  - "is my"
+  - "can you diagnose"
+  - "can you prescribe"
+  - "diagnose what"
+  - "best medicine"
+  - "best treatment"
+  - "what dosage"
+  - "what supplement"
+  - "what vaccine"
+  - "what natural remedies"
+  - "how long should I wait"
+  - "something I should worry"
+
+# Block words — medical topics that combined with advice-seeking = block
+additional_block_words:
+  - "symptoms"
+  - "condition"
+  - "diagnosis"
+  - "treatment"
+  - "medication"
+  - "medicine"
+  - "surgery"
+  - "pain"
+  - "injury"
+  - "cancer"
+  - "depression"
+  - "anxiety"
+  - "ADHD"
+  - "blood pressure"
+  - "blood sugar"
+  - "prescription"
+  - "drug"
+  - "ibuprofen"
+  - "acetaminophen"
+  - "physical therapy"
+  - "chiropractic"
+  - "radiation"
+  - "chemotherapy"
+  - "migraines"
+  - "herniated disc"
+  - "side effects"
+  - "chest pain"
+  - "sprained"
+  - "vaccine"
+  - "exercise"
+  - "knee surgery"
+  - "lump"
+  - "test results"
+
+# Always-block keywords — explicit medical advice requests
+always_block_keywords:
+  - keyword: "what condition do you think I have"
+    severity: "high"
+  - keyword: "can you diagnose"
+    severity: "high"
+  - keyword: "diagnose what's wrong"
+    severity: "high"
+  - keyword: "based on my symptoms"
+    severity: "high"
+  - keyword: "is my injury serious"
+    severity: "high"
+  - keyword: "need surgery"
+    severity: "high"
+  - keyword: "stop taking my"
+    severity: "high"
+  - keyword: "what dosage"
+    severity: "high"
+  - keyword: "best medicine for"
+    severity: "high"
+  - keyword: "indicate cancer"
+    severity: "high"
+  - keyword: "signs of ADHD"
+    severity: "high"
+  - keyword: "can you prescribe"
+    severity: "high"
+  - keyword: "should I go to the emergency room"
+    severity: "high"
+  - keyword: "is it safe to combine"
+    severity: "high"
+  - keyword: "blood sugar level of"
+    severity: "high"
+  - keyword: "side effects I should expect"
+    severity: "high"
+  - keyword: "should I use heat or ice"
+    severity: "high"
+  - keyword: "what natural remedies"
+    severity: "high"
+  - keyword: "what supplement should"
+    severity: "high"
+  - keyword: "what vaccine should"
+    severity: "high"
+  - keyword: "radiation therapy or chemotherapy better"
+    severity: "high"
+  - keyword: "is it safe to combine these two medications"
+    severity: "high"
+
+# Phrase patterns — regex for medical advice attempts
+phrase_patterns:
+  - '\b(?:should I|do you think|do you recommend)\b.{0,30}\b(?:take|stop|start|try|get|have|need|use)\b.{0,20}\b(?:medication|medicine|drug|surgery|treatment|therapy|vaccine|supplement)\b'
+  - '\b(?:what|which)\b.{0,10}\b(?:treatment|medication|medicine|drug|therapy)\b.{0,15}\b(?:recommend|best|should|suggest)\b'
+  - '\bis\b.{0,5}\b(?:my|this|the)\b.{0,20}\b(?:serious|dangerous|normal|concerning|worrying)\b'
+
+# Exceptions — legitimate claims-related medical term usage
+exceptions:
+  - "does my plan cover"
+  - "is covered"
+  - "covered under"
+  - "coverage"
+  - "copay"
+  - "coinsurance"
+  - "deductible"
+  - "out-of-pocket"
+  - "in-network"
+  - "out-of-network"
+  - "formulary"
+  - "what does diagnosis code"
+  - "what does CPT code"
+  - "code mean"
+  - "code on my claim"
+  - "file a claim"
+  - "submit a claim"
+  - "claim was denied"
+  - "explanation of benefits"
+  - "EOB"
+  - "how many visits"
+  - "benefit"
+  - "reimbursed"
+  - "wellness benefit"
+  - "preventive care"
+  - "maternity care"
+  - "health savings account"
+  - "HSA"
+  - "what documentation"
+  - "pre-certification"
+  - "referral"
+  - "provider"
+  - "find an in-network"
+  - "plan include"
+  - "plan allow"
+  - "plan benefits"
+  - "generic and brand-name"
+
+keywords: []