Skip to content
VB-OSVB-OSVB-OS Docs

VBL Evidence Prohibition (prohibit_evidence)

Basic Prohibition

Section titled “Basic Prohibition”

Declare that a field must not be present:

prohibit_evidence: social_security_number
prohibit_evidence: raw_password

If any prohibited field exists in the workload, the evaluation produces DEFER at Stage 2 with failure code F2-005 (PROHIBITED_EVIDENCE_PRESENT).

Conditional Prohibition

Section titled “Conditional Prohibition”

Prohibit a field only when a condition on that field is true:

prohibit_evidence: manual_routing_override WHERE manual_routing_override >= 1
prohibit_evidence: severity_override WHERE severity_override == "FALSE_POSITIVE"
prohibit_evidence: unsafe_content_categories WHERE unsafe_content_categories >= 1

The WHERE comparison left-hand side must match the prohibited field name. Evaluation:

  • Field absent → satisfied (prohibition not triggered)
  • Field present + condition true → F2-005 (prohibited)
  • Field present + condition false → satisfied
  • Field present + condition indeterminate → F2-005 (fails closed)

Purpose

Section titled “Purpose”

Evidence prohibitions serve two purposes:

Data Hygiene

Section titled “Data Hygiene”

Prevent sensitive data from entering the evaluation pipeline. If a workload should never contain a social security number, prohibit_evidence enforces this at the boundary level.

Conditional Logic

Section titled “Conditional Logic”

Combined with WHERE syntax, prohibitions express rules like “block manual overrides when the override flag is set” without complex predicate logic.

Interaction with Other Stages

Section titled “Interaction with Other Stages”

Prohibitions are checked in Stage 2, after admissibility (Stage 1) and before predicates (Stage 3). If Stage 1 fails, prohibitions are never checked. If Stage 2 fails, predicates are never evaluated.

Next Steps

Section titled “Next Steps”