docs(panw_prisma_airs): trim restating comments, document latest-only trust trade-off

Addresses Greptile's comment-noise finding and documents the
caller-supplied-history trade-off Veria flagged: latest-only scanning is
opt-in for non-Anthropic shapes and assumes each turn was scanned when it
was the latest message, which is now stated on the config field.

Claude-Session: https://claude.ai/code/session_019e3TmBntsNQTBbXB9iu9uZ
This commit is contained in:
scthornton 2026-08-31 19:08:08 -04:00
parent 4752dfa6f7
commit 0f28bce05c
2 changed files with 5 additions and 5 deletions

View file

@ -194,8 +194,7 @@ class PanwPrismaAirsHandler(CustomGuardrail):
# internal '<=' comparison and surfaces as a misleading api_error.
self.timeout = float(timeout) if timeout is not None else 10.0
# Tri-state: None = not set (latest-only for Anthropic /v1/messages, full history
# otherwise), True = latest-only for every request shape, False = full history everywhere
# Tri-state scan-scope flag; resolution semantics in _use_latest_user_only()
self.experimental_use_latest_role_message_only: bool | None = kwargs.get(
"experimental_use_latest_role_message_only"
)
@ -1774,8 +1773,6 @@ class PanwPrismaAirsHandler(CustomGuardrail):
if input_type == "request":
structured_messages: Final = inputs.get("structured_messages")
if structured_messages:
# Latest-user-only scanning: flag-controlled for every request shape,
# default-on only for Anthropic /v1/messages (see _use_latest_user_only).
# Uses request_data["messages"] (original format), NOT structured_messages
# (which has injected system content from adapter translation).
if self._use_latest_user_only(request_data, logging_obj):

View file

@ -58,7 +58,10 @@ class PanwPrismaAirsGuardrailConfigModel(GuardrailConfigModel):
"the full conversation history. Set true to enable for every request shape (avoids "
"rescanning prior turns on every call of a multi-turn conversation); set false to always "
"scan all user/system/developer messages. When unset: defaults to latest-only for "
"Anthropic /v1/messages requests and full-history for all other request shapes.",
"Anthropic /v1/messages requests and full-history for all other request shapes. "
"Latest-only scanning trusts caller-supplied history: earlier messages in the request "
"are not rescanned, so enable it only where each turn was scanned when it was the "
"latest message (well-behaved chat clients) or history is server-controlled.",
)
@staticmethod