IBEX Harness
DocsBenchmarksBlogChangelogRoadmap
GitHub
IBEX Harness

Documentation

OverviewConfigurationAuthenticationAuth cachingDirectivesSessionsRate limitingRequest routingProvider adapters
Proxy›Directives
Proxy

Directives

Org-scoped directives and system-prompt injection on the proxy critical path.

New Org directives are shipped. Each agent can have one active directive version; the proxy resolves it on every chat request and injects the content into the message list before the provider call.

Design: ADR-0031, ADR-0030, ADR-0039.

What you get

TopicBehavior
Storageibex_core.directives + append-only directive_versions (Postgres RLS)
Resolve budget100ms (Redis GET, Postgres on miss)
CacheRedis key {org_id}:directive:{agent_id}, TTL IBEX_DIRECTIVE_CACHE_TTL (default 60s)
InvalidatePub/sub channel directive_updates:{org_id}
Fail-openResolve timeout/error → continue without a directive (WARN log)

Prerequisites

Directives require both:

  • POSTGRES_DSN on the proxy
  • REDIS_URL on the proxy

If either is missing, the proxy uses a Noop resolver (no injection). Startup logs make this explicit.

Chat-path flow

Mermaid diagram: sequenceDiagram
+--------+                      +-------+                    +-------+      +----------+   +-----+   
| Client |                      | Proxy |                    | Redis |      | Postgres |   | LLM |   
+--------+                      +-------+                    +-------+      +----------+   +-----+   
     |                              |                            |                |           |      
     |  POST /v1/chat/completions   |                            |                |           |      
     |------------------------------>                            |                |           |      
     |                              |                            |                |           |      
     |                              +---+                        |                |           |      
     |                              |   | auth + agent + rate limit               |           |      
     |                              <---+                        |                |           |      
     |                              |                            |                |           |      
     |                              |  GET org:directive:agent   |                |           |      
     |                              |---------------------------->                |           |      
     |                              |                            |                |           |      
     |                          +alt [cache miss]-------------------------------------+       |      
     |                          |   |                            |                |   |       |      
     |                          |   |          Load active version (RLS)          |   |       |      
     |                          |   |--------------------------------------------->   |       |      
     |                          |   |                            |                |   |       |      
     |                          |   |     write-behind SET       |                |   |       |      
     |                          |   |---------------------------->                |   |       |      
     |                          |   |                            |                |   |       |      
     |                          +-----------------------------------------------------+       |      
     |                              |                            |                |           |      
     |                              +---+                        |                |           |      
     |                              |   | inject per injection_mode               |           |      
     |                              <---+                        |                |           |      
     |                              |                            |                |           |      
     |                              |                   Complete(messages)        |           |      
     |                              |--------------------------------------------------------->      
     |                              |                            |                |           |      
     |                              |           200              |                |           |      
     <........................................................................................|      
     |                              |                            |                |           |      
+--------+                      +-------+                    +-------+      +----------+   +-----+   
| Client |                      | Proxy |                    | Redis |      | Postgres |   | LLM |   
+--------+                      +-------+                    +-------+      +----------+   +-----+   

Middleware: DirectiveResolveMiddleware (after rate limit, before chat parse). Injection runs in the chat handler via packages/injection before provider.Complete.

Injection modes

Stored on the directive row (injection_mode), default system_first:

ModeEffect
system_firstPrepend a new system message with the directive content
system_appendAppend after the leading contiguous system block
user_prependRewrite the first user message as [DIRECTIVE]: …\n\n…

Empty or unknown modes fall back to system_first.

Untrusted content hygiene

Directive text is still data, not operator instructions to the proxy. Memory content (Phase 3) must never be treated as instructions — see AGENTS.md prompt-injection rules. Do not log directive body content in normal logs.

Configuration

VariableDefaultRole
POSTGRES_DSN(empty)Required for durable directives
REDIS_URL(empty)Required for cached resolver
IBEX_DIRECTIVE_CACHE_TTL60sRedis TTL for resolved envelopes

Failure modes

ConditionResult
No Postgres or no RedisNoop — chat continues, no injection
Resolve timeout / DB errorFail-open — chat continues without directive
Inactive / missing directive for agentEmpty resolve — no injection

Where to look in the repo

  • packages/directive — store, cache, pub/sub
  • packages/injection — injection strategies
  • services/proxy/internal/http/directive_middleware.go — resolve middleware
  • infra/migrations/postgres/000009_create_directives.up.sql — schema

Related docs

  • Sessions
  • Proxy overview
  • Proxy configuration
  • Multi-tenant RLS

Was this page helpful?

Edit on GitHub

Last updated on

PreviousAuth cachingNextSessions

On this page

  • What you get
  • Prerequisites
  • Chat-path flow
  • Injection modes
  • Configuration
  • Failure modes
  • Where to look in the repo
  • Related docs
0%