VALIDATE: secureai validate

Scores a deployment out of 100 before it ships. Two subcommands: rag analyses a retrieval pipeline descriptor, guardrail checks system-prompt hardening.

Terminal

secureai validate rag <descriptor.yaml> [flags]
secureai validate guardrail <prompt-or-descriptor> [flags]

The Security Deployment Score

Both subcommands produce an SDS out of 100, where higher is safer. It is a readiness signal, not a grade: below 70 the deployment is treated as not production-ready, which is why --fail-below defaults to 70.

SDS	Reading
90-100	Strong. Controls present across every domain.
70-89	Acceptable. Gaps exist but none are structural.
50-69	Not production-ready. Material controls are missing.
0-49	Unsafe to deploy.

validate rag

Analyses a RAG pipeline descriptor across five security domains: retrieval integrity, context isolation, output validation, access control, and observability. It reports a score for each domain and the issues behind it.

Terminal

# Score a pipeline
secureai validate rag rag-pipeline.yaml

# Enforce a higher bar than the default
secureai validate rag rag-pipeline.yaml --fail-below 80

# Machine-readable
secureai validate rag rag-pipeline.yaml --format json

Flag	Default	Description
`--fail-below`	`70`	Exit non-zero if the SDS is below this score.
`--format`	`terminal`	Output format: `terminal\|json`.

What the descriptor describes

A YAML file recording how your retrieval pipeline is wired: where chunks come from, whether they carry provenance, what bounds the retrieved context, how responses are validated, and who is allowed to retrieve what. It describes the deployment, not the pipeline itself. The analysis is static and safe to run anywhere.

validate guardrail

Checks a system prompt against six control categories, covering the hardening a production prompt is expected to carry: instruction precedence, refusal behaviour, scope limits, output constraints, data-handling rules, and disclosure controls.

Terminal

secureai validate guardrail prompts/system_prompt.md
secureai validate guardrail prompts/system_prompt.md --fail-below 85

Flag	Default	Description
`--fail-below`	`70`	Exit non-zero if the SDS is below this score.
`--format`	`terminal`	Output format: `terminal\|json`.

Reading the output

Terminal

VALIDATE: RAG security analysis
rag-pipeline.yaml

DOMAIN                 SCORE  ISSUES  OWASP
Retrieval integrity       58       3  LLM03
Context isolation         62       2  LLM01
Output validation         71       2  LLM05
Access control            84       1  LLM06
Observability             90       0  LLM09

SDS 68/100: NOT PRODUCTION READY
gate: fail-below=70 → FAILED

Per-domain scores show where the weakness is. A low retrieval-integrity score and a low access-control score call for entirely different work.
Issues are listed underneath with a severity, the OWASP category, and a concrete remediation.

Pair it with BUILD

scan tells you the prompt contains a risky pattern; validate guardrail tells you whether the prompt carries the controls a production system needs. Running both on the same prompt is normal and they answer different questions.

Score interpretation across all phases is collected on Scores & exit codes.