v0.4.0

This release adds content inspection and unifies client configuration for privacy protection, tool authorization and inspection.

Added

• Added rule-based, ONNX and HTTP inspection for model input and optional final output.
• Added GuardrailsChatClientFactory and GuardrailsPolicy for independent or combined feature setup.
• Added built-in PII rules with COMMON and KR presets.

Changed

• Limited PII detection and transformation to runtime values, preserving JSON keys, map keys, tool definitions and output schemas.
• Reused successful analysis and completed tokenization within a privacy session.

Fixed

• Fixed JSON output protection and output-size limit enforcement.

Compatibility

Unifying the three features introduces breaking changes to public APIs and configuration.

• Reorganized client integration and analyzer APIs. Moved output protection, tool disclosure and response-limit settings to client policies.
• Replaced regex analyzer APIs and properties with rule-based APIs and spring.ai.privacy.rules.*. Changed the provider ID from REGEX to RULES.
• Changed the opaque PII token format.

v0.3.0

This release adds optional Spring Security-based tool authorization and improves PII analysis for structured inputs.

Added

• Added optional Spring Security tool authorization and a Spring Boot starter.
• Added a Security scenario to the Privacy Boundary Inspector.

Fixed

• Fixed PII detection in structured JSON by analyzing keys and values independently.
• Applied the existing input-size limit to direct core text operations.

Documentation

• Added tool authorization guides. Updated the English and Korean documentation and demo visuals.

Compatibility

• Removed the spring.ai.privacy.enabled property. Privacy components are now configured based on registered analyzer or service beans.

New Contributors 🎉

• Thanks to @NewChoBo for the contribution in #36.

v0.2.1

This maintenance release refreshes upstream compatibility baselines and CI
coverage without changing public APIs or privacy-enforcement behavior.

Changed

• Updated the default Spring AI baseline to 2.0.1 and Spring Boot to 4.1.1.
• Updated Presidio Analyzer to 2.2.364 and Apache OpenNLP to 2.5.11.

Documentation

• Improved navigation across the English and Korean documentation, including a
  Korean documentation home.
• Documented the project's mention in the official Spring Blog post
  This Week in Spring — August 18, 2026.

Compatibility

• Retained Java 17 CI verification for Spring AI 2.0.0 alongside the default
  2.0.1 baseline.
• Verified the live Presidio integration on Java 17.
• No breaking changes.

v0.2.0

This release lowers the Java baseline to 17 and adds privacy-safe runtime
observation for supported Spring AI privacy boundaries.

Added

• Added PrivacyEnforcementObserver for model, tool-input, tool-result, and
  application-output boundaries with privacy-safe PROTECTED, DISCLOSED,
  and BLOCKED outcomes.

Changed

• Lowered the minimum Java baseline from 21 to 17 while retaining compatibility
  verification on Java 17, 21, and 25.

Documentation

• Added Getting Started guides, demo videos, and screenshots.

Compatibility

• Existing applications do not need to configure a PrivacyEnforcementObserver;
  privacy enforcement behavior remains unchanged when no observer is registered.
• No breaking changes.

v0.1.1

This release adds runnable privacy-boundary demos and expands integration-test coverage.

Added

• Added runnable RAG and Streamable HTTP MCP demos that show privacy boundaries at runtime.
• Added an English and Korean Privacy Boundary Inspector covering Local Tool, RAG, and MCP scenarios.
• Expanded integration-test coverage for PII protection in VectorStore RAG flows and cleanup after stream cancellation.
• Added English and Korean sample guides and refreshed Inspector demo GIFs.

Compatibility

• Public APIs and runtime behavior of the published library modules remain unchanged.
• No breaking changes.

v0.1.0

Initial public release of Spring AI Privacy Guardrails.

Spring AI Privacy Guardrails adds request-scoped privacy boundaries to Spring AI applications. Detected PII is tokenized before protected model calls, while trusted tools can receive only the original values explicitly allowed by policy.

Highlights

• Request-scoped tokenization of detected PII before protected model calls.
• Deny-by-default, per-tool disclosure of original values.
• Tool results are protected again before returning to the model or application.
• Built-in regex analysis with pluggable analyzer support.
• Optional Presidio and OpenNLP integrations.
• Configurable output protection with TOKENIZE, REDACT, and BLOCK.
• Spring Boot starters for base, Presidio, and OpenNLP configurations.
• Test support for verifying model, tool, and session privacy boundaries.

Compatibility

• Java 21 baseline
• Java 25 verified in CI
• Spring AI 2.0.0
• Spring Boot 4.1.0

Documentation

• Documentation
• Configuration
• Architecture
• Threat Model
• Evaluation and Benchmarks