feat: add per-tool CEL expression rail

docs/configure-rails/guardrail-catalog/cel.mdx

@@ -0,0 +1,168 @@
+---
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+title: "Common Expression Language (CEL)"
+sidebar-title: "Common Expression Language (CEL)"
+description: "Reference for the per-tool rail that blocks tool calls or tool results matching Common Expression Language (CEL) expressions you write per tool."
+content:
+  type: "reference"
+---
+
+The CEL rail checks a tool call's arguments, or a tool result's content, against [Common Expression Language (CEL)](https://cel.dev) expressions that you write per tool. CEL is a small, side-effect-free expression language used for policy rules in systems such as Kubernetes admission policies and Envoy. Each expression evaluates to `true` when the tool is being used in a way you want to block.
+
+Unlike [Regex Detection](/configure-guardrails/guardrail-catalog/community/regex), which matches text patterns, CEL expressions address the structured fields of a tool call directly, so one rule can combine several arguments. Unlike [Tool Safety Check](/configure-guardrails/guardrail-catalog/tool-safety-check), the check is deterministic and calls no model. It is scoped per tool through the same `rails.tool_output.per_tool` and `rails.tool_input.per_tool` dispatch mechanism as both.
+
+## Installation
+
+The CEL rail requires the optional `cel` extra, which installs the [`common-expression-language`](https://pypi.org/project/common-expression-language/) package and is available on Python 3.11 and later:
+
+```bash
+pip install "nemoguardrails[cel]"
+```
+
+If the extra is not installed, a configuration that uses the CEL rail fails to load with an error naming the extra.
+
+## Configure the Rail
+
+To use the CEL rail, you should:
+
+1. Write the expressions for each tool in the `rails.config.cel` section of the `config.yml` file, under `tool_output` to check tool calls and `tool_input` to check tool results:
+
+    ```yaml
+    rails:
+      config:
+        cel:
+          tool_output:
+            run_shell:
+              expressions:
+                - 'args.command.matches("(?i)\\brm\\s+-[a-z]*(r[a-z]*f|f[a-z]*r)")'
+            write_file:
+              expressions:
+                - 'args.path.startsWith("/etc/") || args.path.startsWith("/root/")'
+                - 'has(args.mode) && args.mode == "append" && args.path.endsWith(".bashrc")'
+          tool_input:
+            run_shell:
+              expressions:
+                - 'type(result) == string && result.contains("BEGIN RSA PRIVATE KEY")'
+    ```
+
+2. Scope the check to the tool in the `tool_output` and `tool_input` rails sections of the `config.yml` file:
+
+    ```yaml
+    rails:
+      tool_output:
+        per_tool:
+          run_shell:
+            - "cel check tool output"
+          write_file:
+            - "cel check tool output"
+      tool_input:
+        per_tool:
+          run_shell:
+            - "cel check tool input"
+    ```
+
+    The `cel check tool output` flow evaluates the tool's `tool_output` expressions against each call to the tool, and the `cel check tool input` flow evaluates its `tool_input` expressions against each result the tool returns. A tool without a CEL flow under `per_tool` is not checked by the rail, but a tool whose CEL flow has no expressions configured for its direction fails closed.
+
+3. Declare the tool in the main model's `parameters.tools`, or per request: in `options.llm_params.tools` with the Python API, or in the `tools` field of a chat completions request to the server, which the server currently accepts only for non-streaming requests on a configuration with `passthrough: true`. `cel check tool output` blocks a call to an undeclared tool before any expression runs. Refer to [Tool Calling](/configure-guardrails/guardrail-catalog/tool-calling) for the full declaration reference.
+
+The `cel check tool output` and `cel check tool input` rails execute the [`evaluate_tool_output_cel`](https://github.com/NVIDIA-NeMo/Guardrails/blob/develop/nemoguardrails/library/cel/actions.py) and [`evaluate_tool_input_cel`](https://github.com/NVIDIA-NeMo/Guardrails/blob/develop/nemoguardrails/library/cel/actions.py) actions respectively.
+
+## Expression Variables
+
+Each expression can read the following variables:
+
+| Flow | Variable | Value |
+|---|---|---|
+| `cel check tool output` | `args` | The tool call's arguments, as a map |
+| | `tool` | The tool's name |
+| `cel check tool input` | `result` | The tool result's content, exactly as the tool returned it: a string, a list of content blocks, or `null` |
+| | `args` | The arguments of the tool call that the result answers |
+| | `tool` | The tool's name |
+
+Nested arguments are available at any depth, for example `args.options.recursive` or `args.files.exists(f, f.path.startsWith("/etc"))`.
+
+A tool result that contains JSON text is still a string, so check it with string functions such as `contains()` and `matches()`.
+
+## How Expressions Are Evaluated
+
+The rail evaluates every expression configured for the tool:
+
+- If any expression evaluates to `true`, the rail blocks the tool call or result. The block lists the expressions that matched in its `matched_expressions` metadata. The metadata never includes the checked arguments or content.
+- If no expression evaluates to `true`, the rail allows the tool call or result.
+- If any expression fails to evaluate, for example because it reads an argument the call did not include, or it returns a value that is not a boolean, the rail fails closed, even if another expression matched. The tool call or result is blocked and reported as a rail failure rather than a policy decision, and the logged error lists each expression that failed with its error type.
+- If the tool has no expressions configured for the direction its flow runs in, the rail also fails closed, since there is nothing to validate the tool call or result against.
+
+## Write Expressions
+
+Expressions use [CEL syntax](https://github.com/google/cel-spec/blob/master/doc/langdef.md), including comparisons, `&&` and `||`, the `in` operator, the `exists()` and `all()` macros, and string functions such as `contains()`, `startsWith()`, `endsWith()`, and `matches()`, which uses RE2 regular expression syntax. The rail also provides the cel-go extension functions, such as `lowerAscii()`, `split()`, and `lists.range()`.
+
+When you write expressions, keep the following in mind:
+
+- Guard optional arguments with `has()`, for example `has(args.mode) && args.mode == "append"`. Without the guard, a call that omits the argument fails to evaluate.
+- If a tool can return either a string or a list of content blocks, check the type first, for example `type(result) == string && result.contains("password")`.
+- Each expression must evaluate to a boolean. An expression such as `args.command` that returns a string fails to evaluate.
+
+The rail checks each expression's syntax when the configuration loads, so a syntax error fails the load. Everything else is checked when an expression is evaluated: the CEL library the rail uses resolves variable and function names only at evaluation, and `args` and `result` hold the values of each tool call or result, so whether a field exists or has the expected type is known only then. A mistake found at evaluation makes the rail fail closed, so test your expressions against representative tool calls and results before deploying them.
+
+## Complete Example
+
+The following configuration blocks recursive forced deletes in `run_shell`, writes to `/etc` or `/root` and appends to `.bashrc` through `write_file`, and any `run_shell` result that contains a private key:
+
+<Warning>
+
+The expressions on this page illustrate how the rail works; they are not complete security policies. Write and test expressions for the actual threats your tools face.
+
+</Warning>
+
+```yaml
+models:
+  - type: main
+    engine: nim
+    model: meta/llama-3.3-70b-instruct
+
+rails:
+  config:
+    cel:
+      tool_output:
+        run_shell:
+          expressions:
+            - 'args.command.matches("(?i)\\brm\\s+-[a-z]*(r[a-z]*f|f[a-z]*r)")'
+        write_file:
+          expressions:
+            - 'args.path.startsWith("/etc/") || args.path.startsWith("/root/")'
+            - 'has(args.mode) && args.mode == "append" && args.path.endsWith(".bashrc")'
+      tool_input:
+        run_shell:
+          expressions:
+            - 'type(result) == string && result.contains("BEGIN RSA PRIVATE KEY")'
+  tool_output:
+    per_tool:
+      run_shell:
+        - "cel check tool output"
+      write_file:
+        - "cel check tool output"
+  tool_input:
+    per_tool:
+      run_shell:
+        - "cel check tool input"
+```
+
+<Note>
+
+This configuration doesn't declare `run_shell` or `write_file`. Declare them in the main model's `parameters.tools`, or per request: in `options.llm_params.tools` with the Python API, or in the `tools` field of a chat completions request to the server, which the server currently accepts only for non-streaming requests on a configuration with `passthrough: true`. Otherwise `cel check tool output` blocks every call to them before any expression runs. Refer to [Tool Calling](/configure-guardrails/guardrail-catalog/tool-calling) for the declaration format.
+
+</Note>
+
+## Schema Validation
+
+`cel check tool output` runs behind `@tool_output_validation`: a call to a tool the model has not declared, or whose arguments violate the tool's declared JSON schema, is blocked before any expression is evaluated. `cel check tool input` has no such gate, matching regex detection's asymmetry between the two directions.
+
+## Engine Support
+
+| Flow | LLMRails | IORails |
+|---|:---:|:---:|
+| `cel check tool output` | ✗ | ✓ |
+| `cel check tool input` | ✗ | ✓ |
+
+Per-tool checks are an `IORails`-only capability by design. For the full per-rail matrix, refer to [Rail Engine Support](/reference/rail-engine-support).

docs/configure-rails/guardrail-catalog/tool-safety-check.mdx

@@ -29,7 +29,7 @@ To use the tool safety check, you should:
 
     <Note>
 
-    The `type` is a unique identifier for the model that will be passed to the tool output and tool input rails as a parameter. `tools: [...]` above is a placeholder: replace it with `run_sql`'s actual function declaration and JSON schema, either here (static, applies to every request) or per request in `options.llm_params.tools`. `@tool_output_validation` blocks a call to a tool that isn't declared either way, before the judge ever runs. Refer to [Tool Calling](/configure-guardrails/guardrail-catalog/tool-calling) for the full declaration reference.
+    The `type` is a unique identifier for the model that will be passed to the tool output and tool input rails as a parameter. `tools: [...]` above is a placeholder: replace it with `run_sql`'s actual function declaration and JSON schema, either here (static, applies to every request) or per request: in `options.llm_params.tools` with the Python API, or in the `tools` field of a chat completions request to the server, which the server currently accepts only for non-streaming requests on a configuration with `passthrough: true`. `@tool_output_validation` blocks a call to a tool that isn't declared either way, before the judge ever runs. Refer to [Tool Calling](/configure-guardrails/guardrail-catalog/tool-calling) for the full declaration reference.
 
     </Note>
 

docs/index.yml

@@ -127,6 +127,9 @@ navigation:
           - page: Tool Safety Check
             path: configure-rails/guardrail-catalog/tool-safety-check.mdx
             slug: tool-safety-check
+          - page: Common Expression Language (CEL)
+            path: configure-rails/guardrail-catalog/cel.mdx
+            slug: cel
           - page: Hallucinations & Fact-Checking
             path: configure-rails/guardrail-catalog/fact-checking.mdx
             slug: fact-checking

docs/reference/rail-engine-support.mdx

@@ -40,9 +40,9 @@ The following table summarizes surface support by direction:
 | Input | 32 | 32 | 31 |
 | Output | 35 | 35 | 28 |
 | Retrieval | 11 | 11 | 0 |
-| Tool_output | 2 | 0 | 2 |
-| Tool_input | 2 | 0 | 2 |
-| **Total** | **82** | **78** | **63** |
+| Tool_output | 3 | 0 | 3 |
+| Tool_input | 3 | 0 | 3 |
+| **Total** | **84** | **78** | **65** |
 
 `IORails` does not accept a `rails.retrieval` section at all, so every retrieval surface is an `LLMRails` capability.
 A configuration that declares one routes to `LLMRails` by default.
@@ -160,6 +160,7 @@ Per-tool checks are an `IORails`-only capability by design:
 
 | Flow | Rail | LLMRails | IORails | Notes |
 |---|---|:---:|:---:|---|
+| `cel check tool output` | Common Expression Language (CEL) | ✗ | ✓ | IORails-only capability by design |
 | `regex check tool output` | Regex Detection | ✗ | ✓ | IORails-only capability by design |
 | `tool safety check output` | Tool Safety Check | ✗ | ✓ | IORails-only capability by design |
 
@@ -170,10 +171,11 @@ Per-tool checks are an `IORails`-only capability by design:
 
 | Flow | Rail | LLMRails | IORails | Notes |
 |---|---|:---:|:---:|---|
+| `cel check tool input` | Common Expression Language (CEL) | ✗ | ✓ | IORails-only capability by design |
 | `regex check tool input` | Regex Detection | ✗ | ✓ | IORails-only capability by design |
 | `tool safety check input` | Tool Safety Check | ✗ | ✓ | IORails-only capability by design |
 
-For worked per-tool configuration examples, refer to [Regular Expression Detection Integration](/configure-guardrails/guardrail-catalog/community/regex) (includes the `$argument=` scoping option) and [Tool Safety Check](/configure-guardrails/guardrail-catalog/tool-safety-check) (an LLM-judged check with `$model=`/`$variant=`).
+For worked per-tool configuration examples, refer to [Regular Expression Detection Integration](/configure-guardrails/guardrail-catalog/community/regex) (includes the `$argument=` scoping option), [Tool Safety Check](/configure-guardrails/guardrail-catalog/tool-safety-check) (an LLM-judged check with `$model=`/`$variant=`), and [Common Expression Language (CEL)](/configure-guardrails/guardrail-catalog/cel) (deterministic expressions over a tool call's arguments or a tool result's content).
 
 ### Tool Surfaces
 

docs/telemetry.mdx

@@ -43,7 +43,7 @@ In this context, a *session* is the lifetime of a single Python process running
 
 Each value identifies a built-in library feature. The built-in rail manifests are the authoritative source. Related manifests can share a stable feature identifier so telemetry remains comparable across releases.
 
-`activefence`, `ai_defense`, `autoalign`, `clavata`, `cleanlab`, `content_safety`, `context_bloat_detection`, `crowdstrike_aidr`, `f5`, `factchecking`, `fiddler`, `gcp_moderate_text`, `gliner`, `guardrails_ai`, `hallucination`, `hf_classifier`, `injection_detection`, `jailbreak_detection`, `llama_guard`, `pangea`, `patronusai`, `policyai`, `polygraf`, `prompt_security`, `regex`, `self_check`, `sensitive_data_detection`, `tool_safety_check`, `topic_safety`, `trend_micro`.
+`activefence`, `ai_defense`, `autoalign`, `cel`, `clavata`, `cleanlab`, `content_safety`, `context_bloat_detection`, `crowdstrike_aidr`, `f5`, `factchecking`, `fiddler`, `gcp_moderate_text`, `gliner`, `guardrails_ai`, `hallucination`, `hf_classifier`, `injection_detection`, `jailbreak_detection`, `llama_guard`, `pangea`, `patronusai`, `policyai`, `polygraf`, `prompt_security`, `regex`, `self_check`, `sensitive_data_detection`, `tool_safety_check`, `topic_safety`, `trend_micro`.
 
 ## Data Not Collected by Telemetry
 

nemoguardrails/library/cel/__init__.py

@@ -0,0 +1,14 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.