A Custom Entity classifier is a labeled regular expression that F5 SurePath AI evaluates against user prompts. When a prompt contains text matching the pattern, the classifier fires. Attaching that classifier to a policy makes the match drive enforcement.
Admins use a Custom Entity classifier when the target can be expressed as a deterministic text pattern: ticket IDs, commit hashes, internal project codenames, customer account formats, or license key shapes. To match content by meaning rather than by literal pattern, use a Custom Intent classifier instead — see Understanding intent classification.
Classifier types
The Classifiers page offers two types. Intent classifiers perform semantic classification of prompts. Entity classifiers perform pattern matching on prompts. The Type column shows Intent or Entity for each classifier in the list.
The list also shows a Status column, and a Default Policy and Group Policies column that name the action each policy applies when the classifier matches. A classifier with no policy action shows none in the Group Policies column.
A single regex pattern is the entire definition of a Custom Entity classifier. There is no phrase library to build or maintain. SurePath AI compiles the pattern and applies it deterministically, so the same pattern against the same prompt always produces the same result.
Custom Entity is available to all organizations. Earlier releases labeled this type "Regex" and limited it to demo organizations.
Requirements
The organization must be in
platformmode.The admin needs a role with classifier-write permission —
org:ownerororg:admin.Prepare the regex pattern and several representative sample prompts to test it against.
Adding a Custom Entity classifier
To create a Custom Entity classifier:
Click Classifiers in the GOVERN section
Click ADD CLASSIFIER and select Custom Entity to open the Create a Custom Entity drawer
Enter a Name for the classifier and an optional Description
Enter the Regex Pattern
Enter sample text in Test Patterns and confirm the pattern matches
Leave Enabled on to activate the classifier, or toggle it off to save without activating it
Click SAVE
A saved, enabled classifier applies on the next detection call. No service restart is required.
Testing a pattern before saving
The drawer previews matches as the pattern is edited. Admins type sample text into Test Patterns, and Match Preview highlights the text the pattern matched. Test Patterns accepts up to 200 characters. SurePath AI does not save the sample text or the preview with the classifier.
Sample text should be a full sentence written the way a user would type it in a prompt, not the bare value on its own. SurePath AI matches the pattern against the whole prompt, so testing against a bare value hides the most common pattern fault.
Example patterns
These two patterns cover common cases and give admins a start point to edit for their own conventions.
Purpose | Matches | Pattern |
Ticket ID | Ticket IDs such as |
|
Git commit SHA | Short or full lowercase hex hashes |
|
The ticket ID pattern is case-insensitive. It matches ABC-1234, abc-1234, and Abc-1234, but not ABC-wxyz. Each letter of the project key is written as a bracketed case pair, so matching a different key means replacing [Aa][Bb][Cc] with, for example, [Xx][Yy][Zz], and changing \d{4} to the digit count the tracker uses.
Attaching a classifier to a policy
A Custom Entity classifier enforces nothing on its own. It becomes operative when an admin selects the action a policy takes on a match.
To set the action in the Default Policy:
Click Default Policy in the GOVERN section
Select the Classifiers tab
Find the classifier in the Custom Entity Controls section
Select an action from the dropdown beside it
The same tab holds an Intent Topic Controls section for Custom Intent classifiers. Group Policies offer the same controls and override the Default Policy for members of the group. See Understanding policies for the policy model and precedence rules.
Custom Entity classifiers support the standard enforcement actions — Ignore, Monitor, Warn, and Block — plus three redaction actions that only Custom Entity classifiers offer: Tag, Mask, and Delete. The Sensitive Data policy article describes how each action behaves at request time, what the end user sees, and what the platform records.
The Default Policy and Group Policies columns on the Classifiers page show the action each policy currently applies to a classifier.
Editing, disabling, and deleting a classifier
Edit the pattern. Open the classifier, change the Regex Pattern, and save. Match Preview re-runs as the pattern is edited. Later detection calls use the new pattern.
Disable the classifier. Toggle the Enabled switch off. SurePath AI skips a disabled classifier at runtime even when its pattern would match. Toggling the switch back on restores matching.
Delete the classifier. Open the classifier and delete it. SurePath AI removes references to the deleted classifier from any policies that used it, so no manual policy edits are needed.
Writing patterns that match real prompts
Most regex generators, and most copied validation snippets, wrap a pattern in anchors: ^...$. The ^ pins the match to the start of the text and the $ pins it to the end, so ^ABC-1234$ matches only when the entire prompt is exactly ABC-1234.
SurePath AI evaluates the pattern against the full prompt text, and real prompts are sentences — "can you pull up ticket ABC-1234 for me?" — not a bare token. An anchored pattern therefore never matches a normal prompt.
Word boundaries are the right tool instead. A \b marks the zero-width position between a word character (a letter, digit, or underscore) and a non-word character (a space, punctuation, or the start or end of the text). The pattern \bABC-1234\b matches the token wherever it appears inside a longer prompt, while still rejecting partial matches inside a larger token. This is why the Git commit SHA pattern above is written as \b[a-f0-9]{7,40}\b rather than ^[a-f0-9]{7,40}$.
SurePath AI shows a warning in the drawer when a pattern contains ^ or $, stating that the anchors tie the match to the start or end of the whole prompt and recommending \b word boundaries instead. The warning does not block saving, so an anchored pattern can still be saved and enabled.
Two limits remain worth knowing:
The Regex Pattern field accepts any string. SurePath AI does not check that the pattern is valid regex syntax.
Test Patterns checks only the sample text typed into the drawer. There is no way to test a pattern against historical traffic before enabling it.
Admins avoid the problem by taking three precautions:
Strip
^and$from generated patterns unless the intent is genuinely "the whole prompt is exactly this value", and use\b...\binstead.Test with realistic, full-sentence sample text. When the only sample text is the bare value, an anchored pattern appears to work in the tester and then never fires in production.
Test any value that can appear glued to another token. Because letters, digits, and the underscore all count as word characters,
\b...\bdoes not matchABC-1234insideABC-1234xorref_ABC-1234.
SurePath AI exposes no per-classifier switches for case sensitivity, anchoring, or multiline behavior. The pattern string is the entire configuration, so every one of those behaviors — including the case-insensitivity in the ticket ID pattern — has to be expressed inside the pattern.
Common errors
What the admin sees | Cause | Resolution |
The classifier is enabled and attached to a policy, but never matches | The pattern is anchored with | Remove the |
| A classifier with the same name and type already exists in the organization | Choose a different name |
| The classifier ID does not exist within the organization's scope | Reload the classifier list and open the classifier from there |