Skip to main content

​
High-level overview

Guards attach to a specific model or tool connection and to one direction (request or response). They run on the content path after the call is authorized. When an assigned Guard cannot be evaluated, the gateway blocks that connection and direction. It never relays the traffic without inspection. Filters are a Guard type. A Filter is a versioned, deterministic text or JSON inspector. You assign Filters in an ordered chain on a connection and direction. Assigning a Filter and seeing it run looks like this:
  1. An operator creates a text Filter that redacts SSNs and assigns it to the response direction on a model connection.
  2. On the next gateway config sync, that connection runs the Filter over streamed completions.
  3. Matching spans are redacted before the agent sees them.
  4. If an assigned Filter later cannot be decoded, the gateway blocks that direction until the operator rolls back or clears the chain.
Guards inspect content at the connection and fail closed when inspection cannot run.

​
Directions

Each Guard assignment binds to one direction on a connection. Request Guards can transform content or block a call. Response Guards run before any inspected content reaches the caller.

​
Filters

A Filter is workspace-scoped and versioned. Assigned connections pick up the active version on the next gateway sync. Previous versions remain available for rollback. Filter kind is immutable and decides which connections the Filter can attach to. Each (connection, direction) slot holds one ordered Filter chain. Setting a chain replaces the complete list for that slot. Model connections accept only text Filters. Tool connections accept only json Filters. Narrow transforms ahead of broad blocking matchers keep audit attribution predictable when multiple matchers could fire. A matching BLOCK short-circuits the chain. Kinds, actions, and precedence are on the Guards reference.

​
Streaming model responses

LLM chat responses arrive as fragmented SSE chunks. The gateway buffers each connection’s response into a sliding window and runs response Filters over the decoded text so multi-chunk patterns are visible. The effective window is max(workspace floor, connection override, per-request override). A layer set to 0 drops out of the max. Window bounds and where each layer is set are on the Guards reference. How to set them is on Guards.

​
Next steps

With the Guards content-inspection model in mind, continue with:
  • Architecture concept for where Guards sit in the request path
  • Rules concept for allow and deny before content inspection
  • Guards reference for Filter kinds, actions, path syntax, and streaming layers
  • Configure Guards to create Filters, assign chains, and tune streaming windows