> ## Documentation Index
> Fetch the complete documentation index at: https://docs.domesystems.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Guards

> Why Dome inspects request and response content on tool and model connections

export const guard = "Guards inspect request and response content on tool and model connections. They can redact, omit, or block sensitive text before it reaches an agent or upstream backend.";

<p>
  {guard}
</p>

## High-level overview

Guards attach to a specific model or tool **connection** and to one **direction** (`request` or `response`). They run on the content path after the call is authorized. When an assigned Guard cannot be evaluated, the gateway blocks that connection and direction. It never relays the traffic without inspection.

**Filters** are a Guard type. A Filter is a versioned, deterministic text or JSON inspector. You assign Filters in an ordered chain on a connection and direction.

Assigning a Filter and seeing it run looks like this:

1. An operator creates a text Filter that redacts SSNs and assigns it to the response direction on a model connection.
2. On the next gateway config sync, that connection runs the Filter over streamed completions.
3. Matching spans are redacted before the agent sees them.
4. If an assigned Filter later cannot be decoded, the gateway blocks that direction until the operator rolls back or clears the chain.

Guards inspect content at the connection and fail closed when inspection cannot run.

### Directions

Each Guard assignment binds to one direction on a connection.

| Direction  | Model connection                                | Tool connection                                  |
| ---------- | ----------------------------------------------- | ------------------------------------------------ |
| `request`  | Prompt before dispatch to the model provider    | Tool arguments before dispatch to the MCP server |
| `response` | Streamed completion before it reaches the agent | Tool result before it reaches the agent          |

Request Guards can transform content or block a call. Response Guards run before any inspected content reaches the caller.

### Filters

A Filter is workspace-scoped and versioned. Assigned connections pick up the active version on the next gateway sync. Previous versions remain available for rollback. Filter kind is immutable and decides which connections the Filter can attach to.

| Kind   | Connection | Role                                                       |
| ------ | ---------- | ---------------------------------------------------------- |
| `text` | Model      | Substring and pattern inspection on prompts or completions |
| `json` | Tool       | Field-path inspection on tool arguments or results         |

Each `(connection, direction)` slot holds one ordered Filter chain. Setting a chain replaces the complete list for that slot. Model connections accept only `text` Filters. Tool connections accept only `json` Filters.

Narrow transforms ahead of broad blocking matchers keep audit attribution predictable when multiple matchers could fire. A matching `BLOCK` short-circuits the chain. Kinds, actions, and precedence are on the [Guards](/reference/controls/guards) reference.

### Streaming model responses

LLM chat responses arrive as fragmented SSE chunks. The gateway buffers each connection's response into a sliding window and runs response Filters over the decoded text so multi-chunk patterns are visible.

The effective window is `max(workspace floor, connection override, per-request override)`. A layer set to `0` drops out of the max. Window bounds and where each layer is set are on the [Guards](/reference/controls/guards#streaming-window) reference. How to set them is on [Guards](/govern/guards#configure-the-streaming-window).

## Next steps

With the Guards content-inspection model in mind, continue with:

* [Architecture](/concepts/architecture#guards) concept for where Guards sit in the request path
* [Rules](/concepts/controls/rules) concept for allow and deny before content inspection
* [Guards](/reference/controls/guards) reference for Filter kinds, actions, path syntax, and streaming layers
* [Configure Guards](/govern/guards) to create Filters, assign chains, and tune streaming windows