Guards

Guards inspect request and response content on tool and model connections. Filters can redact, omit, or block matching text. Validators block tool traffic when structured checks fail.

Overview

Guards sit on Dome's content path and decide what of an authorized call's body may leave a backend or reach the agent. They attach to a model or tool connection and to a direction (request or response). When an assigned Guard cannot be evaluated, the gateway blocks that connection and direction.

Dome currently supports two Guard types, each with its own workflow:

• Filters rewrite or withhold content. Model connections accept only text Filters. Tool connections accept only json Filters.

  1. Create a Filter for the connection kind you need.
  2. Assign ordered Filter chains on the connection and direction.
  3. Configure the streaming window when model response Filters need more context.

• Validators are pure predicates on tool connections. They never rewrite content. A failure blocks the whole request or response.

  1. Create a Validator for the tool-edge checks you need.
  2. Assign Validators on the connection and direction.

Requirements

Before you begin:

• Authenticate to Dome and select a workspace
• Have at least one model or tool connection to assign

Permissions

Guard Filter operations require platform permissions. Each operation restates its permission inline.

The legacy filters.view and filters.manage aliases still satisfy these checks during the cutover.

Filters

Filters are a Guard type. Create and version Filters here, assign them to connections, and tune the streaming window used when response Filters inspect model output.

Create a Filter

Create a Filter to define its first active version. Text Filters use convenience flags. JSON Filters use a config file.

When more than one JSON action targets the same path, precedence is BLOCK > OMIT > REDACT. REDACT rewrites the matched span or value, OMIT removes a JSON field, and BLOCK withholds the whole message and stops the chain.

dome guards filters create pii-redact \
  --description "Redact PII in model responses" \
  --redact-ssn \
  --redact-substring "internal-only" \
  --block-substring "TOP-SECRET"

dome guards filters create tool-scrub \
  --config-from ./tool-scrub.json

{
  "json": {
    "components": [
      {
        "field_actions": [
          {"matcher": {"path": "ssn"}, "action": "FILTER_ACTION_OMIT"},
          {"matcher": {"path": "email"}, "action": "FILTER_ACTION_REDACT"},
          {"matcher": {"path": "card"}, "action": "FILTER_ACTION_BLOCK"}
        ]
      }
    ]
  }
}

{
  "name": "pii-redact",
  "description": "Redact PII in model responses",
  "redact_ssn": true,
  "redact_substrings": ["internal-only"],
  "block_substrings": ["TOP-SECRET"]
}

Create a text Filter named "pii-redact" that redacts SSNs and the substring "internal-only", and blocks on "TOP-SECRET".

Update a Filter

Update Filter metadata in place, or pass any config flag to deploy a new active version. The previous version remains in history. Assigned connections follow the active version on the next gateway sync.

dome guards filters update pii-redact \
  --description "Redact PII and secrets in model responses" \
  --redact-ssn \
  --block-substring "TOP-SECRET"

{
  "filter": "pii-redact",
  "description": "Redact PII and secrets in model responses",
  "redact_ssn": true,
  "block_substrings": ["TOP-SECRET"]
}

Roll back a Filter

Roll a Filter back to an earlier version. The target version's config is copied forward into a new active version. History is never mutated.

dome guards filters rollback pii-redact --to-version 1

{
  "filter": "pii-redact",
  "to_version": 1
}

Delete a Filter

Delete a Filter and its connection assignments. Corrupt Filters can still be addressed by UUID when their config fails to render.

dome guards filters delete pii-redact

{
  "filter": "pii-redact"
}

Assign ordered Filter chains

Each assignment binds Filters to a (connection, direction) slot. Setting a chain replaces the complete ordered list for that slot. Clear a chain with an empty filter list.

Model connections accept only text Filters. Tool connections accept only json Filters.

dome models guards filters set claude-prod \
  --direction response \
  --filters pii-redact,secrets-block

dome tools guards filters set github-mcp \
  --direction request \
  --filters tool-scrub

dome models guards filters set claude-prod \
  --direction request \
  --filters ""

dome models guards filters list <connection>
dome tools guards filters list <connection>

{
  "connection": "claude-prod",
  "direction": "response",
  "filters": ["pii-redact", "secrets-block"]
}

{
  "connection": "github-mcp",
  "direction": "request",
  "filters": ["tool-scrub"]
}

Assign Filters "pii-redact" and "secrets-block" in that order to the response direction on model connection "claude-prod".

Configure the streaming window

Configure how much streamed model output the gateway buffers before applying response Filters. Layering rules are on the Guards concept and streaming window reference.

In the dashboard, set the workspace floor under Settings → Config. From the API:

PUT /v1/workspaces/<workspace-uuid>/llm-filter-window
Content-Type: application/json

{
  "tenant_id": "<tenant-uuid>",
  "llm_filter_window_bytes": 4096,
  "llm_filter_window_tokens": 1024
}

Agents can request a wider buffer for a single call by adding a _dome block to the OpenAI- or Anthropic-shaped body:

{
  "model": "production",
  "messages": [{"role": "user", "content": "Summarize the notes."}],
  "_dome": {"filter_window_bytes": 8192, "filter_window_tokens": 64}
}

The override is validated against the same bounds the workspace floor uses and is invisible to the upstream provider. Refer to Models for the per-connection flags.

Validators

Validators are a Guard type for tool connections. They check structured conditions on tool request arguments or MCP tool results and block when any condition fails. They never redact or omit fields. Every assigned Validator must pass.

Condition catalogs and response targets are on the Guards reference.

Create a Validator

Create a Validator with a protojson dome.guards.v1.ValidatorConfig. The config arm (toolRequest or toolResponse) sets the kind and is immutable after create.

dome guards validators create require-user-id \
  --description "Require user_id on tool calls" \
  --config-from ./require-user-id.json

{
  "toolRequest": {
    "json": {
      "requiredPaths": ["user_id"],
      "maximumSize": 4096
    }
  }
}

{
  "toolResponse": {
    "target": "VALIDATION_TARGET_STRUCTURED_CONTENT",
    "json": {
      "requiredPaths": ["status"]
    }
  }
}

{
  "name": "require-user-id",
  "description": "Require user_id on tool calls",
  "config_json": "{\"toolRequest\":{\"json\":{\"requiredPaths\":[\"user_id\"],\"maximumSize\":4096}}}"
}

Create a tool-request Validator named "require-user-id" that requires the path "user_id" and caps arguments at 4096 bytes.

Update a Validator

Update metadata in place, or pass --config-from / config_json to deploy a new active version. Kind cannot change.

dome guards validators update require-user-id \
  --description "Require user_id and tenant_id" \
  --config-from ./require-user-id.json

{
  "validator": "require-user-id",
  "description": "Require user_id and tenant_id",
  "config_json": "{\"toolRequest\":{\"json\":{\"requiredPaths\":[\"user_id\",\"tenant_id\"],\"maximumSize\":4096}}}"
}

Roll back a Validator

Roll a Validator back to an earlier version. The target version's config is copied forward into a new active version.

dome guards validators rollback require-user-id --to-version 1

{
  "validator": "require-user-id",
  "to_version": 1
}

Delete a Validator

Delete a Validator and its connection assignments.

dome guards validators delete require-user-id

{
  "validator": "require-user-id"
}

Assign Validators

Attach Validators to a tool connection as an unordered set on one direction. Direction must match the Validator kind. Response Validators are MCP-only.

dome tools guards validators add github-mcp \
  --direction request \
  --validators require-user-id

dome tools guards validators remove github-mcp \
  --direction request \
  --validators require-user-id

dome tools guards validators list github-mcp

{
  "connection": "github-mcp",
  "direction": "request",
  "validators": ["require-user-id"]
}

{
  "connection": "github-mcp",
  "direction": "request",
  "validators": ["require-user-id"]
}

Attach Validator "require-user-id" to the request direction on tool connection "github-mcp".

Next steps

• Guards concept for how content inspection works
• Guards reference for Filter catalogs and audit payloads
• Audit to query guard.filter.evaluate, guard.validator.evaluate, and the enclosing tool.call or model.call
• Connect Tools to add tool connections
• Models to set per-connection filter windows
• Authorize Access when a call should be allowed or denied before Guards run
• Architecture concept for where Guards sit in the request path