Guards

This page lists Guard types and the catalogs that back them. Filters are the Guard type available today; validators are coming soon. For how content inspection works, see the Guards concept. To configure Guards, see Filter responses.

Filters

Filters inspect and rewrite model or tool responses before they return to the agent.

Kinds

Kind	Connection	Matchers	Actions
`text`	Model	Substring, SSN, credit card, phone, digits	`redact`, `block`
`json`	Tool	JSON field path	`redact`, `omit`, `block`

Filter kind is immutable after create.

Actions and precedence

Action	Effect
`redact` / `FILTER_ACTION_REDACT`	Rewrites the matched value with a redaction sentinel
`omit` / `FILTER_ACTION_OMIT`	Removes the key and value (JSON only)
`block` / `FILTER_ACTION_BLOCK`	Withholds the whole message and short-circuits the chain

When more than one JSON action targets the same path, precedence is BLOCK > OMIT > REDACT.

Path syntax

JSON Filter matcher.path values use a locked-down dialect. It is not JSONPath.

Form	Matches	Example
`key`	A top-level field	`email`
`a.b`	A nested field at an exact path	`user.email`
`a.b[3].c`	A specific array element by index	`contacts[0].phone`
`a.b.c` against an array of objects	Every element (implicit fan-out)	`employees.ssn` redacts the field on every employee
`.key` or `.a.b`	The trailing path at any depth in the response	`**.phone` redacts every `phone` field, nested at any level

Exact-path matching is the default. The **. prefix redacts a field by name wherever it appears. Recursive descent (**.phone) fits when the field name is a reliable sensitivity signal regardless of depth, when response shapes vary across tools, or when enumerating every exact path is brittle. Exact paths (primary_contact.phone) fit when only specific occurrences are sensitive and a same-named field elsewhere should pass through. ** is only recognized as a leading prefix. Mid-path ** (for example a.**.b) is treated as literal key characters and never matches. There is no JSONPath .., no wildcards, and no slice ranges.

Tool payload coverage

JSON Filters traverse every tool-result shape the MCP server can return.

Payload	Coverage
Content body	Raw JSON object or array
Content items	Top-level MCP content array
Embedded JSON	JSON encoded inside `text` or `resource.text`
`structuredContent`	Structured mirror attached by the MCP server

Field matchers apply at any depth. A matching BLOCK short-circuits the Guard chain and replaces the result with a safe placeholder. The audit event identifies the blocking Filter.

Streaming window

The effective window at stream time is max(workspace floor, connection override, per-request override). Any layer set to 0 drops out of the max.

Layer	Where it’s set	Notes
Workspace floor	Settings → Config in the dashboard, or `UpdateWorkspaceLLMFilterWindow` on the API	Bytes ≤ 1 MiB, tokens ≤ 4096.
Per-connection	`--filter-window-bytes` / `--filter-window-tokens` on `dome model add` or `dome model update`	`0` inherits the workspace floor. On `update`, passing `0` with the flag present clears the override back to the floor.
Per-request	`_dome.filter_window_bytes` / `_dome.filter_window_tokens` in the OpenAI or Anthropic request body	The `_dome` key is stripped before the request reaches the upstream provider.

Workspace floor fields are llm_filter_window_bytes and llm_filter_window_tokens. Per-connection flags live on Models. Setting the layers is on Configure the streaming window.

Next steps

Guards concept for Filters, directions, and fail-closed behavior
Configure Guards to create, assign, and tune windows
Models for per-connection filter windows

Get started

Core concepts

Connect

Govern

Operate

Manage

Develop

Reference

Filters

Kinds

Actions and precedence

Path syntax

Tool payload coverage

Streaming window

Next steps

​Filters

​Kinds

​Actions and precedence

​Path syntax

​Tool payload coverage

​Streaming window

​Next steps

Filters

Kinds

Actions and precedence

Path syntax

Tool payload coverage

Streaming window

Next steps