> ## Documentation Index
> Fetch the complete documentation index at: https://docs.domesystems.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Guards

> Guard types, Filter kinds and actions, path syntax, tool payload shapes, and streaming window layers

This page lists Guard types and the catalogs that back them. Filters are the Guard type available today; validators are coming soon.

For how content inspection works, see the [Guards](/concepts/controls/guards) concept. To configure Guards, see [Filter responses](/govern/guards).

## Filters

Filters inspect and rewrite model or tool responses before they return to the agent.

### Kinds

| Kind   | Connection | Matchers                                   | Actions                   |
| ------ | ---------- | ------------------------------------------ | ------------------------- |
| `text` | Model      | Substring, SSN, credit card, phone, digits | `redact`, `block`         |
| `json` | Tool       | JSON field path                            | `redact`, `omit`, `block` |

Filter kind is immutable after create.

### Actions and precedence

| Action                            | Effect                                                   |
| --------------------------------- | -------------------------------------------------------- |
| `redact` / `FILTER_ACTION_REDACT` | Rewrites the matched value with a redaction sentinel     |
| `omit` / `FILTER_ACTION_OMIT`     | Removes the key and value (JSON only)                    |
| `block` / `FILTER_ACTION_BLOCK`   | Withholds the whole message and short-circuits the chain |

When more than one JSON action targets the same path, precedence is `BLOCK` > `OMIT` > `REDACT`.

### Path syntax

JSON Filter `matcher.path` values use a locked-down dialect. It is not JSONPath.

| Form                                | Matches                                            | Example                                                     |
| ----------------------------------- | -------------------------------------------------- | ----------------------------------------------------------- |
| `key`                               | A top-level field                                  | `email`                                                     |
| `a.b`                               | A nested field at an exact path                    | `user.email`                                                |
| `a.b[3].c`                          | A specific array element by index                  | `contacts[0].phone`                                         |
| `a.b.c` against an array of objects | Every element (implicit fan-out)                   | `employees.ssn` redacts the field on every employee         |
| `**.key` or `**.a.b`                | The trailing path at **any depth** in the response | `**.phone` redacts every `phone` field, nested at any level |

Exact-path matching is the default. The `**.` prefix redacts a field by name wherever it appears.

Recursive descent (`**.phone`) fits when the field name is a reliable sensitivity signal regardless of depth, when response shapes vary across tools, or when enumerating every exact path is brittle. Exact paths (`primary_contact.phone`) fit when only specific occurrences are sensitive and a same-named field elsewhere should pass through.

`**` is only recognized as a leading prefix. Mid-path `**` (for example `a.**.b`) is treated as literal key characters and never matches. There is no JSONPath `..`, no wildcards, and no slice ranges.

### Tool payload coverage

JSON Filters traverse every tool-result shape the MCP server can return.

| Payload             | Coverage                                      |
| ------------------- | --------------------------------------------- |
| Content body        | Raw JSON object or array                      |
| Content items       | Top-level MCP content array                   |
| Embedded JSON       | JSON encoded inside `text` or `resource.text` |
| `structuredContent` | Structured mirror attached by the MCP server  |

Field matchers apply at any depth. A matching `BLOCK` short-circuits the Guard chain and replaces the result with a safe placeholder. The audit event identifies the blocking Filter.

### Streaming window

The effective window at stream time is `max(workspace floor, connection override, per-request override)`. Any layer set to `0` drops out of the max.

| Layer           | Where it's set                                                                                     | Notes                                                                                                                   |
| --------------- | -------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
| Workspace floor | **Settings → Config** in the dashboard, or `UpdateWorkspaceLLMFilterWindow` on the API             | Bytes ≤ 1 MiB, tokens ≤ 4096.                                                                                           |
| Per-connection  | `--filter-window-bytes` / `--filter-window-tokens` on `dome model add` or `dome model update`      | `0` inherits the workspace floor. On `update`, passing `0` with the flag present clears the override back to the floor. |
| Per-request     | `_dome.filter_window_bytes` / `_dome.filter_window_tokens` in the OpenAI or Anthropic request body | The `_dome` key is stripped before the request reaches the upstream provider.                                           |

Workspace floor fields are `llm_filter_window_bytes` and `llm_filter_window_tokens`. Per-connection flags live on [Models](/connect/resources/models). Setting the layers is on [Configure the streaming window](/govern/guards#configure-the-streaming-window).

## Next steps

* [Guards](/concepts/controls/guards) concept for Filters, directions, and fail-closed behavior
* [Configure Guards](/govern/guards) to create, assign, and tune windows
* [Models](/connect/resources/models) for per-connection filter windows