Guardian icon

Guardian

Policy-based safety gate for AI agents and workflows. Check actions against Guardian policies, enforce previously-evaluated intents, or gate AI agent tool calls. Returns Allowed (including OBSERVED advisory decisions), Denied, or Needs Approval.

Actions3

Check → Evaluate Only

AI-generated

Summary

Evaluate an action against Guardian policies without marking it as executed. Provide the required action type and JSON payload; optionally add a requester for the audit trail, a project slug to scope the policy check, an idempotency key for retry deduplication, or enable test mode to avoid consuming quota.

Inputs

  • Action Type (required) — Action identifier that must match a Guardian policy, such as payment.send.
  • Payload (required) — JSON data for Guardian to evaluate against the policy rules. An unparsable JSON string causes an error.
  • Requester — Optional audit-trail identifier.
  • Project Slug — Optional project that scopes the policy check; empty uses the default project.
  • Idempotency Key — Optional key sent with the request to prevent duplicate processing on retries.
  • Test Mode — When enabled, sends the test-mode header; the UI states this does not consume quota.

Output shape

Three output branches: Allowed, Denied, and Needs Approval. Each receives the Guardian response fields plus a _guardian object with the normalized decision, intent run ID, action type, operation, and executed: false.

This operation submits a policy check and does not call the execution confirmation endpoint, even when the decision is ALLOW. OBSERVED decisions go to Allowed as advisory results and are marked advisoryOnly; DENY goes to Denied, and other decisions go to Needs Approval. API or payload errors stop the node unless Continue On Fail is enabled, in which case the error item goes to Denied.

Links

Discussion