Guard proposed tool calls
Guard evaluates tool proposals returned by supported, non-streaming OpenAI Chat Completions and Anthropic Messages calls.
Two launch modes
- Audit: a matching rule records a would-block and lets the proposal continue.
- Enforce: a matching block rule prevents the normal provider dispatch loop from receiving the proposal and raises
st.GuardBlocked.
allow is the ordinary wire result when no configured rule blocks a proposal. It is not a separate product mode.
Configure a policy first
Built-in rules are templates. They do not protect an agent until you attach them to a policy for the matching organization, agent, or environment.
Start in audit mode. Review the recorded would-blocks, tune the policy, then enable enforcement when the false-positive rate is acceptable.
See rules and policies.
Provider-proposed tools
try:
response = client.chat.completions.create(
model="gpt-4o-mini",
messages=messages,
tools=tools,
)
except st.GuardBlocked as blocked:
return recover(blocked.reason)The patched provider evaluates configured policies before returning proposed tools to the normal dispatch loop.
@st.tool records the Python function that actually runs. It does not evaluate Guard by itself.
Direct tool calls
Call st.guard() before a direct action that needs enforcement:
decision = st.guard("delete_record", {"record_id": "r_42"})
if decision.action == "block":
raise RuntimeError(decision.reason)
delete_record("r_42")Pass trace and span IDs in context when a manual decision must link to a specific trace. See manual checks.
Failure policy
Guard fails open when no policy decision is available by default. Set fail_closed=True for a direct check, or STASO_GUARD_FAIL_CLOSED=true for the process, when explicit degradation must block the action.
A direct check has a 10-second request timeout by default. Provider integrations evaluate a proposal batch concurrently under one 10-second absolute deadline, with at most four evaluations active by default. STASO_GUARD_BATCH_TIMEOUT and STASO_GUARD_MAX_CONCURRENCY tune those bounds. Results remain in provider input order; unfinished checks return an explicit unavailable result and follow the configured failure mode.