saphan guardrail
Inspects the model-text guardrail — the plugins that judge the text passing between an agent and its model — and prepares the owner's act that switches a stage to enforcement.
Inspects the model-text guardrail — the plugins that judge the text passing between an agent and its model — and prepares the owner's act that switches a stage to enforcement. Setting a stage's mode to enforce in the configuration only declares the intent; the stage stays in observe until a signed owner act names the plugin, the stage and the pinned manifest's digest. ⛔ No command here ever prints the text that was judged: only decisions, reason codes, counts and redacted configuration values.
saphan guardrail act
Prepares, and where the root key is present signs, the owner act that arms one plugin at one stage. Without --root-key it only prints the exact bytes to be signed, so a machine that does not hold the key can still show what will be signed; with it, it prints the signed line. The command writes nothing: append that line to the file named by guardrail.enforce_acts on the machine that runs the stage, then confirm with saphan guardrail config that the stage reads as enforcing — until then it only observes. A stage the plugin's manifest does not list is refused. The manifest's digest is part of what is signed, so re-pinning the plugin requires a new act.
⚠ Enforcing at spawn.handoff judges every agent start: a plugin that blocks there can refuse every run.
| flag | type | default | what it does |
|---|---|---|---|
--actor | string | Who performs the act; it is part of the signed content and cannot be changed afterwards. | |
--plugin-digest | string | The sha256 of the plugin manifest's exact bytes, in lower-case hex; part of the signed content. | |
--plugin-manifest | string | The path of the plugin's manifest (use an absolute path); its bytes are checked against --plugin-digest. | |
--recorded-at | string | The RFC 3339 time of the act; required, because it is signed and the command never reads a clock for it. | |
--root-key | string | The local path of the root key on the machine that holds it; omit it to print the bytes to sign without signing. | |
--stage | string | The one stage to arm: model.request, model.response, bridge.ingress or spawn.handoff. |
saphan guardrail config
Shows the guardrail configuration that actually applies — every key, its value, and where the value came from (default, config, unset, or not applicable with the reason) — and names any stage set to enforce that has no verified owner act. Values are redacted: credentials in URLs and every query-string value are removed.
| flag | type | default | what it does |
|---|---|---|---|
--backend | string | The agent backend to resolve the configuration for; required. | |
--config | string | The configuration file to resolve; defaults to this machine's own. | |
--seat | string | The seat to resolve the configuration for. |
saphan guardrail replay
Runs a plugin's own named false-positive cases, as listed in its manifest, through the real plugin and the same decision path the proxy uses, and prints one line per case. The plugin runs with an empty environment, so it inherits none of your credentials. It exits non-zero, naming the case, when any case does not meet its expected result, and refuses when no case resolved at all.
| flag | type | default | what it does |
|---|---|---|---|
--fixture-dir | string | The absolute path of the directory holding the cases the manifest names. | |
--plugin-artifact | string | The absolute path of the plugin executable that the manifest pins by digest. | |
--plugin-digest | string | The sha256 of the plugin manifest's exact bytes, in lower-case hex. | |
--plugin-manifest | string | The absolute path of the plugin's manifest. |
saphan guardrail stats
Reads a guardrail audit file and prints, per plugin and stage, how many requests were allowed, blocked or errored, with timeouts counted separately and the 95th-percentile latency. Rows the proxy wrote about its own failures are counted under proxy, and an empty window reads as unmeasured, never 0%.
| flag | type | default | what it does |
|---|---|---|---|
--audit | string | The path of the audit JSONL file a guardrail proxy or egress door wrote (use an absolute path). |
Global options apply to every command — see Every command.
saphan grammar
Prints the document formats compiled into this binary, so an agent or operator on a remote machine can read them without a source checkout, and manages the list of declared document keys.
saphan guardrail-proxy
Runs one command behind a local proxy that records, and optionally judges, the text exchanged between an AI client and its model provider.