Limits · Saphan Studio documentation

limit	what it means for you
No built-in rules	Judging is only as good as the plugin you attach. Without one, the guardrail records but judges nothing.
A plugin can send content elsewhere	Nothing in the product restricts a plugin's own network access. The shipped NeMo adapter sends the conversation to your NeMo service by design.
One plugin, one decision at a time	Each proxy runs one plugin process, and decisions are serialised. A slow plugin slows the agent.
Enforce holds whole responses	In `enforce` a streamed response is buffered until the decision, so the agent sees it all at once.
Some traffic is not judged	Error replies from the model provider and model-listing requests pass unjudged, in every mode. They are recorded.
In observe, a plugin failure lets the call through	The failure is recorded. Requests the proxy cannot read at all are refused in every mode.
Pointed, not forced, on most lanes	Outside the sealed Linux wall, an agent that ignores the proxy address is not stopped at the network layer. See Coverage.
Not every agent is covered	`cursor` is not covered; `qwen-code` is not covered inside the egress wall; `codex` and `droid` are covered on Linux only.
Some coverage is unproven	The remote Mac, the agent harness and `droid` inside the wall are built but not yet exercised end to end.
Plugin decisions are not in the event log	The console's event log does not show guardrail decisions in this release. Read them from the run's audit file, or summarise it with `saphan guardrail stats`.
No verification command for the transcript chain	The model transcript is hash-chained, but no command checks the chain on demand. See Session recording.