# Air-gap & known limits

What an air-gapped deployment allows, the consent an external tier needs, and every known limit of the guardrail layer.

Source: https://tokentriage.com/docs/guardrails/air-gap-and-limits

---
Embedded detectors run in the Go gateway without an external model call. External guardrail processing requires typed destination consent, a supported representation and a request-owned budget. Configuration alone is not evidence that a call was sent or a detector completed.

## Supported activation

| Capability | Current support |
|---|---|
| Embedded Go content detectors | Available within each detector's declared phases and coverage |
| Production sidecar tier | Activation rejected pending a pinned and measured reference runtime |
| Judge tier with a positive hard dollar cap | Activation rejected without a proven conservative reservation price |
| Judge tier with an explicit zero cap | Accepted with consent; makes zero judge calls and records denial |
| External detector requiring raw content | Activation rejected |
| Spanless classification plus a mutating action | Activation rejected |
| `rewrite` and `reask` | Activation rejected; no shipped executor |
| Gatewayless Python/TypeScript routing or Rust/Wasm | No guardrail enforcement; required protection is refused |

The sidecar reference service is an unqualified development fixture. Its protocol requires correlated result IDs, explicit valid scores and immutable model provenance, refuses redirects, and bounds request/response sizes. Tests using synthetic classifiers verify protocol behavior only. No NER span or model efficacy claim follows from those tests.

## Calls and cost

An invocation receipt is independent of findings: a clean call, a paid malformed response and a denied call are different events. Receipts distinguish preparation, attempted sends and received responses. Destination/model metadata is hashed; errors contain authored codes. A send attempt does not prove remote receipt.

The shared request budget bounds calls, bytes, concurrency and money across phases. A zero cap denies every call. Unknown reservation cost denies a capped call before dispatch. Uncapped calls may remain unpriced; missing usage is never treated as free, and an ambiguous paid failure cannot refund reserved budget as though nothing happened.

## Content and quality limits

No embedded detector semantically reads images, audio or video. Tool schemas and envelope metadata are preserved outside the mutation surface. Opaque or unsupported content, scanner exhaustion, and incomplete stream coverage apply the configured failure posture and produce receipts.

Published repository fixtures are synthetic and visible to implementers. They are useful regression controls, not a blinded sample or a population accuracy estimate. Local protocol tests do not establish model efficacy. No broad zero-leak, precision/recall, air-gap or performance claim is made without the corresponding executed release evidence.

For external calls that are unavailable under these restrictions, keep protection local or leave the feature disabled. See [Phases & streaming](/docs/guardrails/phases-and-streaming) for failure behavior and [What gets inspected](/docs/guardrails/what-gets-inspected) for scope.