Proving it before you arm it
Resolve a binding, dry-run it, watch it on real traffic in monitor, and only then enforce — plus what each step cannot tell you.
On this page
Use configuration resolution, simulation and real traffic as separate checks. A simulation finds detector behavior on its selected inputs; it does not prove live delivery or retention behavior.
Resolve the effective policy
tokentriage guardrails explain --binding pii_in --config tokentriage.yaml prints the compiled binding, detector versions, thresholds and supported actions. Ensure the intended profile is selected by default_profile or the request’s resolved policy. Unsupported actions and capability combinations are rejected during activation.
Simulate with a named operation
POST /tt/api/v1/guardrails/simulate and tokentriage guardrails test produce mode: simulate, enforced: false reports. Reports include operation context, policy generation, extraction state and detector executions. They contain no submitted text or finding detail strings. Ordinary simulation runs embedded detectors only.
Literal text and provider-shaped bodies are different inputs. Structured runs use the serving extractor; opaque or partial bodies disclose gaps. Literal input defaults to detector_diagnostics; stored subjects default to policy_dry_run. The latter runs extraction and sequential planning against the current named profile, or the deployment default when no profile is selected.
Per-key guardrail simulation is not implemented: a nonempty key selector is refused with a named error. Selecting an authorized stored request supplies its content, not its historical virtual-key overrides. Policy dry runs do not test external detectors, stream framing, provider retries, re-identification or client delivery. Missing or unreadable stored content is reported explicitly.
Stored-content simulation is content access. It requires privileged content:read authorization and a successful audit append before reading stored content; an ordinary wildcard read grant is insufficient. This is a global management content permission, not a per-record ownership or tenant-isolation boundary.
Read the denominator
Dataset and cohort reports disclose total, selected, missing, unreadable, cap-excluded and truncated-body counts. A selection or read failure cannot become an empty successful report. A literal-text case with no stored subject is distinct from an unavailable stored case.
Hot reload publishes the simulator with the runtime policy snapshot. Check the report’s generation and policy reference; an in-flight run keeps its captured snapshot.
Verify the live boundaries
Exercise input, buffered output and streaming separately in monitor and enforce modes. Include malformed bodies, work limits, detector faults and cancellation. Compare actual upstream/client bytes, invocation counts, execution receipts and storage effects. A clean detector result establishes no claim about a path that was not selected or was not inspected.
Use representative benign cases as well as positive cases before enforcement. Repository-visible synthetic fixtures provide regression checks, not blinded population accuracy. See Evidence & alerting.