# Proving it before you arm it

Resolve a binding, dry-run it, watch it on real traffic in monitor, and only then enforce — plus what each step cannot tell you.

Source: https://tokentriage.com/docs/guardrails/proving-it-before-you-arm-it

---
Use configuration resolution, simulation and real traffic as separate checks. A simulation finds detector behavior on its selected inputs; it does not prove live delivery or retention behavior.

## Resolve the effective policy

`tokentriage guardrails explain --binding pii_in --config tokentriage.yaml` prints the compiled binding, detector versions, thresholds and supported actions. Ensure the intended profile is selected by `default_profile` or the request's resolved policy. Unsupported actions and capability combinations are rejected during activation.

## Simulate with a named operation

`POST /tt/api/v1/guardrails/simulate` and `tokentriage guardrails test` produce `mode: simulate`, `enforced: false` reports. Reports include operation context, policy generation, extraction state and detector executions. They contain no submitted text or finding detail strings. Ordinary simulation runs embedded detectors only.

Literal text and provider-shaped bodies are different inputs. Structured runs use the serving extractor; opaque or partial bodies disclose gaps. Literal input defaults to `detector_diagnostics`; stored subjects default to `policy_dry_run`. The latter runs extraction and sequential planning against the current named profile, or the deployment default when no profile is selected.

Per-key guardrail simulation is not implemented: a nonempty key selector is refused with a named error. Selecting an authorized stored request supplies its content, not its historical virtual-key overrides. Policy dry runs do not test external detectors, stream framing, provider retries, re-identification or client delivery. Missing or unreadable stored content is reported explicitly.

Stored-content simulation is content access. It requires privileged `content:read` authorization and a successful audit append before reading stored content; an ordinary wildcard read grant is insufficient. This is a global management content permission, not a per-record ownership or tenant-isolation boundary.

## Read the denominator

Dataset and cohort reports disclose total, selected, missing, unreadable, cap-excluded and truncated-body counts. A selection or read failure cannot become an empty successful report. A literal-text case with no stored subject is distinct from an unavailable stored case.

Hot reload publishes the simulator with the runtime policy snapshot. Check the report's generation and policy reference; an in-flight run keeps its captured snapshot.

## Verify the live boundaries

Exercise input, buffered output and streaming separately in monitor and enforce modes. Include malformed bodies, work limits, detector faults and cancellation. Compare actual upstream/client bytes, invocation counts, execution receipts and storage effects. A clean detector result establishes no claim about a path that was not selected or was not inspected.

Use representative benign cases as well as positive cases before enforcement. Repository-visible synthetic fixtures provide regression checks, not blinded population accuracy. See [Evidence & alerting](/docs/guardrails/evidence-and-alerting).