# Verbs & effects

The ten guardrail verbs, which of them this build carries out, and why the effect on the row differs from the verb you configured.

Source: https://tokentriage.com/docs/guardrails/verbs-and-effects

---
An action is an instruction selected by a finding. The execution receipt separately records whether it was attempted, applied, failed or withheld and what was delivered.

| Verb | Supported behavior |
|---|---|
| `observe` | Record a finding |
| `warn` | Record a warning; do not assume a response header was emitted |
| `block` | Refuse input or suppress unreleased output |
| `redact` | Replace a validated span with a fixed marker |
| `mask` | Replace a validated span with a partial reveal |
| `tokenize` | Replace a validated span with a request-vault placeholder |
| `pseudonymize` | Replace a validated span with a consistent surrogate |
| `reidentify` | Restore exact input-vault placeholders on a supported reverse leg |
| `rewrite`, `reask` | Unavailable; activation is rejected |

Spanless classification does not provide coordinates for redaction. Mutating sidecar combinations are refused during activation. `observe`, `warn` and `block` are meaningful classification actions, subject to the external-tier activation restrictions.

## What `mutated` proves

A transformation validates all coordinates, UTF-8 boundaries, non-overlap and replacement operations before committing the candidate body. A failed or discarded candidate cannot claim mutation. Stream operations must also refer to bytes still held for release. Invalid spans apply the configured [failure posture](/docs/guardrails/phases-and-streaming).

In `monitor`, the finding can say the configured action is `redact`, but the effect is an annotation and no bytes changed. Reversibility describes the action's mechanism; it does not establish durable recovery. The vault remains request-scoped unless the running build explicitly provides a durable store.

Read the selected action together with transformation and delivery receipts. A mutation applied before output was withheld is different from a mutation delivered to the client. A finding count alone establishes neither one.