Controls

A control connects an obligation to a mechanism that checks or enforces it. Choose the mechanism from when the obligation must hold and what should happen when it does not.

Five control types

Type Purpose

Guardrail

Decide whether a model call, tool call, or response may proceed.

Sanitizer

Mask sensitive text before it reaches a configured destination.

Evaluation

Measure behavior against quality or safety criteria.

Human decision

Require a person’s approval or input at a defined step.

Gate

Turn check results into a build or release decision.

A classifier supplies a score or label that another mechanism uses. It is a building block, not an additional control type: the same classifier can inform a guardrail, sanitizer, evaluator, or application decision.

Timing and outcomes

A blocking guardrail acts inline. By default, a failure of the check does not permit the action to proceed. Report-only mode observes decisions without blocking. A live evaluator runs after an interaction and cannot undo its outcome; use a guardrail when the result must determine whether an action happens.

Human approval requires more than a pause. The system must authenticate the decision, verify the person’s authority, and record it before resuming. A workflow supplies the durable wait and application logic supplies the acceptance conditions.

A gate decides over results, such as a test pass rate or the exit conditions required for release. It is distinct from an individual runtime check.

Evidence and intervention

Each verdict identifies its control so evidence can be traced to an obligation. Control verdicts distinguish upheld, breached, inconclusive, and error outcomes; an unavailable check must not silently become a successful one.

A system-wide halt and a per-call guardrail have different scopes. For an Autonomous Agent, the component client provides suspension, resumption, and termination. Use the documented lifecycle behavior when implementing intervention.

Next steps