# Guard rules

> Use Guard rules to redact secrets before they reach a model, and to block, ask or warn before an AI agent runs a risky command, reads a file or calls MCP.

Source: https://docs.subcloak.com/cloak-watch/ai-activity/guard/

Guard is the part of AI Activity that stops things. Its secrets rule keeps keys and tokens from reaching a model, and its tool rules block, ask or warn before an agent runs a command, reads or writes a file, calls an MCP server or fetches a domain. Guard only acts through tools you've [connected](https://docs.subcloak.com/cloak-watch/ai-activity/connections/) with hooks or the gateway; with nothing connected, the Guard tab says **No agent is connected, so these rules don't stop anything yet.**

*[Screenshot: The Guard tab: the Secrets rule Secrets never leave this Mac set to Redact, a list of tool rules such as Ask before rm -rf outside the project, Block curl | sh and Block reading ~/.ssh, and the selected rule's editor with Name, What, Action, Where, Message, If Watch isn't running and Who enforces it]*

## The rules list

| Section | What's in it |
|---|---|
| **Secrets** | The rule **Secrets never leave this Mac**. It's on from the start, set to **Redact**. |
| **Tool rules** | Built-in rules you switch on, and your own. **Add Rule** offers templates by category and **Custom Rule…**. |
| **Exceptions** | What you allowed with **Always Allow**, each with **Remove**. |
| **Recent decisions** | What Guard blocked, asked about or redacted in the last days, each with **Allow Once**, **Always Allow** and **Show in Activity**. |

Each rule shows its action, where it applies, and who enforces it, for example **Enforced in Claude Code and Cursor**, or **No connected agent enforces this yet**.

## Built-in rules

| Rule | Action | On at first |
|---|---|---|
| **Secrets never leave this Mac** | Redact | Yes |
| **Ask before rm -rf outside the project** | Ask | No |
| **Block curl \| sh** | Block | No |
| **Block reading ~/.ssh** | Block | No |
| **Block reading ~/.aws** | Block | No |
| **Block reading ~/.config/gh** | Block | No |
| **Ask before keychain commands** | Ask | No |
| **Ask before git push --force to main** | Ask | No |
| **Ask before publishing packages** | Ask | No |
| **Ask before writing outside the project** | Ask | No |
| **Block an MCP server…** | Block | No, needs a server |
| **Block a domain…** | Block | No, needs a domain |

## Actions

| Action | In a tool rule | In the secrets rule |
|---|---|---|
| **Block** | The agent can't run the tool call; it's told why. | Stops the prompt or request. |
| **Ask** | The agent asks you first. Codex and Gemini CLI can't ask, so Guard blocks there instead; Cursor can ask only before shell and MCP calls. | Not available |
| **Warn** | Allowed, and noted in the timeline. | Allowed, and noted. |
| **Redact** | Not available | Replaces each secret with `[REDACTED: type]` in requests through the gateway. Hooks can't change a prompt, so in prompts Redact blocks instead. |

How the secrets rule works in practice:

- **Through the gateway**, Guard redacts secrets in what you and your tools wrote (prompts and tool results) before the request leaves your Mac. Secrets in `CLAUDE.md`, the system prompt or tool definitions are flagged, not removed: remove them where they're written.
- **Through Claude Code's hooks**, a prompt with a secret is stopped before it reaches the model, and secrets in a tool's output are redacted before the model reads it.
- **Through Cursor's hooks**, Guard also checks a file's content before Cursor reads it.

Guard finds AWS, GitHub, Stripe, Slack, Anthropic, OpenAI, Google, npm and other keys and tokens, private keys, and `.env` values. It never stores a secret: only its type, a masked form and where it was.

## Make or change a rule

1. On the Guard tab, select a rule, or click **Add Rule** and pick a template or **Custom Rule…**.

   *[Screenshot: The rule editor for a new custom rule, with What, the trigger fields, Action, Where, Message and If Watch isn't running]*

2. Fill in the editor:

   | Field | Options |
   |---|---|
   | **Name** | What you'll see in the list and the timeline |
   | **What** | **Shell command** (a pattern), **File path** (a path pattern; **Reads**, **Writes** or both; **Only outside the project** / **Anywhere outside the project**), **MCP server** (and optionally one **Tool**), **Web domain**, or **Tool name**. For the secrets rule: **Keys, tokens, private keys, .env values**. |
   | **Action** | **Block**, **Ask** or **Warn** for tool rules; **Redact**, **Block** or **Warn** for the secrets rule |
   | **Where** | **Agents** (a checkbox each) and **Projects** (**Every project** or one) |
   | **Message** | What the agent is told. It usually passes it on to you. |
   | **If Watch isn't running** | **Let it through** (the default) or **Block** |

   **Who enforces it** lists each agent and whether it can enforce the rule.

3. Click **Add Rule** or **Save**. **Revert** discards your changes; **Delete Rule** removes a rule you made.

> **Fail closed carefully:**
> **If Watch isn't running › Block** makes the agent refuse the action whenever Watch is closed or slow to answer. Use it only for rules where that's what you want.

## Allow something Guard stopped

When Guard stops something you meant to do, allow it from the event in the Activity tab or from **Recent decisions**:

- **Allow Once**: retry the same action in the agent within 10 minutes and it goes through. The event says **Allowed once: retry it in the agent within 10 minutes**.
- **Always Allow**: this exact action is always allowed from now on, listed under **Guard › Exceptions**.
- For redacted secrets, **Allow This Secret…** / **Allow These Secrets…** offers **Send unredacted from now on** (**They're test keys** or **It's a false positive**) or **Just once (I'll rotate it)**.

*[Screenshot: The Activity tab with a Bash rm -rf command that Guard asked about, and its detail showing the rule and Allow Once and Always Allow buttons]*

Exceptions are stored by a hash of the command or secret, never the raw value, in a file only you can read. Remove one from **Guard › Exceptions** to make the rule apply again.

## What agents see

When Guard blocks, the agent gets a message, for example `Cloak Watch blocked this: it reads ~/.ssh/id_ed25519 (rule: Block reading ~/.ssh).` Through the gateway, a blocked request returns an error starting `Cloak Watch blocked this request:`, and Claude Code adds: "Press Esc twice to go back and edit the message, or allow it in Cloak Watch."

## Related

  - [Connect your AI tools](https://docs.subcloak.com/cloak-watch/ai-activity/connections/): Guard works through hooks and the gateway.
  - [AI Activity](https://docs.subcloak.com/cloak-watch/ai-activity/): See every decision in the timeline.
  - [Security model and FAQ](https://docs.subcloak.com/cloak-watch/security-and-faq/): What Guard can't stop.