AI Activity
Guard rules
Use Guard rules to redact secrets before they reach a model, and to block, ask or warn before an AI agent runs a risky command, reads a file or calls MCP.
Guard is the part of AI Activity that stops things. Its secrets rule keeps keys and tokens from reaching a model, and its tool rules block, ask or warn before an agent runs a command, reads or writes a file, calls an MCP server or fetches a domain. Guard only acts through tools you’ve connected with hooks or the gateway; with nothing connected, the Guard tab says No agent is connected, so these rules don’t stop anything yet.
The rules list
Section titled “The rules list”| Section | What’s in it |
|---|---|
| Secrets | The rule Secrets never leave this Mac. It’s on from the start, set to Redact. |
| Tool rules | Built-in rules you switch on, and your own. Add Rule offers templates by category and Custom Rule…. |
| Exceptions | What you allowed with Always Allow, each with Remove. |
| Recent decisions | What Guard blocked, asked about or redacted in the last days, each with Allow Once, Always Allow and Show in Activity. |
Each rule shows its action, where it applies, and who enforces it, for example Enforced in Claude Code and Cursor, or No connected agent enforces this yet.
Built-in rules
Section titled “Built-in rules”| Rule | Action | On at first |
|---|---|---|
| Secrets never leave this Mac | Redact | Yes |
| Ask before rm -rf outside the project | Ask | No |
| Block curl | sh | Block | No |
| Block reading ~/.ssh | Block | No |
| Block reading ~/.aws | Block | No |
| Block reading ~/.config/gh | Block | No |
| Ask before keychain commands | Ask | No |
| Ask before git push –force to main | Ask | No |
| Ask before publishing packages | Ask | No |
| Ask before writing outside the project | Ask | No |
| Block an MCP server… | Block | No, needs a server |
| Block a domain… | Block | No, needs a domain |
Actions
Section titled “Actions”| Action | In a tool rule | In the secrets rule |
|---|---|---|
| Block | The agent can’t run the tool call; it’s told why. | Stops the prompt or request. |
| Ask | The agent asks you first. Codex and Gemini CLI can’t ask, so Guard blocks there instead; Cursor can ask only before shell and MCP calls. | Not available |
| Warn | Allowed, and noted in the timeline. | Allowed, and noted. |
| Redact | Not available | Replaces each secret with [REDACTED: type] in requests through the gateway. Hooks can’t change a prompt, so in prompts Redact blocks instead. |
How the secrets rule works in practice:
- Through the gateway, Guard redacts secrets in what you and your tools wrote (prompts and tool results) before the request leaves your Mac. Secrets in
CLAUDE.md, the system prompt or tool definitions are flagged, not removed: remove them where they’re written. - Through Claude Code’s hooks, a prompt with a secret is stopped before it reaches the model, and secrets in a tool’s output are redacted before the model reads it.
- Through Cursor’s hooks, Guard also checks a file’s content before Cursor reads it.
Guard finds AWS, GitHub, Stripe, Slack, Anthropic, OpenAI, Google, npm and other keys and tokens, private keys, and .env values. It never stores a secret: only its type, a masked form and where it was.
Make or change a rule
Section titled “Make or change a rule”-
On the Guard tab, select a rule, or click Add Rule and pick a template or Custom Rule….
-
Fill in the editor:
Field Options Name What you’ll see in the list and the timeline What Shell command (a pattern), File path (a path pattern; Reads, Writes or both; Only outside the project / Anywhere outside the project), MCP server (and optionally one Tool), Web domain, or Tool name. For the secrets rule: Keys, tokens, private keys, .env values. Action Block, Ask or Warn for tool rules; Redact, Block or Warn for the secrets rule Where Agents (a checkbox each) and Projects (Every project or one) Message What the agent is told. It usually passes it on to you. If Watch isn’t running Let it through (the default) or Block Who enforces it lists each agent and whether it can enforce the rule.
-
Click Add Rule or Save. Revert discards your changes; Delete Rule removes a rule you made.
Allow something Guard stopped
Section titled “Allow something Guard stopped”When Guard stops something you meant to do, allow it from the event in the Activity tab or from Recent decisions:
- Allow Once: retry the same action in the agent within 10 minutes and it goes through. The event says Allowed once: retry it in the agent within 10 minutes.
- Always Allow: this exact action is always allowed from now on, listed under Guard › Exceptions.
- For redacted secrets, Allow This Secret… / Allow These Secrets… offers Send unredacted from now on (They’re test keys or It’s a false positive) or Just once (I’ll rotate it).
Exceptions are stored by a hash of the command or secret, never the raw value, in a file only you can read. Remove one from Guard › Exceptions to make the rule apply again.
What agents see
Section titled “What agents see”When Guard blocks, the agent gets a message, for example Cloak Watch blocked this: it reads ~/.ssh/id_ed25519 (rule: Block reading ~/.ssh). Through the gateway, a blocked request returns an error starting Cloak Watch blocked this request:, and Claude Code adds: “Press Esc twice to go back and edit the message, or allow it in Cloak Watch.”