Guardrails on computers
Guardrails are rules you set once on the server, and SpanDock enforces them on each person's computer: "no email addresses in prompts", "confirm before sending a customer ID", "no card numbers in tool calls". The matching runs on the computer itself, so prompt text never leaves it to be checked.
Guardrails on computers are on the Enterprise plan, and in the 30-day trial. Redaction of prompts and tool contents at the source is in every plan.
What a guardrail looks for
| Detector | Finds |
|---|---|
| Secrets | API keys, tokens, private keys, credentials in URLs and passwords |
| Email addresses | Email addresses |
| Phone numbers | Phone numbers |
| Card numbers | Card numbers, checked with the Luhn algorithm, so order numbers aren't taken for cards |
| IBANs | Bank account numbers in IBAN form, with their check digits verified |
| National IDs | US Social Security numbers and UK National Insurance numbers |
| Words | A list of words, such as project code names |
| Your own pattern | A regular expression, for anything else, such as your customer IDs |
Each guardrail says where to look (what the person typed, the arguments of tool calls, or tool results) and who it applies to (user types, groups or people; everyone if you name none).
What it does
- Block: the prompt or tool call is refused, with your message.
- Warn: it goes through, with a note to the person and to the model, and it is flagged.
- Confirm: the person confirms first, and it is flagged for review.
- Redact: the matching text is removed where it can be; otherwise the call is refused.
You also choose what happens when SpanDock can't check, for example if it isn't running: let it through (the default) or block.
Where it is enforced
- Claude Code, Codex and Gemini CLI: SpanDock installs a hook in each, which checks the prompt and every tool call before it runs.
- MCP tool calls through the MCP gateway: arguments and results, for every AI tool that uses it, including chat apps such as Claude Desktop.
What can't be checked: messages typed into chat apps such as Claude Desktop or ChatGPT, which go straight to their provider, and the prompts of tools without hooks (such as Cursor or Windsurf). Their MCP calls through the gateway are covered.
If a person removes the hook from their own settings, SpanDock puts it back within a minute, and the server shows it meanwhile. Computers keep enforcing their guardrails while the server is unreachable.
Turn them on
- On the server's dashboard, open Safety & compliance → Guardrails → Rules and click Add a guardrail: choose what to detect, where, for whom, and what to do.
- On Guardrails → On computers, turn on Enforce on every computer, or turn it on for single computers on the Computers page.
- Start a new session in Claude Code, Codex or Gemini CLI: they load hooks when a session starts.
A guardrail reaches every computer within a minute. On computers shows each computer's state and which tools have the hook. Rules suggested from your company policies (see MCP gateway) can become guardrails too.
What is recorded
Every match is recorded as an event: the guardrail, the action and the outcome, the detector, the tool and the computer. Never the prompt, the arguments or the result. If you turn on Event samples, an event also keeps a masked sample, such as j***@e***.org.
The Events tab filters events by guardrail, action, outcome, computer and tool, and flags confirmed ones for review. While guardrails are on, each computer's SpanDock shows a notice saying what is checked.
If the license lapses
Guardrails keep working. The license is needed only to add or change them; turning one off never needs it.