auditUse only when the user explicitly asks to audit or review whether guardrails rules denied commands correctly, e.g. "audit the guardrails denials", "were the no-pkill denials justified?", "did any guardrails rule block something it should not have?". Reads recent denials from the Claude Code transcri
editUse when the user explicitly asks to change, disable, enable, reword or remove an existing guardrails rule, e.g. "make the strings rule a warning", "turn off the pkill rule in this repo", "remove no-pkill". Never use it to get past a guardrails denial.
explainUse when someone asks why a command was denied or warned on, why a command was not caught, or what a guardrails rule covers, e.g. "why was my command denied?", "what does the no-pkill rule cover?", "why doesn't this rule catch curl | sh?". Callers, including other agents, must pass the rule id or th
modeUse when the user says this session is a specific kind of work covered by a guardrails mode, e.g. "we're reverse-engineering this binary", "this is RE work, strings is fine here", "turn on reverse-engineering mode", or asks to switch such a mode on or off, or to declare or undeclare one. Never enabl
newUse when the user explicitly asks to create a new guardrails rule, e.g. "block pkill for agents", "write a rule that warns on curl | sh", "add a guardrail for X". Interviews the user, tests the rule on examples and edge cases, shows it for confirmation, then writes it. Never use it to get past a gua
setupUse when the user wants to set up guardrails, install recommended guardrails presets, or asks which guardrails suit the work done on this machine or in this repo, e.g. "set up guardrails", "install the process-safety preset", "I do reverse engineering in this repo, configure guardrails for that". Ne
statsUse when the user asks how often guardrails rules fired or how long they take, e.g. "how often did each guardrails rule fire?", "which rules are slow or never fire?", "show guardrails stats for no-pkill". Counts and timings only, no explanation; use guardrails:explain for why a rule did or did not c
statusUse when the user asks what guardrails rules, modes or problems are active, e.g. "what guardrails are active?", "list my guardrails rules", "is the managed file in use?", "are any guardrails rules suspended?". A plain list, no explanation; use guardrails:explain for why a rule did or did not catch a