Trait Guard 

pub trait Guard: Send + Sync {
    // Required methods
    fn name(&self) -> &str;
    fn evaluate(&self, ctx: &GuardContext<'_>) -> Result<Verdict, KernelError>;
}

A policy guard that the kernel evaluates before forwarding a tool call.

Guards are the same concept as ClawdStrike’s Guard trait, adapted for the Chio tool-call context. Each guard inspects the request and returns a verdict.

Required Methods

fn name(&self) -> &str

Human-readable guard name (e.g., “forbidden-path”).

fn evaluate(&self, ctx: &GuardContext<'_>) -> Result<Verdict, KernelError>

Evaluate the guard against a tool call request.

Returns Ok(Verdict::Allow) to pass, Ok(Verdict::Deny) to block, or Err on internal failure (which the kernel treats as deny).

Implementors