docs(guardrails): describe streaming and actions as the gateway runs them

[nik13]

Summary

The guardrail pages described two things differently from how the gateway behaves:

1. Streaming. The pages said post-stage guardrails check a streamed response before it reaches the caller, and stop the stream when they block. In the gateway, only rules in the gateway's own config file with guardrails.streaming.enabled check a stream while it is generated, and only on /v1/chat/completions. Every other post-stage check, including those set up in the dashboard, runs once after the stream has been delivered, sees the text only when the gateway records bodies, and can't stop anything already sent.
2. Mask. The pages listed Mask as a fourth guardrail action. The gateway runs Mask as Log. Masking PII is the PII check's own remediation setting.

Every statement was checked against the gateway source. The streaming behaviour is the same on the gateway's main and in release v1.43.3, so these pages can merge now.

Related: future-agi/future-agi#3237 removes Mask from the dashboard's action list. The Mask wording here holds before and after it ships. future-agi/future-agi#3233 adds per-check stages for dashboard guardrails; these pages describe stages generically and will need an update when it ships.

What changed

• Command Center → Guardrails (command-center/features/guardrails.mdx): the Streaming Guardrails section now says what each stage does to a stream:

  • pre-stage checks run before the stream starts;
  • config.yaml post rules can act while a stream is generated when guardrails.streaming.enabled is on, with check_interval and failure_action;
  • other post-stage checks run once after delivery.

  It also says headers can't change once a stream starts, and that dashboard and SDK rules always run synchronously.

• Command Center → Streaming (command-center/features/streaming.mdx): the guardrails paragraph and its Next Steps card, which now links to the streaming section.

• Command Center → API reference (command-center/concepts/api-reference.mdx): the streaming guardrail note.

• Protect (protect/index.mdx, protect/concepts/understanding-protect.mdx, protect/reference/guardrail-checks.mdx, protect/troubleshooting/guardrail-fires-on-the-wrong-requests.mdx):

  • the actions are Block, Warn and Log;
  • a saved Mask runs as Log, and masking PII is the PII check's remediation;
  • the post stage on a streamed response runs after it has been sent.

Checks

• node scripts/audit-links.mjs: 0 broken nav links, 0 broken content links. The orphan-page warnings were already on main.
• node scripts/check-deleted-pages.mjs main: no pages deleted.
• npx astro build: every page compiled.
• git diff --check: clean.

🤖 Generated with Claude Code