---
title: "overlane guard check"
description: "Ask the server to decide an action now; exits 6 when it is refused"
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.overlane.app/llms.txt
> Use this file to discover all available pages before exploring further.

# overlane guard check

{/* Generated by apps/docs/scripts/generate.mjs (CLI pages from the command registry in packages/cli). Do not edit; run `pnpm --filter @overlane/docs gen`. */}

The hook point for the git layer and CI: sends the action to the guardrail engine and exits 0 when allowed, or 6 with the code, the rule ID and the exact next command. An action that needs approval opens one with your summary and prints its ID; run it again with --approval \<id\> once an independent agent or a person has approved it.

## Usage

```sh
overlane guard check --tool TOOL [--path PATH...] [--branch BRANCH] [--repo OWNER/NAME] [--environment NAME] [--host HOST] [--task held|none] [--summary TEXT] [--content-file PATH] [--approval ID] [--dry-run]
```

## Flags

| Flag | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `--tool` | string | yes |  | The action, for example git.push, deploy.run, egress.fetch or api.write |
| `--path` | string (repeatable) | no |  | A path the action touches; repeat for more |
| `--branch` | string | no |  | The branch the action targets |
| `--repo` | string | no |  | The repository the action targets |
| `--environment` | string | no |  | The environment, for example production |
| `--host` | string | no |  | The host, for an egress action |
| `--task` | one of `held`, `none` | no |  | Whether the caller holds an active task (the task rule needs it) |
| `--summary` | string | no |  | A plain-language summary shown to the approver if the action needs approval |
| `--content-file` | string | no |  | A file whose text the action would write; scanned for credentials |
| `--approval` | string | no |  | An approval that covers exactly this action |
| `--dry-run` | boolean | no |  | Print the requests and file changes this command would make, then stop. Needs no credentials. |

## Examples

```sh
overlane guard check --tool git.push --branch main --task held
overlane guard check --tool deploy.run --environment production --summary "Deploy build 42" --dry-run
```

## Behavior

- Effect: `write` (changes local or hosted state).
- Needs credentials: yes. Uses the network: yes.
- Supports `--dry-run`: yes. Accepts `--force`: no.
- Machine-readable description: `overlane schema guard check`.

## Result

With `--json` (the default when stdout is not a terminal) the command prints this JSON Schema's shape on stdout.

```json
{
  "anyOf": [
    {
      "type": "object",
      "properties": {
        "decision": {
          "type": "object",
          "properties": {
            "tenantId": {
              "type": "string",
              "minLength": 1,
              "maxLength": 128,
              "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]*$",
              "description": "tenant identifier"
            },
            "effect": {
              "type": "string",
              "enum": [
                "allow",
                "deny",
                "require_approval"
              ]
            },
            "allowed": {
              "type": "boolean"
            },
            "code": {
              "anyOf": [
                {
                  "type": "string",
                  "enum": [
                    "policy_denied",
                    "approval_required",
                    "protected_branch",
                    "path_protected",
                    "spend_cap_reached",
                    "plan_limit_reached",
                    "egress_blocked",
                    "deploy_blocked",
                    "secret_detected",
                    "task_required"
                  ]
                },
                {
                  "type": "null"
                }
              ]
            },
            "ruleId": {
              "type": [
                "string",
                "null"
              ]
            },
            "layer": {
              "anyOf": [
                {
                  "type": "string",
                  "enum": [
                    "platform",
                    "team",
                    "project"
                  ]
                },
                {
                  "type": "null"
                }
              ]
            },
            "message": {
              "type": "string",
              "minLength": 1
            },
            "nextCommand": {
              "type": [
                "string",
                "null"
              ]
            },
            "exitCode": {
              "anyOf": [
                {
                  "type": "number",
                  "const": 0
                },
                {
                  "type": "number",
                  "const": 6
                }
              ]
            },
            "dryRun": {
              "type": "boolean"
            },
            "wouldBlock": {
              "type": "boolean"
            },
            "approvalId": {
              "type": "string"
            },
            "matched": {
              "type": "array",
              "items": {
                "type": "object",
                "properties": {
                  "ruleId": {
                    "type": "string",
                    "minLength": 1
                  },
                  "layer": {
                    "type": "string",
                    "enum": [
                      "platform",
                      "team",
                      "project"
                    ]
                  },
                  "effect": {
                    "type": "string",
                    "enum": [
                      "allow",
                      "deny",
                      "require_approval"
                    ]
                  },
                  "dryRun": {
                    "type": "boolean"
                  }
                },
                "required": [
                  "ruleId",
                  "layer",
                  "effect",
                  "dryRun"
                ],
                "additionalProperties": false
              }
            }
          },
          "required": [
            "tenantId",
            "effect",
            "allowed",
            "code",
            "ruleId",
            "layer",
            "message",
            "nextCommand",
            "exitCode",
            "dryRun",
            "wouldBlock",
            "matched"
          ],
          "additionalProperties": false
        },
        "secrets": {
          "anyOf": [
            {
              "type": "object",
              "properties": {
                "tenantId": {
                  "type": "string",
                  "minLength": 1,
                  "maxLength": 128,
                  "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]*$",
                  "description": "tenant identifier"
                },
                "blocked": {
                  "type": "boolean"
                },
                "findings": {
                  "type": "array",
                  "items": {
                    "type": "object",
                    "properties": {
                      "tenantId": {
                        "type": "string",
                        "minLength": 1,
                        "maxLength": 128,
                        "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]*$",
                        "description": "tenant identifier"
                      },
                      "source": {
                        "type": "string",
                        "enum": [
                          "push",
                          "task",
                          "evidence",
                          "log",
                          "memory",
                          "api"
                        ]
                      },
                      "rule": {
                        "type": "string",
                        "minLength": 1
                      },
                      "disposition": {
                        "type": "string",
                        "enum": [
                          "blocked",
                          "reported"
                        ]
                      },
                      "path": {
                        "type": "string"
                      },
                      "line": {
                        "type": "integer",
                        "exclusiveMinimum": 0,
                        "maximum": 9007199254740991
                      }
                    },
                    "required": [
                      "tenantId",
                      "source",
                      "rule",
                      "disposition"
                    ],
                    "additionalProperties": false
                  }
                }
              },
              "required": [
                "tenantId",
                "blocked",
                "findings"
              ],
              "additionalProperties": false
            },
            {
              "type": "null"
            }
          ]
        }
      },
      "required": [
        "decision",
        "secrets"
      ],
      "additionalProperties": false
    },
    {
      "type": "object",
      "properties": {
        "dryRun": {
          "type": "boolean",
          "const": true
        },
        "service": {
          "type": "string"
        },
        "requests": {
          "type": "array",
          "items": {
            "type": "object",
            "properties": {
              "method": {
                "type": "string"
              },
              "path": {
                "type": "string"
              },
              "body": {},
              "note": {
                "type": "string"
              }
            },
            "required": [
              "method",
              "path"
            ],
            "additionalProperties": false
          }
        },
        "commands": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "writes": {
          "type": "array",
          "items": {
            "type": "object",
            "properties": {
              "path": {
                "type": "string"
              },
              "action": {
                "type": "string",
                "enum": [
                  "write",
                  "append",
                  "delete"
                ]
              },
              "description": {
                "type": "string"
              }
            },
            "required": [
              "path",
              "action",
              "description"
            ],
            "additionalProperties": false
          }
        },
        "notes": {
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      },
      "required": [
        "dryRun",
        "requests",
        "commands",
        "writes",
        "notes"
      ],
      "additionalProperties": false
    }
  ]
}
```

See [exit codes](/cli/#exit-codes) for the status the process returns.

Source: https://docs.overlane.app/cli/guard-check/index.mdx