---
title: "overlane guard dry-run"
description: "Report what the guardrails would decide for an action, without blocking or recording"
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.overlane.app/llms.txt
> Use this file to discover all available pages before exploring further.

# overlane guard dry-run

{/* Generated by apps/docs/scripts/generate.mjs (CLI pages from the command registry in packages/cli). Do not edit; run `pnpm --filter @overlane/docs gen`. */}

Asks the server for the combined decision (platform, team and project rules) and prints it without recording an audit entry or opening an approval. A rule in dry-run mode shows as would-block. An agent or a person sees exactly what a rule change would do before it is enforced.

## Usage

```sh
overlane guard dry-run --tool TOOL [--path PATH...] [--branch BRANCH] [--repo OWNER/NAME] [--environment NAME] [--host HOST] [--task held|none] [--summary TEXT] [--content-file PATH]
```

## Flags

| Flag | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `--tool` | string | yes |  | The action, for example git.push, deploy.run, egress.fetch or api.write |
| `--path` | string (repeatable) | no |  | A path the action touches; repeat for more |
| `--branch` | string | no |  | The branch the action targets |
| `--repo` | string | no |  | The repository the action targets |
| `--environment` | string | no |  | The environment, for example production |
| `--host` | string | no |  | The host, for an egress action |
| `--task` | one of `held`, `none` | no |  | Whether the caller holds an active task (the task rule needs it) |
| `--summary` | string | no |  | A plain-language summary shown to the approver if the action needs approval |
| `--content-file` | string | no |  | A file whose text the action would write; scanned for credentials |

## Examples

```sh
overlane guard dry-run --tool git.push --branch main --task held
overlane guard dry-run --tool egress.fetch --host registry.example.com --json
```

## Behavior

- Effect: `read` (changes nothing).
- Needs credentials: yes. Uses the network: yes.
- Supports `--dry-run`: no. Accepts `--force`: no.
- Machine-readable description: `overlane schema guard dry-run`.

## Result

With `--json` (the default when stdout is not a terminal) the command prints this JSON Schema's shape on stdout.

```json
{
  "type": "object",
  "properties": {
    "decision": {
      "type": "object",
      "properties": {
        "tenantId": {
          "type": "string",
          "minLength": 1,
          "maxLength": 128,
          "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]*$",
          "description": "tenant identifier"
        },
        "effect": {
          "type": "string",
          "enum": [
            "allow",
            "deny",
            "require_approval"
          ]
        },
        "allowed": {
          "type": "boolean"
        },
        "code": {
          "anyOf": [
            {
              "type": "string",
              "enum": [
                "policy_denied",
                "approval_required",
                "protected_branch",
                "path_protected",
                "spend_cap_reached",
                "plan_limit_reached",
                "egress_blocked",
                "deploy_blocked",
                "secret_detected",
                "task_required"
              ]
            },
            {
              "type": "null"
            }
          ]
        },
        "ruleId": {
          "type": [
            "string",
            "null"
          ]
        },
        "layer": {
          "anyOf": [
            {
              "type": "string",
              "enum": [
                "platform",
                "team",
                "project"
              ]
            },
            {
              "type": "null"
            }
          ]
        },
        "message": {
          "type": "string",
          "minLength": 1
        },
        "nextCommand": {
          "type": [
            "string",
            "null"
          ]
        },
        "exitCode": {
          "anyOf": [
            {
              "type": "number",
              "const": 0
            },
            {
              "type": "number",
              "const": 6
            }
          ]
        },
        "dryRun": {
          "type": "boolean"
        },
        "wouldBlock": {
          "type": "boolean"
        },
        "approvalId": {
          "type": "string"
        },
        "matched": {
          "type": "array",
          "items": {
            "type": "object",
            "properties": {
              "ruleId": {
                "type": "string",
                "minLength": 1
              },
              "layer": {
                "type": "string",
                "enum": [
                  "platform",
                  "team",
                  "project"
                ]
              },
              "effect": {
                "type": "string",
                "enum": [
                  "allow",
                  "deny",
                  "require_approval"
                ]
              },
              "dryRun": {
                "type": "boolean"
              }
            },
            "required": [
              "ruleId",
              "layer",
              "effect",
              "dryRun"
            ],
            "additionalProperties": false
          }
        }
      },
      "required": [
        "tenantId",
        "effect",
        "allowed",
        "code",
        "ruleId",
        "layer",
        "message",
        "nextCommand",
        "exitCode",
        "dryRun",
        "wouldBlock",
        "matched"
      ],
      "additionalProperties": false
    },
    "secrets": {
      "anyOf": [
        {
          "type": "object",
          "properties": {
            "tenantId": {
              "type": "string",
              "minLength": 1,
              "maxLength": 128,
              "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]*$",
              "description": "tenant identifier"
            },
            "blocked": {
              "type": "boolean"
            },
            "findings": {
              "type": "array",
              "items": {
                "type": "object",
                "properties": {
                  "tenantId": {
                    "type": "string",
                    "minLength": 1,
                    "maxLength": 128,
                    "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]*$",
                    "description": "tenant identifier"
                  },
                  "source": {
                    "type": "string",
                    "enum": [
                      "push",
                      "task",
                      "evidence",
                      "log",
                      "memory",
                      "api"
                    ]
                  },
                  "rule": {
                    "type": "string",
                    "minLength": 1
                  },
                  "disposition": {
                    "type": "string",
                    "enum": [
                      "blocked",
                      "reported"
                    ]
                  },
                  "path": {
                    "type": "string"
                  },
                  "line": {
                    "type": "integer",
                    "exclusiveMinimum": 0,
                    "maximum": 9007199254740991
                  }
                },
                "required": [
                  "tenantId",
                  "source",
                  "rule",
                  "disposition"
                ],
                "additionalProperties": false
              }
            }
          },
          "required": [
            "tenantId",
            "blocked",
            "findings"
          ],
          "additionalProperties": false
        },
        {
          "type": "null"
        }
      ]
    }
  },
  "required": [
    "decision",
    "secrets"
  ],
  "additionalProperties": false
}
```

See [exit codes](/cli/#exit-codes) for the status the process returns.

Source: https://docs.overlane.app/cli/guard-dry-run/index.mdx