// enforcement
Block bad actions before they run
A pre-call decision engine that decides allow, block, or hold for an agent action before it executes, so runaway loops and budget blow-outs are stopped at the source, not diagnosed after the fact.
Pre-call gate
Before a model or tool call executes, a single check returns allow, block, or hold, the action only proceeds if the policy permits it.
Fails safe
Enforcement is treated like billing and auth: if a decision can't be made, the action is blocked rather than allowed through.
Ceilings, loop breakers, debounce
Cap spend per run, break repeated identical actions, and debounce rapid duplicate calls, individually or combined into one policy.
Hold for approval
High-risk actions can be parked in an approval queue instead of blocked outright, with versioned policies so every change is auditable.
Drop-in gateway
Route model calls through a provider-compatible gateway to enforce policy without changing your client, and your provider key is never stored or logged.
Offline SDK ceilings
The SDK enforces local per-run step, token, and spend ceilings with zero network calls, raising a typed RetraceEnforcementError instead of silently skipping work.
from retrace import RetraceEnforcementError
try:
run_agent(prompt)
except RetraceEnforcementError as e:
# e.verdict is "block" or "hold"
print("stopped by enforcement:", e.verdict)A blocked or held action stops the call with a typed error.
POST /api/v1/enforcement/check
{
"run_id": "run_123",
"tool_name": "send_email",
"proposed_usd": 0.20
}
ā { "verdict": "allow" | "block" | "hold" }Or ask the gate directly before running any action.
REST API
- POST /api/v1/enforcement/check: allow / block / hold decision
More of the platform