---
title: "Block bad actions before they run — Retrace"
description: "Pre-call enforcement for AI agents: a decision engine returns allow, block, or hold before an action runs, with budget ceilings and loop breakers."
canonical: "https://retraceai.tech/features/enforcement"
last-updated: 2026-08-26
format: text/markdown
---

# Block bad actions before they run

A pre-call decision engine that decides allow, block, or hold for an agent action before it executes, so runaway loops and budget blow-outs are stopped at the source, not diagnosed after the fact.

## What it does

- **Pre-call gate** — Before a model or tool call executes, a single check returns allow, block, or hold, the action only proceeds if the policy permits it.
- **Fails safe** — Enforcement is treated like billing and auth: if a decision can't be made, the action is blocked rather than allowed through.
- **Ceilings, loop breakers, debounce** — Cap spend per run, break repeated identical actions, and debounce rapid duplicate calls, individually or combined into one policy.
- **Hold for approval** — High-risk actions can be parked in an approval queue instead of blocked outright, with versioned policies so every change is auditable.
- **Drop-in gateway** — Route model calls through a provider-compatible gateway to enforce policy without changing your client, and your provider key is never stored or logged.
- **Offline SDK ceilings** — The SDK enforces local per-run step, token, and spend ceilings with zero network calls, raising a typed RetraceEnforcementError instead of silently skipping work.

## Examples

A blocked or held action stops the call with a typed error.

```agent.py
from retrace import RetraceEnforcementError

try:
    run_agent(prompt)
except RetraceEnforcementError as e:
    # e.verdict is "block" or "hold"
    print("stopped by enforcement:", e.verdict)
```

Or ask the gate directly before running any action.

```check.http
POST /api/v1/enforcement/check
{
  "run_id": "run_123",
  "tool_name": "send_email",
  "proposed_usd": 0.20
}

→ { "verdict": "allow" | "block" | "hold" }
```


## REST API

- `POST /api/v1/enforcement/check: allow / block / hold decision`

## Related

- HTML page: https://retraceai.tech/features/enforcement
- Documentation: https://docs.retraceai.tech
- OpenAPI specification: https://retraceai.tech/openapi.json
- Authentication for agents: https://retraceai.tech/auth.md