A streaming response leaves the process in pieces while the model is still producing it. A check that waits for the last token has nothing left to prevent, because the earlier pieces already reached the caller.
Akka Verify runs guardrails inline at the agent-response boundary. The runtime groups tokens into a unit the guardrail can evaluate and releases that unit after the verdict returns.
A response returned whole is one object. The check reads all of it, returns a verdict, and the runtime emits the response or refuses it. Nothing has reached the caller while the check runs.
Streaming emits the answer in pieces as the model produces them, which is what makes the first word appear in a few hundred milliseconds. Each piece that leaves the process is read by the caller, and no protocol recalls it.
An inline check on a stream therefore runs repeatedly. The runtime accumulates output until there is enough content for a verdict, applies the guardrail to that content, and releases it once the verdict is PASS.
The perceived speed of a streaming response is the time to its first word. A guardrail that evaluates larger units returns stronger verdicts and pushes that first word later. Unit size is the setting that governs both.
Compliance owns the policy matrix that decides which controls run inline. A control that must prevent an outcome runs in the path and pays that latency. A control whose obligation is evidence runs against the interaction log after the response completes. The inline control and the after-the-fact control write to the same interaction record.
The caller has received the units that passed and then receives a termination carrying the reason. The refusal, the policy that produced it and the content held back are written to the interaction record in the same transaction.
A required production guardrail fails closed, so an error or a timeout stops the content from being emitted. A check that failed open would stop enforcing under the load that makes enforcement matter.
Guardrails run at the tool boundary, the LLM boundary and the agent-response boundary. A check on the input stops a request before it reaches the model and before it consumes tokens.
The tool call is held at its own boundary and receives its own verdict. The runtime gates the call, so the record shows whether the tool executed.
