Gateway

Reason codes

Reference for the reason codes attached to gateway decisions.

Reason codes explain gateway decisions and operational outcomes. They can appear on a trace summary, guard or action card, or span. Trace-level codes roll up into the Overview “Top reason codes” list. This is a reference for the ones you’ll commonly see.

About reason codes#

A single decision can carry several codes. They’re stable string identifiers, so you can alert or filter on them. The input and tool classifiers are enabled by default, so their codes are the ones a new project sees first.

Input guard#

Reason code	Meaning
`INPUT_GUARD_UNSAFE`	Input scored at or above the unsafe threshold.
`INPUT_GUARD_FLAGGED`	Input scored in the flagged band.
`INPUT_GUARD_FLAGGED_NO_SCORE`	The input was labeled suspicious without a numeric score, so it was flagged rather than treated as safe.
`INPUT_GUARD_FLAGGED_UNKNOWN_LABEL`	An unrecognized label scored at or above the unsafe threshold but was downgraded to flagged; unknown labels cannot trigger an unsafe block.
`INPUT_GUARD_ERROR`	The input classifier errored; resolved by the fail-open setting.
`CUSTOM_BLOCKLIST_MATCH`	A configured literal term matched the latest user request. Enforce blocks before the provider call; Observe records the simulated block.

Tool guard#

Reason code	Meaning
`TOOL_GUARD_UNSAFE`	A tool call scored at or above the unsafe threshold.
`TOOL_GUARD_FLAGGED`	A tool call scored in the flagged band.
`TOOL_GUARD_ERROR`	The tool classifier errored; resolved by the fail-open setting.

Output guard#

Reason code	Meaning
`OUTPUT_GUARD_UNSAFE`	Output scored at or above the unsafe threshold.
`OUTPUT_GUARD_FLAGGED`	Output scored in the flagged band.
`OUTPUT_GUARD_UNSAFE_NO_SCORE`	Labeled unsafe without a numeric score.
`OUTPUT_GUARD_FLAGGED_NO_SCORE`	Labeled flagged without a numeric score.
`OUTPUT_GUARD_FLAGGED_UNKNOWN_LABEL`	An unrecognized label scored at or above the unsafe threshold but was downgraded to flagged; unknown labels cannot trigger an unsafe block.
`OUTPUT_GUARD_ERROR`	The output classifier errored; resolved by the fail-open setting.

Decision fallbacks#

The decision normally retains reason codes returned by each guard. The codes below are fallbacks used only when the relevant guard supplied no reason code.

Reason code	Meaning
`POLICY_BLOCK_UNSAFE`	Fallback when a classifier returned unsafe and supplied no reason code.
`GUARD_ERROR_FAIL_OPEN_ALLOW`	Fallback when a classifier errored, the aggregate decision had no reason code, and fail-open allowed it.
`GUARD_ERROR_FAIL_CLOSED_BLOCK`	Fallback when a classifier errored, the aggregate decision had no reason code, and fail-open was off.

Request errors#

Reason code	Meaning
`PROVIDER_AUTH_REQUIRED`	No upstream provider key was supplied in Authorization.
`PROVIDER_UNSUPPORTED`	x-triage-provider is not a supported value.
`UPSTREAM_CONFIG_REQUIRED`	A non-default provider hint requires a matching stored project upstream.
`UPSTREAM_PROVIDER_MISMATCH`	x-triage-provider did not match the project's configured upstream.
`UPSTREAM_CONFIG_INVALID`	The project's stored upstream configuration is invalid (HTTP 422).
`ANTHROPIC_SERVER_TOOL_UNSUPPORTED`	Enforce rejected an Anthropic provider-side tool before the upstream call because it cannot be intercepted post-response.
`MODEL_REQUIRED`	The request did not specify a model.
`STREAMING_DISABLED_POLICY`	Streaming requested but disabled for the project (HTTP 501).

Context & tool handling#

Reason code	Meaning
`CONTEXT_SPLICE_REMEDIATED_INPUT`	The latest input was safely rewritten or replaced, so the effective pre-provider verdict was remediated.
`CONTEXT_SPLICE_UNLOCALIZED_INPUT_QUARANTINED`	The unsafe latest turn had no usable safe span and was quarantined as a whole.
`CONTEXT_SPLICE_NONACTIONABLE_INPUT_QUARANTINED`	Localized removal left no meaningful task, so the latest turn was quarantined as a whole.
`CONTEXT_SPLICE_CONTINUATION_BRIDGE`	A safe continuation turn replaced quarantined input because prior workflow context was available.
`CONTEXT_SPLICE_NO_WORKFLOW_CONTEXT`	Whole-turn continuation was not eligible because no prior Chat or Responses workflow context was present; Enforce blocks before the provider call.
`CONTEXT_SPLICE_BLOCKLIST_TERMINAL`	A custom-blocklist match remained authoritative and was not eligible for splicing.
`CONTEXT_SPLICE_DISABLED_POLICY`	Context splicing was disabled when unsafe input was evaluated, so no steering mutation was attempted.
`CONTEXT_SPLICE_UNSALVAGEABLE_INPUT`	No safe localized remediation or eligible whole-turn continuation was available; blocked in Enforce.
`CONTEXT_SPLICE_TOOL_RESULT_WITHHELD`	A Chat tool message matched a deterministic instruction-hijacking pattern and was withheld by context splicing.
`TOOL_RESULT_QUARANTINE_UNSAFE`	An inbound tool result was classified unsafe.
`TOOL_RESULT_QUARANTINE_FLAGGED`	An inbound tool result was classified as flagged.
`TOOL_RESULT_QUARANTINE_WITHHELD`	Unsafe tool-result content, or flagged content when configured, was replaced before the model saw it (Enforce).
`TOOL_RESULT_QUARANTINE_FAIL_CLOSED_BLOCK`	A tool result could not be verified and the project fails closed.
`TOOL_RESULT_QUARANTINE_REVIEW_LIMIT_EXCEEDED`	More tool results were present than the configured review window; Enforce fails closed instead of forwarding an unreviewed older result.
`TOOL_POLICY_ARGUMENTS_SANITIZED`	Disallowed or sensitive tool arguments were removed or redacted before delivery (Enforce).
`TOOL_POLICY_SANITIZE_MUTATION_FAILED`	A requested tool-argument rewrite could not be applied to its exact response target, so delivery was blocked (Enforce).
`TOOL_INTERCEPTION_STRIPPED`	Tool calls denied by classifier or retry-without-tool policy were removed; any safe remainder was returned (Enforce).
`TOOL_INTERCEPTION_RETRY`	The request was retried after a tool-interception decision.

Transport & streaming#

These annotate provider transport and downstream delivery failures. The stream-specific codes are most visible in Observe mode, where content passes through and guards run after delivery.

Reason code	Meaning
`UPSTREAM_STREAM_INCOMPLETE`	The provider stream ended without a terminal done marker.
`UPSTREAM_TRANSPORT_ERROR`	The upstream provider request or stream failed at the transport layer.
`EDGE_RESPONSE_DEADLINE_EXCEEDED`	The gateway cancelled in-flight work and returned HTTP 504 because it could not start a response within the edge-safe deadline.
`DOWNSTREAM_SEND_ERROR`	The gateway could not deliver a response or stream frame to the downstream client.
`POST_RESPONSE_GUARD_ERROR`	A guard failed while classifying already-delivered streamed content.

CoT integrity#

INT-CoT returns at most a flagged advisory result and never blocks on its own. A material, rising result can escalate an already-flagged tool or output result; that action-layer decision then follows normal retry and block policy.

Reason code	Meaning
`COT_INTEGRITY_DIVERGENCE`	Reasoning-divergence score reached the selected static threshold.
`COT_INTEGRITY_RISING`	Divergence risk was still climbing across chunks when flagged.
`COT_INTEGRITY_WEAK_DIVERGENCE`	Score in the soft band below the threshold.
`COT_INTEGRITY_DISABLED_POLICY`	INT-CoT is disabled for the project.
`COT_INTEGRITY_NO_REASONING`	No reasoning trace or summary was available to score.
`COT_INTEGRITY_URL_NOT_CONFIGURED`	The CoT service was not discoverable. The request still proceeds.
`COT_INTEGRITY_ERROR`	The CoT service failed; the gateway skipped this layer fail-open.
`COT_INTEGRITY_CONJUNCTION_ESCALATED`	Material, rising divergence escalated an already-flagged tool or output result to unsafe.