Verify Federated Guardrails Delivery Evidence

Verify Federated Guardrails delivery after approval.

Before You Begin

Complete these prerequisites before verifying Guardrails delivery:

• Prepare the policy identifier and current governed revision.
• Ask the Guardrails administrator whether retrieval uses anonymous compatibility or a named consumer account.
• Confirm the deployment’s apiService.environment.GUARDRAILS_CONSUMER_USERNAME value with its configuration owner.
• Arrange an operator with policy:audit to inspect restricted Operations details.

A receipt records that consumer’s retrieval of the generated configuration. It does not confirm that Guardrails has started applying the configuration to requests.

The chart maps this value through the API ConfigMap into the consumer-username environment variable. The empty-string default accepts only requests with absent or empty identity. A nonempty value requires an exact gateway-verified username match. See consumer evidence and configuration for supported settings. Neither publication nor an ineligible retrieval proves receipt completion.

Inspect Publication and Receipt

To verify publication and the consumer receipt, follow these steps:

1. Open the policy in Policy Library.
2. Record the currently approved policy version and displayed protection status.
3. Have the authorized operator check the latest publication request in Operations for errors.
4. Ask the Guardrails administrator to confirm a successful fetch using the configured identity mode.
5. Reload the policy and check its protection status. Publication reaches Published. Publication plus qualifying receipt allows reconciliation to Enforced for a Guardrails-only policy.
6. If the policy remains Published after a successful fetch, send the policy version, operation details, and retrieval time to your deployment or support owner.

A successful fetch must include the current policy version. Guardrails can retrieve one combined configuration containing several policies. An older configuration or one containing a different version of this policy does not confirm current delivery.

Use the application programming interface (API) retrieval reference and authentication for consumer retrieval contracts. An eligible retrieval can record receipt on either a full 200 response or an unchanged 304 response. Eligibility requires the configured identity mode: absent or empty identity for the empty-string default, or an exact gateway-verified named match. Named requests do not qualify under the empty-string default. Receipts must match current publication targets and checksums, or exact current contributor lineage in a newer aggregate. Follow approved gateway access rules and keep named consumer credentials separate. Never supply trusted identity headers yourself.

Without a qualifying pull, a published Guardrails-only deployment remains Published. With publication and qualifying receipt, it can reach Enforced. For mixed deployments, also complete Data evidence.

Understand the Evidence Boundary

A receipt confirms retrieval, not successful processing of real requests. Ask the Guardrails administrator to perform the deployment’s runtime test after retrieval. If several Guardrails replicas run, confirm their configuration through Guardrails monitoring. Policy’s receipt does not verify each replica.

For example, retrieving a combined configuration containing policy version 2 does not verify delivery of version 3. Background recompilation can also change the generated configuration without changing the approved major version. When investigating a mismatch, give the administrator the full version, including its compilation minor, and the retrieval timestamp.

Stop and Escalate

Stop when publication failed, the consumer identity is uncertain, or receipt evidence mismatches. If the retrieval identity does not match the configured mode, ask the configuration owner to correct the mismatch. Approval retries cannot repair an identity mismatch. Retain the policy, revision, generation, timestamp, and visible support reference. Ask the Guardrails administrator to include the retrieved product response’s fingerprint when available. The retrieval reference describes this aggregate-output field. Do not infer it from the policy title or revision. Ask your Policy administrator to compare the recorded retrieval with the policy’s current generated configuration. Do not retry approval merely because the consumer has not fetched the output.

For failed retained work, follow delivery issues. For ongoing recompilation, see automatic recompilation.