---
title: Guard
description: The Guard tab — live sessions ranked by spend at risk, detector incidents, Pause/Stop/Kill with honest per-session capability, and the policy decision log.
keywords: stop runaway AI agent, agent kill switch, agent loop detection, agent enforcement policy
eyebrow: Dashboard
---

# Guard

See what is running, spot the ones that have gone off track, and stop them.

## Sessions, ranked by money

The session list is ordered by **spend at risk** — the estimated cost of the
flagged stretch, not the whole session — rather than by severity.

That choice matters. Severity is a label; a fleet where everything is `warning`
gives you a list sorted by nothing. Money is a number you can act on, and the
session at the top is the one costing you the most right now.

Where no cost is known the value is `0.00` with a basis of `unknown`, never a
fabricated figure — sorting a list by an invented dollar number would be worse
than not sorting it.

A `warning` that crosses `CLAWMETRY_GUARD_CRITICAL_USD` (default `$5`) is
promoted to `critical`.

## Incidents

Each flagged session shows what the detector found, in plain words, with the
evidence behind it:

- **stuck_loop** — the same call, or a short repeating cycle, over and over
- **no_progress** — busy but not advancing: many tool calls, no file changes
- **repeated_tool_failure** — the same tool erroring repeatedly
- **action_discrepancy** — continued after a failed command without retrying or
  acknowledging it
- **file_blast_radius** — touching far more files than this cohort normally does
- **credential_access** — reading credential-shaped paths
- **network_egress** — talking to an unusual number of distinct hosts
- **privilege_change** — attempting a privilege escalation

Every incident carries a `threshold_source`, so you can tell a measured
threshold from a shipped constant. → [Detectors](/docs/guard/detectors/)

## The controls

Pause, Stop, Kill and Resume, per session.

| Action | What it does |
|---|---|
| **Pause** | Suspends the process. Resumable. |
| **Resume** | Continues a paused process. |
| **Stop** | Asks the process to stop cleanly — the equivalent of Ctrl-C. |
| **Kill** | Terminates the process tree, escalating if it does not go. |

These are the human path, and they are not entitlement-gated: you made the call.
They are origin-checked, because they signal real processes.

## Capability is answered per session

A control that cannot work says why, next to a disabled button. Three things
vary independently:

- **The OS.** POSIX uses signals; Windows uses its native equivalents. A Windows
  stop cannot be addressed to one process — it reaches the whole console — and
  the UI says so rather than pretending otherwise.
- **The runtime, per session.** A Cursor **CLI** session is a real process tree
  and is controllable. A Cursor **editor** conversation shares the one IDE
  process and is not. The answer is per session, not per runtime.
- **OpenClaw pause.** OpenClaw has no pause primitive. ClawMetry's pause is a
  flag file enforced only by the [enforcement proxy](/docs/guard/proxy/) — with
  no proxy running it is advisory, and the UI reports `advisory_only` rather
  than claiming the agent was held.

→ [Pause, stop, kill](/docs/guard/process-control/)

## Policies

The same actions, without a human present. A policy matches on detector kind,
severity, repeat count, duration and spend, and fires an action — optionally as
an escalation ladder (*pause now, kill in five minutes if still stuck*).

Every policy action passes three locks:

1. The action must not be `monitor` — which is the default for a new policy, and
   records what it *would* have done.
2. `CLAWMETRY_POLICY_ENFORCE=1` must be set on the node. One environment
   variable disables every policy.
3. An entitlement check that fails closed.

→ [Policies and escalation](/docs/guard/policies/)

## The decision log

Every evaluation is recorded, including dry runs. This is the page to read
before turning enforcement on: it tells you exactly what would have happened
over the last week.

```bash
curl -s localhost:8900/api/guard/actions | jq '.actions[:20]'
```

## Learned baselines

Thresholds adapt to your fleet. A cohort's own history sets what "unusual"
means, clamped to a band around the shipped default — so a cohort where
everything loops cannot teach Guard to go blind, and a cohort of three sessions
cannot make it scream.

```bash
curl -s localhost:8900/api/guard/baselines | jq
```

→ [Thresholds and baselines](/docs/guard/thresholds/)

## The API

```bash
curl -s localhost:8900/api/guard/sessions -X POST -d '{}' -H 'content-type: application/json' | jq
curl -s localhost:8900/api/guard/policies | jq
curl -s localhost:8900/api/guard/actions  | jq
```