Every broken rule gets one of three responses: Taste rules nudge unless an editor set another response; compliance rules respond as written. See Rules & scope.

​
A stop

A stopped call is answered by the guard with isError: true under the call’s id. The app never sees the call.
An ask-first rule is held the same way (never run), but opens with “Claros held this action: a rule your team set says to ask first.” and its Next line says who to ask. The — <owner>'s rule, from <where> tail says whose rule it is and where it came from: a Slack thread, a PR review, an issue thread, a policy doc, a rule they added, their answers (recorded by voice), their past decisions, a report that a check was wrong, or a correction to an agent (the rule version’s source, see Rules).

​
Asks

An ask opens a question to the rule’s owner in Claros (see Asks and approvals). The guard waits for the answer, up to --ask-wait seconds (default 120; 0 answers the hold at once, naming the decision URL): Your MCP client must allow a tool call to take that long; lower --ask-wait if it times out sooner. A rule from a written policy is quoted from the document instead:
Browser agents get the same text: Playwright throws ClarosStop, browser-use returns it as the action’s error.

​
Parallel calls, retries and long-running jobs

  • Parallel tool calls are each checked on their own: the guard checks every tools/call as it comes, and coding agents run the hook once per tool call (tool_use_id ties each check to its call), however many run at once.
  • A reworded retry of a denied action isn’t judged fresh. When the owner said no to an ask, a call from the same agent session in the next 30 minutes that does the same thing in other words (other argument names, the reason moved to a note) is stopped with Why Claros stopped it: Denied earlier by <owner>: <their reason>. If the agent keeps at it, the owner is told once. How alike counts is a workspace setting (PUT /api/workspace/learning {retry_similarity}, 0–1, default 0.7; 0 turns it off). A rule’s own stop isn’t a denial here: its advice is to change the record, and a changed record is checked fresh.
  • Long-running jobs are checked at every write step, not once at the start: each write is its own tool call, and each tool call goes through the guard or the hook. A job that runs for hours with a stop in the middle is stopped at that step; what it read before isn’t checked (reads pass).

​
A nudge

A nudged call is forwarded to the app. Its result comes back as the app sent it, plus one more text item, so the agent can fix the record (if it still can) and follow the rule next time:
The fix is the judge’s for a judged rule, or the rule’s own fix template (with {field} filled from the record) for a precise one; with neither, there is no fix line. The guard logs → nudge and the rule on stderr. Playwright passes the nudge to onNudge and console.warn; browser-use appends it to the action’s extracted_content, which the agent keeps in memory.

​
The API answer

The guard builds that text from the /v1/check answer:
allowed is false when any violation is stop or ask. A nudge violation comes back with allowed: true and, when there is one, a fix. result is the strongest response: stop, ask, nudge or allowed. Older maps and clients say warn for a nudge; Claros still accepts it and answers nudge. not_evaluable lists rules the record lacked facts for; judge_yourself lists fuzzy rules the judge didn’t run.