Checkpoints

Checkpoints are the enforcement points around a model call. They decide whether the provider sees input, which tools the model can see, whether your app can execute a tool, whether tool output can re-enter the model, and whether final text can leave the system.

​

Lifecycle

Tool exposure is listed separately because developers need to reason about it separately, but it is delivered as a request checkpoint decision.

​

Request

The request checkpoint runs before the upstream provider call. The SDK normalizes the latest user input into an Averta payload. For supported images and rich media, it sends image data separately from text. If the request decision is:

• allow: the provider call continues.
• block: the wrapper throws before the provider call.
• restrict_tools: the wrapper removes blocked tools, then continues if the request itself is not blocked.

​

Tool Exposure

Tool exposure controls the tool list sent to the provider. Configure it from the tool exposure policy page. Example: a support agent may expose search_docs but hide send_email when a request looks risky. The model can still answer or use safer tools, but it cannot choose the hidden tool because it never sees it. The wrapper also sanitizes forced tool-choice settings when the requested tool was removed.

​

Tool Call

The tool-call checkpoint runs after the model asks for a tool and before your app executes it. This is the checkpoint that protects side effects:

• sending email
• creating tickets
• changing account state
• running shell or browser actions
• calling external APIs

If a tool-call decision is block, the wrapper throws and your app should not execute the tool.

​

Tool Result

The tool-result checkpoint runs when your app sends tool output back into the model loop. Treat tool output as untrusted input. Search results, HTML, ticket comments, emails, database rows, and API responses can carry prompt injection or unsafe instructions. If a tool-result decision is block, the continuation request is not sent to the provider.

​

Output

The output checkpoint runs on final model text. For non-streaming calls:

• allow returns the original provider result.
• block throws before the result reaches your app.
• rewrite asks the provider for a safer answer, then checks the rewritten answer with rewrite_attempt: 1.

For streaming calls, behavior is stricter. OpenAI streaming output checks are supported with limits, but streaming rewrites fail closed. Anthropic streaming is not supported in the current wrapper. See fail-closed behavior for how wrappers handle unsupported paths.

​

Provider Coverage

​

If a Checkpoint Event Is Missing

Use this table when you expected a decision in Events, but one checkpoint is absent. A missing event usually means that stage did not happen in the provider flow, the call used an unsupported method, or the client was not wrapped at the point where the provider call happened.

​

Next Steps