GWS ModelArmor Action

Action-oriented command for executing Google Workspace ModelArmor operations as discrete, auditable actions with full pre-flight checks, execution logging, and result verification.

When to Use This Command

Run this command when you need to execute a ModelArmor operation as a tracked, verified action within a larger automation workflow.

• You are building an auditable content moderation pipeline that requires execution logs
• You need to create, update, or delete ModelArmor templates as part of infrastructure setup
• You want pre-flight validation before any write operation touches your safety configuration
• You are orchestrating multiple ModelArmor actions in a CI/CD pipeline

Use it also when:

• You need confirmation prompts before destructive template operations
• You want structured action results for downstream processing

Quick Start

Copy
# .claude/commands/gws-modelarmor-action.md
name: gws-modelarmor-action
description: Execute auditable ModelArmor actions
arguments:
  action: The specific ModelArmor action to perform

Copy
# Create a new safety template
claude gws-modelarmor-action "+create-template --params '{\"parent\": \"projects/my-proj/locations/us-central1\"}' --json '{\"displayName\": \"Production Safety\"}'"

Expected output:
Action: create-template
Status: SUCCESS
Template: projects/my-proj/locations/us-central1/templates/prod-safety-001
Created: 2026-03-15T10:30:00Z

Core Concepts

Concept	Description
Action	A discrete, logged operation against the ModelArmor API
Pre-flight Check	Validation of auth, permissions, and parameters before execution
Execution Log	A record of what was executed, when, and the result
Confirmation Gate	User prompt before write or delete operations
Result Verification	Post-execution check that the action produced expected results

Action Lifecycle:
  Define Action ──> Pre-flight Checks ──> User Confirmation
                                               │
       Result Verification <── Execute API <───┘
              │
              v
       Action Log Entry

Configuration

Parameter	Default	Description
action	required	ModelArmor method: sanitize-prompt, sanitize-response, create-template
params	none	URL and query parameters as JSON
json	none	Request body as JSON
dry-run	false	Run pre-flight checks without executing
format	json	Output format for action results

Best Practices

1. Always run with dry-run first for template changes -- Use --dry-run to validate your create-template or update operations before committing changes to production.

2. Include descriptive display names -- When creating templates, use clear naming conventions like prod-safety-v2 so team members can identify templates at a glance.

3. Log action results to a file -- Redirect output to a log file for audit trails: claude gws-modelarmor-action "..." >> modelarmor-actions.log 2>&1.

4. Verify template creation after execution -- After creating a template, run a test sanitization against it to confirm it is active and filtering correctly.

5. Use separate templates per environment -- Maintain distinct templates for development, staging, and production to allow independent tuning of safety thresholds.

Common Issues

1. Permission denied on template creation -- Creating templates requires modelarmor.templates.create permission. Verify your IAM role includes this permission in the target project.

2. Template already exists error -- Template IDs must be unique within a location. Check existing templates with gws modelarmor --help or choose a different template ID.

3. Invalid JSON in --json flag -- Complex template configurations require properly escaped JSON. Use a heredoc or file input for large JSON bodies to avoid shell quoting issues. For example, write your JSON to a file and reference it: --json "$(cat template-config.json)".

Audit Trail Integration

Every action executed through this command produces structured output suitable for audit logging. Redirect output to a log file with timestamps for compliance: claude gws-modelarmor-action "..." 2>&1 | ts '[%Y-%m-%d %H:%M:%S]' >> modelarmor-audit.log. The action results include the operation type, target resource, execution timestamp, and outcome status. For organizations with strict change management policies, combine the --dry-run flag with team review before executing the actual action. This two-step workflow ensures that all template modifications are reviewed and approved before taking effect in production environments.