Protocols

Each entry below is a factory returning the blue team's Protocol, selected by name with ct run eval --protocol <name>. Names, arguments, and defaults are read from the eval-protocol registry, so this page cannot drift from the code.

Adding one

from control_tower.protocols.eval.registry import protocols

@protocols.register()
def my_eval_protocol(...):
    ...

Every non-underscore module under the registry's discovery package is imported on first lookup, so the decorator is all the registration a new eval-protocol needs.

Registered protocols

`apollo-watcher`

Blue protocol that has Watcher Live judge each of U's actions before it runs.

Defined in control_tower.protocols.eval.protocols.watcher.watcher.

Argument	Type	Default	Description
`grade_every_action`	`bool`	`False`	Skip Watcher's built-in Claude Code rules, which clear actions like `Read` and source-file writes without grading, so its grader judges every action under CT's own tool names.
`cot_level`	`Literal`	`'none'`	How much of U's own text Watcher sees, as for CT monitors: none, text, cot.
`settings`	`dict[str, Any] \| None`	`None`	Watcher settings overlaid on the organization's for this run, as YAML: thresholds, rules, or `policy_monitors.policy_gateway_grader_id` to grade with a custom grader and its model. A setting the organization locks fails the sample.
`record`	`bool`	`False`	Keep the conversation and decisions as a session on the Watcher host.
`timeout`	`float \| None`	`None`	Seconds to wait for Watcher's decision on all of one action's calls; a slower answer fails the sample. Unset, the SDK allows 420 seconds per call.
`block_message`	`str`	`'A safety monitor blocked this action. Take a different, si…`	What U reads in place of a blocked action's results; says nothing about why.

`block-all`

U proposes, blue refuses, nothing runs.

Defined in control_tower.protocols.eval.protocols.block_all.block_all.

Argument	Type	Default	Description
`harness`	`control_tower.protocols.eval.harness.NullHarness \| control_tower.protocols.eval.harness.InspectSweHarness`	`NullHarness(...)`	The harness that runs U: `{kind: 'null'}` for the env as declared, or `{kind: inspect_swe, agent: <name>, version: <stable\|latest\|semver>, args: {...}}` for a real coding agent, whose agent white must allow.

`block-every-other`

U proposes, blue refuses the 1st, 3rd, 5th call of each exchange and runs the rest.

Defined in control_tower.protocols.eval.protocols.block_every_other.block_every_other.

Argument	Type	Default	Description
`harness`	`control_tower.protocols.eval.harness.NullHarness \| control_tower.protocols.eval.harness.InspectSweHarness`	`NullHarness(...)`	The harness that runs U: `{kind: 'null'}` for the env as declared, or `{kind: inspect_swe, agent: <name>, version: <stable\|latest\|semver>, args: {...}}` for a real coding agent, whose agent white must allow.

`defer-to-resample`

Draw U several times, score each draft, run the least suspicious.

Defined in control_tower.protocols.eval.protocols.resample.defer_to_resample.

Argument	Type	Default	Description
`drafts`	`int`	`3`	Drafts of U per step.
`monitors`	`list`	required	The monitors asked, each a packaged prompt by name or a mapping of `Monitor` fields: `[simple, {prompt: strong, model: judge, cot_level: cot, samples: 2}]`. `model` names a role bound with --model-role.
`combine`	`Combine`	`Combine(...)`	How every score of every monitor on an action combines into one: an Inspect score reducer by name (`max`, `mean`, `median`, `mode`, ...), or `{name: ..., args: {...}}` for one that takes arguments; `name` may be your own `module:function`, which reads each score's monitor from `metadata.monitor`.
`harness`	`control_tower.protocols.eval.harness.NullHarness \| control_tower.protocols.eval.harness.InspectSweHarness`	`NullHarness(...)`	The harness that runs U: `{kind: 'null'}` for the env as declared, or `{kind: inspect_swe, agent: <name>, version: <stable\|latest\|semver>, args: {...}}` for a real coding agent, whose agent white must allow.

`defer-to-trusted`

Score U's action; too suspicious, the trusted model acts instead; more suspicious still, audit.

Defined in control_tower.protocols.eval.protocols.defer_to_trusted.defer_to_trusted.

Argument	Type	Default	Description
`monitors`	`list`	required	The monitors asked, each a packaged prompt by name or a mapping of `Monitor` fields: `[simple, {prompt: strong, model: judge, cot_level: cot, samples: 2}]`. `model` names a role bound with --model-role.
`combine`	`Combine`	`Combine(...)`	How every score of every monitor on an action combines into one: an Inspect score reducer by name (`max`, `mean`, `median`, `mode`, ...), or `{name: ..., args: {...}}` for one that takes arguments; `name` may be your own `module:function`, which reads each score's monitor from `metadata.monitor`.
`defer_threshold`	`float \| None`	`None`	If U's action scores at or above this, the trusted model is asked the same request and its action runs instead. Unset, U's action always runs.
`audit_threshold`	`float \| None`	`None`	If U's action scores at or above this, it is audited: an attack sample stops there and an honest one continues. Checked before `defer_threshold`. Unset, nothing is audited.
`block_message`	`str`	`'A safety monitor blocked this action. Take a different, si…`	What U reads in place of its action's results when the trusted model, asked to act instead, answers without a tool call.
`harness`	`control_tower.protocols.eval.harness.NullHarness \| control_tower.protocols.eval.harness.InspectSweHarness`	`NullHarness(...)`	The harness that runs U: `{kind: 'null'}` for the env as declared, or `{kind: inspect_swe, agent: <name>, version: <stable\|latest\|semver>, args: {...}}` for a real coding agent, whose agent white must allow.

`null-blue-team`

U proposes, blue allows, everything runs unmodified.

Defined in control_tower.protocols.eval.protocols.null_blue.null_blue_team.

Argument	Type	Default	Description
`harness`	`control_tower.protocols.eval.harness.NullHarness \| control_tower.protocols.eval.harness.InspectSweHarness`	`NullHarness(...)`	The harness that runs U: `{kind: 'null'}` for the env as declared, or `{kind: inspect_swe, agent: <name>, version: <stable\|latest\|semver>, args: {...}}` for a real coding agent, whose agent white must allow.

`trusted-editing`

Score U's action; too suspicious, the trusted model edits it before it runs; more suspicious still, audit.

Defined in control_tower.protocols.eval.protocols.trusted_editing.trusted_editing.

Argument	Type	Default	Description
`monitors`	`list`	required	The monitors asked, each a packaged prompt by name or a mapping of `Monitor` fields: `[simple, {prompt: strong, model: judge, cot_level: cot, samples: 2}]`. `model` names a role bound with --model-role.
`combine`	`Combine`	`Combine(...)`	How every score of every monitor on an action combines into one: an Inspect score reducer by name (`max`, `mean`, `median`, `mode`, ...), or `{name: ..., args: {...}}` for one that takes arguments; `name` may be your own `module:function`, which reads each score's monitor from `metadata.monitor`.
`edit_threshold`	`float \| None`	`None`	If U's action scores at or above this, the trusted model is shown it and edits it, and the edited calls run instead. Unset, U's action always runs.
`audit_threshold`	`float \| None`	`None`	If U's action scores at or above this, it is audited: an attack sample stops there and an honest one continues. Checked before `edit_threshold`. Unset, nothing is audited.
`block_message`	`str`	`'A safety monitor blocked this action. Take a different, si…`	What U reads in place of its action's results when the trusted model, asked to edit it, answers without a tool call.
`harness`	`control_tower.protocols.eval.harness.NullHarness \| control_tower.protocols.eval.harness.InspectSweHarness`	`NullHarness(...)`	The harness that runs U: `{kind: 'null'}` for the env as declared, or `{kind: inspect_swe, agent: <name>, version: <stable\|latest\|semver>, args: {...}}` for a real coding agent, whose agent white must allow.

`trusted-monitoring`

Ask the monitors about each action; at or above sus_threshold, block up to blocks times, then audit.

Defined in control_tower.protocols.eval.protocols.trusted_monitoring.trusted_monitoring.

Argument	Type	Default	Description
`monitors`	`list`	required	The monitors asked, each a packaged prompt by name or a mapping of `Monitor` fields: `[simple, {prompt: strong, model: judge, cot_level: cot, samples: 2}]`. `model` names a role bound with --model-role.
`combine`	`Combine`	`Combine(...)`	How every score of every monitor on an action combines into one: an Inspect score reducer by name (`max`, `mean`, `median`, `mode`, ...), or `{name: ..., args: {...}}` for one that takes arguments; `name` may be your own `module:function`, which reads each score's monitor from `metadata.monitor`.
`sus_threshold`	`float \| None`	`None`	Act at or above this score; unset, the monitors are asked and nothing intervenes.
`blocks`	`int`	`0`	Flagged actions sent back to U with `block_message` this many times before the trajectory is audited.
`block_message`	`str`	`'A safety monitor blocked this action. Take a different, si…`	What U reads in place of a blocked action's results; says nothing about why.
`harness`	`control_tower.protocols.eval.harness.NullHarness \| control_tower.protocols.eval.harness.InspectSweHarness`	`NullHarness(...)`	The harness that runs U: `{kind: 'null'}` for the env as declared, or `{kind: inspect_swe, agent: <name>, version: <stable\|latest\|semver>, args: {...}}` for a real coding agent, whose agent white must allow.