Core concepts
Read this once and the rest of the docs click into place. Five ideas: the Guardian, the three-outcome verdict, the policy manifold, the Glass Box Ledger, and the four-layer assurance stack.
The Guardian
A Guardian is a small, specialized language model distilled on your policies, running on a deterministic kernel. It sits inline between your application and the AI provider (or between an agent and its tools). It does not generate content — it governs content. Think of it as the kernel-space safety layer to the model's user-space creativity: a user process cannot overwrite kernel memory, and a probabilistic actor cannot execute a business violation through the Guardian.
The three-outcome verdict
Every governed call returns exactly one of three outcomes. This is the contract your client code branches on.
| Outcome | Meaning |
|---|---|
passed | Compliant. Returned unchanged. |
corrected | A violation was surgically repaired. Returns an RFC 6902 JSON Patch. |
blocked | A critical, unrepairable violation. Returns a 403-style refusal. Do not use the original output. |
See Verdict vocabulary for the full receipt shape.
The policy manifold
Policies are not text rules a Guardian "reads." They are geometry. Each policy defines a manifold in the model's latent space — safe centroids (permitted regions) and forbidden zones (exclusion radii). A Guardian projects an output vector onto this manifold and measures geometric distance. A corrected verdict is the projection of a violating vector onto the nearest safe centroid — a deterministic calculation that produces a unique result, not a re-prompt.
The Glass Box Ledger
Every verdict is hashed, signed, and Merkle-chained into an append-only ledger. Each block's hash chains to the prior block; Merkle roots are anchored externally (RFC 3161 + Sigstore Rekor). Alter any byte in any past block and the current hash fails validation. Any third party can reproduce a proof in a browser — without trusting Trinitite. This is what turns a decision into evidence.
The four-layer assurance stack
- Layer 1 — Sampled Assurance. An offline, signed pre-audit of your historical logs. The wedge — standalone, low-touch.
- Layer 2 — Continuous Assurance. A live, signed compliance stream with drift detection. The "did the fix work?" layer.
- Layer 3 — Guardians. Inline enforcement that blocks, corrects, or masks before a failure ships.
- Layer 4 — Bound Coverage. Coverage priced from the Layer 1/2 evidence. (Layer 4 surfaces are not yet documented on this site.)
Each layer compounds: the signed report from L1 identifies the gaps; L2 watches the live stream; L3 steps in inline; L4 prices the residual risk.
Why determinism is the whole game
Under batch_invariant determinism, the same (input, guardian_version, policy_hash) triple always produces the same verdict, the same patch, and the same chain hash — across batches, nodes, and restarts. That is what makes a verdict replayable (you can re-run any past decision and get the identical receipt) and therefore auditable. Anyone else in this category produces logs. Trinitite produces evidence. The difference is determinism.
→ Quickstart — wire a real Guardian into your code in five minutes. → Architecture — the full picture of how a Guardian works. → Products — the full product surface.