Guardians

The deterministic enforcement layer. A Guardian intercepts every AI output (or tool call) and returns one of three verdicts — passed, corrected, or blocked — against your policies. It is the kernel-space safety layer to the model's user-space creativity.

What it is

A Guardian is a small, specialized language model (an SLM) distilled on your specific policies and fine-tuned as a LoRA adapter on top of a deterministic SGLang kernel. It sits inline between your application and the AI provider (or between an agent and its tools). It does not rewrite outputs by asking another LLM "make this safe" — it maps the output vector to the nearest pre-validated safe centroid in your policy manifold and, when a violation is repairable, emits an RFC 6902 JSON Patch that surgically fixes the offending span.

Guardians come in a triad: input governance (inspect the request), output governance (inspect the response), and bidirectional (both). Each tool call can get its own schema-trained Tool Guardian; each non-human identity gets its own binding.

Why it matters

• Deterministic, not probabilistic. Under batch_invariant determinism, the same input + policy + version always produces the same verdict and the same patch — byte-for-byte. Verdicts are replayable and auditable.
• Correct, don't regenerate. A corrected verdict ships a JSON Patch your client applies in place — no costly re-generation, no latency tax on the happy path.
• Herd immunity. When one node detects a novel attack, a micro-LoRA is minted and hot-swapped into every Guardian globally — no restarts, no downtime. That attack class drops from non-zero probability to mathematically impossible.
• Decoupled from the model. Swap GPT-5 for Claude without rewriting your safety architecture. Compliance logic lives in the Guardian, not the weights.

How it works

1. Intercept. The call (or its response) routes through the Guardian.
2. Project. The Guardian projects the output vector onto your policy manifold — geometric distance to safe centroids and forbidden zones.
3. Decide. One of three outcomes: passed (compliant), corrected (repairable — emit the nearest-safe JSON Patch), blocked (critical — refuse with a forensic record).
4. Receipt. Every decision is hashed, signed, and Merkle-chained into the Glass Box Ledger.

Get started

• Drop in via the Proxy endpoint (redirect OPENAI_BASE_URL) or call the Chat endpoint directly.
• Create and manage Guardians programmatically via the Guardians API.
• Train Guardians on your policies via the Training API; test them via the Testing & Simulation surface.

---

→ Guardian Training — oracle-guided distillation, LoRA hot-swap. → Architecture — the policy manifold and semantic rectification. → Verdict vocabulary — the three-outcome contract.