Skip to main content

Warden

The Warden is the boss-class Emu. It commands a fleet of guardians across your organization, presiding over governance, enforcing policy fleet-wide, and coordinating the Emu cast that watches each model and tool call. Ask in plain language and it sets up the guardrails, masks what is sensitive, and keeps a record you can review.

Status: Stable · GA Companion docs: Chat shell · Named agents · Prompts · Inline UI · Memory · Receipts · BYOK models Siblings: the Emu desktop app is the on-device guardian the Warden commands. The SDK wraps the same governance in two lines of code.

Your AI, on your terms​

The Warden is a chat shell that is the app. You type a natural-language request. A deterministic agent reasons, calls governed tools, retrieves from the knowledge graph, and answers with either a snippet, a direct change, or a rich server-driven UI component mounted inline in the chat turn. A risk register table. A compliance heatmap. A full vendor dashboard. A 3D risk sphere. Every step is signed and hash-chained.

Two things make this more than a chat wrapper​

Two properties make the Warden structurally different from a chat wrapper, and both are observable in every run:

No backdoor
The agent's tool calls go through the same governed proxy
The Warden does not have a parallel "AI tool" surface. Its tool calls are governed trinitite.* MCP tools routed through the same pre and post governance and audit pipeline as any external tool. Masking, action-guards, NHI-tier filtering, and the hash-chained audit all apply. There is no bypass path.
Same answer every time
A brain that returns the same bytes for the same input
The agent's inference calls go to a determinism-eligible model on a batch-invariant kernel. Same inputs, same tokens, a signed and replayable chain of receipts per run. Regulated work mandates this. A non-deterministic frontier model would silently invalidate the receipts.

The first means the Warden inherits governance for free. The second means every run is provable, not promised. See Receipts for the full attestation story and the fork-from-checkpoint rewind.

Read the section​

The composer and the thread
Chat shell
The composer, the sidebar, streaming turns, the settled turn anatomy, rating and feedback, fork from any turn.
Scope what an agent can touch
Named agents
A named agent is a scoped configuration. Bind a subset of MCP servers, tools, and skills. Set the NHI tier, required permissions, model, system prompt, and guardian id.
Copy-paste prompts
Prompts
The featured first-run prompt and a library of asks across masking, scoping, audits, remediation, the risk register, evals, and red-team. Each with an expected outcome.
Rich views, mounted in the turn
Inline UI
The agent mounts rich components inline in a chat turn: risk tables, heatmaps, 3D risk spheres, dashboards, the estate graph, and full workbench pages. Plus generative UI trees.
Opt-in and forgettable
Memory
Memory is opt-in, off by default, and forgettable at any granularity. The Personalized pill, the capture row, per-memory forget, and the bulk wipe.
Provable, not promised
Receipts
Every run is a hash-chained sequence of signed receipts. Fork from any step. The step drawer with per-step rewind. The five receipt families.
Bring your own key
BYOK models
Pick a frontier model per turn from 12 providers. Regulated work stays on the deterministic brain regardless. Leaving a frontier model selected is safe.

Where the Warden fits​

The Warden is the conversational layer that oversees the guardian fleet. The Emu desktop app is the on-device guardian the Warden commands, running the same governance beside you instead of in a data center. The SDK wraps the same governance in two lines of code for the AI you build yourself. All three run the same deterministic kernel.

Go build it: start with Prompts for a copy-paste ask you can try right now, or read Chat shell first if you want the full anatomy of a run before you type.

Last updated on