How it works
One policy source governs the whole turn
A deployment binds a persona pack and a conduct profile. The engine screens what comes in, gates what the agent does, and screens what goes out — with floors that don't depend on the model's cooperation.
The enforcement pipeline
Input pre-gate
Injection and directive-extraction attempts are screened before the model ever sees the text. A deny answers with your refusal — the model is never called.
Tool policy
Every tool call passes a deny-first policy check before it executes. A denied call never runs, and the reason is auditable.
Output guard
Buffered mode holds the whole turn, screens it, and delivers only the screened result. Streaming mode releases only verified text and latches on a violation.
Persona, projected
Identity, personality, and voice compile into the system prompt from the same pack that carries the rules — one artifact, versioned and testable.
Runtime overlays
Per-tenant directives fold in at runtime, tighten-only: a tenant can add a forbidden phrase or a required disclosure, never remove your floors.
Testable packs
Packs ship with executable conformance suites and a red-team corpus. A strict conformance pass means the guarantees were exercised, not assumed.
Built to be wired in, not built around
host hooks wire the whole contract — or use a shipped adapter
small dependencies in the engine — none of them a model
reference adapters: a zero-dependency loop and the Vercel AI SDK