Governance · Flagship case study

GuardrailAI

Controls the model cannot negotiate away.

A reference framework demonstrating deterministic pre-model checks for OFAC/AML/HIPAA Safe Harbor patterns on synthetic data and an in-memory SHA-256 hash-chained audit ledger: tamper-evident, not tamper-proof.

Inspect repository

Problem

Prompt-only safety instructions are not hard controls. High-consequence workflows need explicit ceilings, refusal paths, bounded execution, and records that can be examined after the model responds.

Architectural decision

Deterministic pre-flight and post-flight checks sit outside the model. Circuit breakers select safe fallbacks, while each transition contributes to a tamper-evident ledger.

Execution topology

01
Request
02
Pre-flight controls
03
Bounded agent work
04
Post-flight controls
05
Audit digest and integrity check

Engineered invariants

Deterministic rules run before model execution.
Agent work has explicit mathematical bounds.
Post-flight thresholds can refuse unsafe output.
Circuit breakers degrade to defined fallbacks.
Audit entries are linked by cryptographic hashes.

Verification paths

Audit ledger implementationIn-memory blocks, SHA-256 digests, link verification, and a formatted audit seal; no digital signature.Guardrail sourceDeterministic policy implementations and enforcement boundaries.Source repositoryFramework, tests, deployment assets, and documentation.

Boundaries stated plainly

— A technical reference is not a certification or legal compliance determination.
— Rules must be reviewed and maintained by qualified domain owners.
— The ledger is held in memory and can be replaced and rehashed by a writer; it is not tamper-proof or digitally signed.

Enterprise adoption path

01Validate rules with domain counsel.
02Integrate authoritative policy sources.
03Add access control, retention, monitoring, and incident procedures.