Capability is the market.
Accountability is the product.

Follow us on GitHub

Guardrail stops dangerous agent actions. Engram gives agents memory. Amparo is the agent that acts under policy. ELLM is the engine underneath.

AI agents are getting dangerous tools — shells, databases, cloud credentials. The industry's answer is another AI: LLM judges that cost money, burn energy, and can be talked out of the right answer. We build the deterministic alternative: the same verdict every time, with a trace a human can audit — protecting people from harm and the planet from waste. And the agent that acts through it is Amparo — open, under policy, bring your own LLM.

But this is not only an AI story. Shell scripts, CI pipelines, and automation have been executing dangerous instructions since long before LLMs existed. AI didn't invent the problem — it multiplied the blast radius. Our tools are built for that wider world: they help AI, and not only AI.

Your data stays on your device. No telemetry. No phoning home. Our servers store only the minimum needed to run your account — never sold, ever. Read the full privacy page →


Our approach

Deterministic over probabilistic. Every check produces the same output every time. No model to inject a prompt into. No hallucinations. No distribution shift. A Rete forward-chaining network replaces the LLM judge — same security boundary, zero probability.

Efficiency as proof. The deterministic check is also the cheap one: a tool call classified in 15µs (p50) on a single core, ~65 KB of memory per check — millions of times less energy than an LLM judge for the same decision.

Ungameable by design. Actions are parsed into ASTs and content-addressed before classification. Obfuscation, encoding tricks, and prompt injection don’t work. Ambiguity defaults to deny.

Products

Govern — in beta

Guardrail

A firewall for AI agents that act — blocks dangerous tool calls in 15µs, no AI judge. Try it live, no signup.

Remember — beta

Engram

Long-term memory for your AI. Encrypted on your machine, never in a cloud. Source-available under the FSL, free to use.

Act — in beta

Amparo

An open agent that acts under policy. Bring your own LLM — deny-by-default gates, human-only approval, and a ledger for every consequential act.

Built on ELLM

ELLM — the reasoning engine underneath Guardrail and Engram. Content-addressed frames, deterministic forward-chaining, auditable inference traces. It's how we can say "provably," not just "probably."

How ELLM works →

Built for AI. Not only for AI.

Guardrail — any programmatic execution

An agent loop, a CI pipeline, a shell script, a human operator’s terminal. Same policy, same 15µs verdict, same audit trail. Who issues the instruction doesn’t change how safety works.

ELLM — embeddable anywhere

The reasoning engine underneath is embeddable at every scale. Any software that needs provable inference — security tooling, compliance, automation — is a home for it.

Engram — a problem older than AI

A memory vault aimed at AI agents today — but what to keep, what to strengthen, and what to forget is a problem far older than AI.

Amparo — the agent that acts under the rules

Bring your own LLM and give it real tools. Every consequential act passes the gate chain — registry, ceiling, policy, and a human for the dangerous ones — and leaves a ledger entry a human can audit.

Your data stays on your device

Your data stays on your hardware

The guardrail engine is self-hosted on your infrastructure. It never phones home — no license checks, no telemetry. The deterministic check makes no network call at all.

No third-party model in the loop

There’s no LLM judge by default, so your tool calls are never sent to a model provider. If you enable the judge tier, it calls an endpoint you supply. We never see your tool calls.

Memory that never leaves

Engram is an encrypted, local-first memory vault. SQLCipher at rest, keys bound to your hardware, on your machine.

The console keeps the minimum

The hosted console processes only account, member, key metadata, and the event records your engines report. Never sold. Payloads are read only to operate the service, debug issues you report, or comply with law.

An agent that brings its own LLM

Amparo calls the model endpoint you supply — no model in our loop — and records every consequential act in a privacy ledger of counts, never values.

Full privacy page →

Proof, not promises

15µs p50 latency
37.7k/s single core
0 false-ALLOW 115 beyond-bash tests
~65 KB memory per check

Measured by a reproducible benchmark: cargo run --release --bin guardrail_bench (requires licensed source). Full methodology →

From the journal

Read the journal →