PolicyGuard
Monad Parallel EVM execution containment & real-time pre-flight policy firewall.
Architecture
Two paths through
Two paths through
every request.
A security path that decides in milliseconds whether traffic is safe — and a trust path that turns an agent's history into evidence nobody can quietly rewrite.
Off-chain · the request path
Screened both directions.
Every prompt is inspected before your model sees it. Every response is inspected before your user does.
01INTAKE
Request intake
The gateway accepts prompts from your app, or from any OpenAI-compatible client pointed at its universal auth proxy (Ollama, vLLM, LocalAI, llama.cpp). Tenants are identified and metered per API tier.
02FAST PATH
Fast-path screen
A regex and heuristic layer sheds obvious injection patterns at zero ML inference cost — high-volume attack traffic never reaches the classifier.
03SEMANTIC
Semantic firewall
An embedding-based classifier judges the subtle cases. Three operating modes trade recall against false positives: strict blocks first, balanced loosens thresholds, permissive flags without blocking.
04DE-OBFUSCATION
De-obfuscation pass
Morse, Braille steganography, Base64, hex, binary, ROT13, homoglyphs — inputs are normalized before classification so payloads can't hide behind an encoding layer.
05EGRESS
Response guardrails
Model output is scanned for PII (redacted before egress), XSS/SQL/shell fragments, and system-prompt leakage, with optional watermarking for downstream tracing. Fail-closed rate limiting bounds everything.
On-chain · the trust path
Identity first. Evidence second.
The on-chain suite doesn't slow down execution — it makes an agent's identity, permissions, and security track record independently verifiable.
06IDENTITY
Register & enforce portable identity (ERC-8004)
Your agent is registered in the Trustless Agents ecosystem with a verifiable identity token. The runtime Identity Gate validates cryptographic identity pre-flight on transactions and inter-agent channels with hot-wallet collision guards.
07PASSPORT
Mint a soulbound passport (ERC-5192)
A non-transferable passport carries verifiable trust tiers (UNVERIFIED → SILVER → GOLD → DIAMOND) and a 0–10000 reputation score derived from empirical security scan history.
08ANCHOR
Anchor tamper-evident Merkle roots
Security events and prompt audits are batched and hashed into a Merkle tree. Periodic roots are anchored on-chain — so when an incident occurs, you're not debugging from vibes or trusting unverified server logs.
09CERTIFY
Issue signed insurance certificates
GuardianInsuranceLedger anchors cryptographic certificates summarizing an agent's verified security posture for underwriters and enterprise compliance. It records immutable evidence — it does not automate payouts or slashing.
What's real today — stated plainly.
Merkle anchoring defaults to simulated mode; live testnet submission is active on Monad Testnet. The canonical ERC-8004 registries are mainnet ecosystem infrastructure — testnet registrations use an ABI-faithful stand-in registry. The insurance ledger anchors certificates only; no payout or slashing automation exists. We'd rather lose the hype than the trust this page asks you to place in us.
The trust suite
Eleven contracts. Nine live on Monad testnet.
ThreatOracle
Chainlink CRE receiver, live on Monad testnet: only the Chainlink forwarder can write to it, and every agent wallet refuses addresses it flags. Fed today by a CRE simulation with a real broadcast; live DON next.
CortexAnchor
Batches security-event hashes into Merkle roots and anchors them as tamper-evident timestamps.
PassportSBT
ERC-5192 soulbound agent identity with trust tiers and score.
InterlockRegistry
Explicit agent-to-agent authorization — no silent handshakes between machines.
InsuranceLedger
Anchors signed insurance evidence certificates for underwriters (100k cap).
ThreatFeedRegistry
Publishes threat intelligence on-chain for cross-organization consumption.
RiskAttestation
Records third-party risk attestations against registered agents.
Timelock
24-hour OpenZeppelin delay controller before administrative changes execute.
CircuitBreaker
A kill switch that can halt the trust suite when anomalous activity is detected. In the repo; not deployed yet.
ProtectedVault
Escrow-style custody for value touching the trust suite. In the repo; not deployed yet.
Integrate
Two calls. That's the integration.
The Python SDK wraps the gateway API with JWT auth, retries, and typed results. A JavaScript SDK mirrors it.
app.pypython sdk
from guardianai import GuardianAI
guardian = GuardianAI(api_url="https://your-guardianai-host")
guardian.login("username", "password")
# 1. Screen every prompt before it reaches your model
check = guardian.scan_prompt(user_input)
if check.blocked:
raise RuntimeError(f"Blocked by policy: {check.reason}")
reply = call_your_llm(user_input)
# 2. Screen every response before it reaches your user
out = guardian.scan_response(reply, system_prompt=SYSTEM_PROMPT)
if out.blocked:
raise RuntimeError(f"Response withheld: {out.reason}")
return replyPoint your existing stack at it
The universal auth proxy sits in front of Ollama, vLLM, LocalAI, and other OpenAI-compatible endpoints, so unmodified clients get guarded without code changes.
Try it live
Launch real attacks against a guarded agent and watch both gates refuse them on Monad testnet, then check every contract live in the proof ledger: aiguardian.dev/explorer ↗. No wallet needed.
Read the receipts next.
Benchmarks, latency under attack, test counts, audit status — each figure cited to its dated artifact.