Skip to content

If you only read one page

This page is the guide in brief, limits included. Every statement on it is explained, with its evidence, in the chapter it links.

What each product does

  • The Bot Builder builds your own agent from the tools you already have: Python functions, MCP servers, OpenAPI operations, LangChain tools or a TypeScript project. You declare the agent in one agent.yaml file or in Python (chapter 30).
  • Agent Graph Verification checks every route through an agent before it runs (chapter 47, and chapter 31 for an agent you built with the Bot Builder).
  • The Guardrail Bug Hunter scans a guardrail policy, a router or an agent graph for every way through it to a forbidden action (chapter 28).
  • Guardrail Verification decides whether an action can fire without its safety context (chapters 3 to 12).
  • Guardrail Writing drafts a policy from a rule in prose, on your own model, and verifies the draft (chapter 13).
  • Random Forest Verification checks a trained forest against the properties you state (chapter 14).

The two that are used together most are the selector, which is part of the Bot Builder, and the bug hunter: a guardrail makes every tool wait for the selector's decision, and the hunter looks for every path that skips it, failing the change that adds one (chapter 29).

Language support

The selector understands turns written in English. Portuguese is its next grammar, and has not shipped yet; until it does, a turn written in Portuguese is not read as Portuguese.

How an agent is kept in line

  • Before it runs, its routes are verified: every path to a write without its check, its confirmation or its order rule is a finding, and an agent with such a path does not start (chapter 45). stalwart verify makes the same check a gate in CI (chapter 46).
  • On every turn, the selector reads the turn and decides the tool, a question to ask, or a refusal, by a named rule. A model is called only where your settings send a turn to one (chapter 20).
  • On every tool call, whoever chose it, the call is checked against your catalogue, your rules and the session's history. The answer is allow, confirm (a person approves the exact arguments) or refuse (chapter 32).
  • When a run fails, its writes are undone, last first, each undo checked like any call (chapter 34).
  • Before a reply is shown, it is held to what was actually done, and checked for personal data and wording you forbid (chapters 42 and 43).
  • All of that runs on your own machine, in the licensed runtime. Your agents' calls and your documents never reach our service, and a user's turn reaches it only as the words of a turn somebody rated with a thumb (chapter 25). Otherwise only counts do (chapter 38).

What it does not claim

These are the limits a reader most needs, in short. Each chapter states its own under a heading of its own.

  1. A verification proves the question you asked, and no other. One run proves one proposition. A policy is only as verified as your list of questions is complete (chapter 1).
  2. A certificate establishes a derivation, not that its premises are your policy. Checking a certificate shows the equations it starts from have no common solution; it does not show those equations are a faithful compilation of the policy (chapter 7).
  3. A verdict over a policy the compiler did not fully read is not a verdict. A line the parser skipped is a missing edge, and a missing edge reads as a bypass or a pass that means nothing (chapter 6).
  4. A patch is proved to close the hole, and only sometimes proved not to over-block. The second proof has its own outcome, and only proved_free makes that claim (chapter 8).
  5. A stall on the guardrail side is acted on as a bypass; on the random forest side it concludes nothing (chapters 6 and 14).
  6. A clean agent scan proves no path reaches a tool without its check, to the depth checked. It does not prove the model chooses well, and it reads your own functions as able to do anything (chapter 31).
  7. An attack not realised says nothing about safety (chapter 33).
  8. A rollback does not undo an irreversible step, and a saga compensates rather than locks (chapter 34).
  9. The reply checks remove what the system's facts do not support; they do not prove a reply true (chapter 42).
  10. An OWASP or NIST mapping is not a certification, and the hunter's OWASP coverage is at the policy level (chapter 39).

How to check our work

A certificate can be checked with no key, no network and none of our software: read the specification, or run the reference checker, one short file under the MIT licence, over the certificates in the corpus.

Your account

Sign up at stalwart.it with Google or an emailed link. The first key is shown once on the welcome page; every key after that is yours to mint in the console (chapter 5). What each plan includes is in chapter 40; what is kept, for how long, and what is never kept, is in chapter 16.