Ask an LLM “is this command dangerous?” and you’ll get an answer. Usually the right one. Sometimes not. The problem isn’t the average case — it’s the tail.
A prompt-based guardrail can be socially engineered. A classifier can be adversarially attacked. A model can hallucinate. And in each case, the failure mode is the worst possible outcome for a security product: the attacker wins.
We took a different approach.
The Rete network
Instead of asking a model to reason about danger, we compile a policy into a Rete forward-chaining network. Rete is a pattern-matching algorithm developed in the 1970s for production systems. It’s deterministic, fast, and well-understood.
Here’s what happens when a tool call arrives:
Map. The tool name and target are normalized and parsed. Bash commands become ASTs. File paths are collapsed. Obfuscation is mechanically stripped.
Insert. The normalized action is inserted as a fact into the Rete network’s working memory.
Infer. Rules fire. IS_A relationships are traversed. Flag rules are checked. Category verdicts are applied. The network runs to fixpoint.
Read. The verdict is read from working memory. Allow, Deny, or Escalate. Always the same output for the same input.
No model. No prompt. No probability distribution. Just a network of pattern-matching nodes firing deterministically.
Why this matters
Immunity to prompt injection. There is no prompt. The deterministic tier has no text interface that an attacker can manipulate. You can’t sweet-talk a Rete network.
Bit-for-bit reproducibility. The same policy + the same input = the same output. Across restarts. Across machines. Across versions. You can test it once and know it will behave the same way in production.
Speed. 124 microseconds per check. That’s not a benchmark — it’s the architecture. Rete networks are O(R * F) where R is the number of rules and F is the number of facts. For realistic policies, that’s effectively constant time.
Verifiability. Because the network is deterministic, you can prove properties about it. You can enumerate every possible input and verify every output. Try doing that with a 70-billion-parameter model.
The cost of probability
An LLM-based guardrail costs roughly $0.001–0.01 per check in API fees alone — not counting latency (500ms–2s) or energy consumption (several watt-hours per thousand calls). For an agent making 100 tool calls per minute, that’s $4–40 per hour just to decide whether each call is safe.
Our Rete network runs on a single core at 8,000 checks per second. It uses ~50 MB of memory. It produces no API fees. The energy cost per check is measured in microjoules, not watt-hours.
Security shouldn’t require a supercomputer. It shouldn’t require a subscription to a model provider. It should be fast, cheap, and boringly reliable. That’s what we build.