Deterministic LLM Guardrail Compiler

Concept

This tool shifts the burden of reliability from stochastic model weights to a deterministic enforcement layer. Instead of relying on prompting for safety, the system provides a technical implementation of Execution-Time Authorization (ETA) [1]. In its initial version, the tool functions as a library and middleware proxy where developers manually define declarative policies (using frameworks like OPA) to govern specific tool calls. This ensures that every proposed action is evaluated against versioned policies and the current system state at a non-bypassable boundary, failing closed unless an affirmative 'ALLOW' verdict is produced [1, 4].

Technical Architecture

The system integrates several formal mechanisms to ensure correctness:

• Execution-Time Authorization (ETA): A distinct architectural layer that checks if a specific action is allowed based on the current system state before it is executed, producing a replayable record of the decision [1].
• Stable Authority Boundary (SAB): A control boundary that separates what the LLM is technically capable of doing from what it is actually authorized to do. This ensures actions are refused if the conditions supporting that authority have changed [2].
• The Execution Boundary: The system implements a clear hand-off point where a proposal is checked for validity before it is allowed to have a real-world effect. This ensures no action is taken without verified evidence and authority [3].
• Logic Validation: To prevent hallucinations, the tool verifies that the LLM preserved the intended logic of a request—for example, ensuring the LLM didn't change the order of operations or the logic of a conditional statement—rather than just checking for keyword matches [2].
• Action Authorization Artifacts: Unlike standard API gateways that only verify identity, this system produces a cryptographically signed record proving that a specific output complied with the specific policy version active at the time of the event [4, 6].

Constraints and Scope

This approach prioritizes deterministic safety over creative flexibility, which strictly limits LLM autonomy. While this eliminates the risk of 'silent failures' by treating the LLM as a proposal engine, it introduces a 'fail-closed' architecture that may block valid but non-conforming agent actions. The system is designed as a complementary structural layer to existing frameworks like ISO/IEC 42001 or NIST AI RMF, rather than a replacement for them [5].