Skip to content
Part 3 · How the models fit

The dog barks. The guard decides. The owner has the last word.

How InnerWarden decides when an AI agent misbehaves: rules decide, the graph connects what the rules cannot see alone, models only suggest, humans keep the veto. One night, seven moments.

1
panel artnight, the fenced house, the dog's ears up by the fenceimg/09-night.png
2:07 am. Something moves at the fence.
2
panel artthe dog barking at the fenceimg/10-bark.png
WOOF!
WOOF!
The dog barks. That is his whole job.
3
panel artthe guard at the gate, lantern raised, the knowledge graph of the night forming in his thoughtsimg/11-guard.png
The fence. Again. Third time tonight.
2:08 am. The rules run first, and nothing in them denies a bark outright. So the guard looks at what else happened tonight: the same fence at 1:52, the shed light at 2:03, one story, not three noises.
4
panel artthe guard at the gate, phone to his ear, glancing back at the houseimg/15-call.png
Connected, the three noises are serious. Unconnected, they were nothing. The rules still cannot prove intent, so this one goes up. Most nights end at the guard.
5advice only
panel artthe consultant with a headset, advising by phoneimg/13-expert.png
Sounds like a known trick.
The specialist advises. He holds no keys.
6the decision
panel artthe owner mid something impressive, one glance at the notification, one tapimg/12-owner.png
No. Keep it shut.
2:09 am. The rare escalation. One tap: denied.
7
panel artdawn, dog asleep on the porch, guard by the closed gateimg/14-dawn.png
Nothing ranthe gate stayed shut
6:40 am. Nothing happened, because it escalated right.
Why the night ended quietly
The dog never opens the gate.

The hot path is deterministic and local: milliseconds, offline, nothing shipped to a third party. Models exist in three bounded shapes: a local classifier that proposes, an anomaly learner that observes, and an optional LLM that advises behind floors, budgets, a circuit breaker and the needs-human veto. Turn every model off and the product still decides, the same way, every time. Escalation to a person is rare by design: it happens only for high-impact actions below the confidence floor. Most nights, no one is woken at all.

rules decide, the graph remembers, correlation connects, models suggest, humans veto, evidence proves
The same night, in the product

Who is who

the dog → Warden Model

A local classifier (distilled SecureBERT, in-process ONNX, 50 to 200 ms, about 87 MB, default off). It proposes a disposition; it cannot act. A per-host autoencoder learns this machine's normal for 7 days and stays advisory.

the rules → deterministic core

Every command is scored before it runs, against fixed, inspectable thresholds. Same input, same verdict, evidence attached. When nothing matches, the log says so rather than calling silence safe.

what he remembers → the knowledge graph

Processes, files, IPs, users and domains as nodes, joined by typed relations. It gives the guard lineage (which process really spawned this) and provenance, which is why the graph outranks any model: where a privilege came from is a graph walk, not a guess. Correlation then connects staged events, because single events lie and sequences do not. Shipped in Pro and Enterprise on Linux hosts.

the phone → escalation

Only ambiguous cases go further. Confident allow and confident deny never consult a model.

the specialist → LLM triage

Bring your own, default off: your provider (Anthropic, OpenAI, Azure or a local Ollama), your key, referenced by env var name and never stored. Severity floor, call budget, circuit breaker, and a shadow mode that logs agreement but is never allowed to act. In Community the second opinion fires only on the ambiguous review band.

the owner → needs-human veto

High-impact actions below the confidence floor wait for a person. No model can override the owner. No LLM configured? The review goes to a human, full stop. And this is rare by design: almost everything resolves deterministically at the guard; the owner is pulled in only when the stakes and the ambiguity are both high.

One story, three differentiators, one channel1The kernel gate2The graph & the layered decision3Models suggest, humans veto+Telegram, the pocket guard
the honest detail

Three models, three leashes. The Warden Model (distilled SecureBERT student, in-process ONNX, 50 to 200 ms, about 87 MB) ships behind a build feature, default off, and proposes one of four dispositions. The anomaly autoencoder learns a host's normal for 7 days with the deterministic rules as its teacher; its score is blended, never sovereign, advisory only. LLM triage is bring your own (Anthropic, OpenAI, Azure or local Ollama), default off, behind a severity floor, per-tick call budget, circuit breaker, allowlists, protected-IP rules and the needs-human veto; shadow mode logs agreement and is never allowed to act. In Community the optional second opinion fires only on the ambiguous review band; with no LLM configured the review goes to a human. Keys are referenced by environment variable name, never stored. Facts verified against messaging/how-it-decides.md section 4.