Keep policy enforcement outside the model
A proposed action has both deterministic facts and semantic questions. Exact permissions, allowed resources and required approvals belong in the application. A model can judge whether an otherwise permitted action appears relevant or risky, using only the evidence it receives.
The official LLM guardrails cookbook illustrates screening messages and routing results. The Jev 1.13 limitations explicitly note that adversarial state can affect judgments. Typed output does not eliminate prompt injection.
Permission hooks need a failure contract
OpenRouter's agent-permission recipe checks static rules before asking Jev about routine commands. Unclear decisions retain the normal prompt. The surrounding host and policy checks, rather than the confidence threshold, establish what can run.
- Determine which actions require a person or are never permitted.
- Validate the entire proposed operation, including arguments and target resources.
- Send only approved, necessary context to the inference provider.
- Reject invalid responses and define the outage behavior.
- Record the proposed action, policy result, model result and final decision separately.
A high threshold does not make an incomplete state sufficient. If a command touches a production resource but the model is not told that fact, a confident answer can still be inappropriate.
Different Jev Guard projects
leepokai/jev-guard describes hooks for multiple coding agents. Other repositories named Jev Guard address different hosts or risk-triage applications. Identify the owner, supported version and actual behavior before comparing them.
Pi extensions also differ. pi-jev-auto-mode describes a deterministic envelope and refusal when a decision cannot be made. y0usaf/pi-jev describes its own gate and behavior without a key. Test the specific configuration; do not transfer one project's failure behavior to another.
Detection, logging, masking and blocking are separate
The UiPath Jev PII guardrail is a useful example of why names are insufficient. Its README says it sends the request in the clear, records detected identifier types, does not return offsets, never masks or blocks, and fails open on detector outages. That is documented detection and observation, not a redaction barrier.
A probability that text contains an identifier does not identify the character span to remove. If your task requires redaction, use a component that actually finds and replaces those spans, then validate the resulting payload. Decide whether detection happens before or after data has already crossed the model boundary.
Evaluate dangerous misses and ordinary false alarms
Build a test set containing ordinary allowed operations, required-review operations, known forbidden operations and ambiguous targets. Include compound requests and adversarial descriptions. Measure missed risks, unnecessary prompts and review coverage separately.
Exercise timeouts, malformed responses, absent credentials and unavailable providers. Check that the host's own permissions remain effective and that logs do not unexpectedly retain secrets or sensitive content. Introduce bounded automation only after the actual failure path is visible.