Guards

Guards are the deterministic escalators that run after policy. Every one of them can make a decision stricter. None can loosen one.

That asymmetry is the whole safety property: a guard that misfires is noisy, and a guard that fails is silent. Neither can make something permitted that policy refused.

Eight of them are a single switch, and they do not all default the same way. Some are on unless you switch them off; the rest do nothing until you name them. This table is the one thing to read on this page:

A flag beginning --no- disables something already running. A flag without it enables something that is not. Reading the list as "these are my guards" therefore gets three of them backwards.

Blast radius is the ninth, and it is the only one that takes two flags rather than a switch, because it needs a code graph to read as well as permission to escalate. It has its own section below.

memnox setup turns on everything in both halves, because a laptop wants them all and the first run observes rather than blocks.

Content shield

Offline scanning of written content and git diffs for secrets, PII and vulnerable packages. Path-routed rules, a versioned ruleset, no network and no model.

It is also where the security baseline lives, the lookup table behind memnox context, stamped with SECURITY_BASELINE_VERSION so a briefing can be reproduced later.

Blast radius

A policy matches the path an action names. That is not enough: an agent editing src/utils/money.ts is editing payment code if payment/checkout.ts imports it.

memnox graph build                       # writes .memnox/code-graph.json
memnox graph explain src/utils/money.ts  # what a change here reaches
memnox serve --code-graph .memnox/code-graph.json --protected-path "*payment/*"

Escalation-only, and silent when uncertain. An unresolvable target or an ambiguous path raises nothing rather than blaming the wrong file.

Deeper analysis, optionally

The built-in graph reads imports in a handful of languages. Graphify parses 36 with tree-sitter and adds calls and inherits edges.

memnox graphify install   # uv / pipx / pip3
memnox graphify build     # AST only: no LLM, no network, no API key
memnox setup              # picks it up automatically

Only EXTRACTED (AST) edges cross into the decision path. INFERRED ones are counted and discarded, because a model-derived edge must never influence a verdict. Graphify is never installed as a side effect, running the install command is the consent.

Behavior

Novel destructive actions, bursts, boundary probing, measured against this agent's own 14-day baseline, not against a global norm. See Risk, drift and incidents.

Trust

Each agent carries a trust score derived from its history. A low-trust agent attempting a risky action escalates; the same action from a long-established agent may not.

memnox agents list                    # every agent, with its trust score

Or read one agent directly, which is what a dashboard would poll:

curl http://127.0.0.1:7466/v1/agents/<id> \
  -H "Authorization: Bearer $MEMNOX_ADMIN_TOKEN"

Verification

An agent that never reported the outcome of its last allowed action gets escalated on the next one. The reasoning is blunt: an agent that does not tell you whether its last change worked is an agent you know less about with every step.

See Verified execution.

Dependencies

memnox serve --dependency-guard

Governs dependency.add: known-vulnerable versions from the shield's curated offline table, and licenses the organization cannot accept.

License lookup defaults to an offline table; --dependency-license-lookup opts into the npm registry. An unknown license or an unreachable registry raises nothing, a lookup failure can never cause a wrongful block.

Shell indirection

Catches the shape where a forbidden command is reached through something that is not itself forbidden, a script, an alias, an interpreter one level down. The rule you wrote said rm -rf; the call said bash deploy.sh.

Taint

Provenance, and the one guard that is fail-closed: if the session taint store cannot be read, the session is treated as tainted. See Trust, taint and provenance.

Decision memory

Recorded organizational decisions, consulted as constraints. An action that contradicts a decision your team approved escalates. See Decisions and memory.

Turning them on for a server

memnox serve \
  --behavior-guard \
  --trust-guard \
  --verification-guard \
  --dependency-guard \
  --code-graph .memnox/code-graph.json \
  --protected-path "*payment/*"

That is the four opt-in guards, plus the two flags blast radius needs. The other four, content shield, shell indirection, decision memory and taint, are already running and are not named here, which is why the line is shorter than the guard list.

Every guard is a flag on purpose. A server deployment should never gain a guard because a local default moved, and the flag list in your deployment config is the record of what you actually chose.