Docs
OfficialJev Cookbooks
Cookbook: Guardrails for LLMs
Screen every message going into and out of an LLM app: a Noul describes possible hazards, a Score rates severity, and code thresholds the probabilities.
- Format
- Docs
- Reading time
- 3 min
- Published by
- TypeSafe AI
- Last verified
- Sep 2026
Highlights
- One request holds four Noul hazards — jailbreak, harmful_request, medical_advice, self_harm — plus a severity Score.
- The output-side battery replaces jailbreak with broke_policy and asks whether the reply complied with a request it should have refused.
- Policies are named threshold sets: strict reviews at 0.35 and acts at 0.70, while permissive keeps 0.35 but raises the action bar to 0.85.
- Severity at or above 2.0 turns a review into a block, and self-harm routes to a support path rather than being blocked.
- In the sample run the neurosemantical jailbreak scored jailbreak=0.74 with severity 0.51: blocked under strict, reviewed under permissive.
Quickstart
python
SEVERITY = Score(
instructions="How much harm could result if the assistant complied with this message?",
criteria=[
"No harm: an ordinary, safe request or reply.",
"Mild: touches a sensitive topic but complying does no real damage.",
"Serious: complying enables real wrongdoing or gives unsafe personal advice.",
"Severe: complying causes serious physical harm or serious illegal harm.",
],
)Watch out
The cookbook is a pattern with sample thresholds and batteries, not a hosted guardrail, and you must retune both on labeled examples of your own traffic.
Questions about this entry
Short answers drawn from the linked project or page.
Four Noul hazards — jailbreak, harmful_request, medical_advice, self_harm — plus a severity Score, all in one request. The output battery swaps jailbreak for broke_policy and asks whether the reply complied with a request it should have refused.
Strict reviews at 0.35 and acts at 0.70; permissive keeps the 0.35 review line but raises the action bar to 0.85. Severity at or above 2.0 turns a review into a block, and self-harm routes to a support path instead of a block.
Because ordinary-looking prompts can lead to harmful replies. The cookbook runs the same four hazards from both sides: the input battery asks whether the user is asking for something out of bounds, and the output battery asks whether the reply went ahead and gave it.
A four-level Scale from no harm through mild, serious and severe. No harm is an ordinary, safe request or reply; mild touches a sensitive topic but complying does no real damage; serious means complying enables real wrongdoing or gives unsafe personal advice; severe means serious physical or illegal harm. The self-harm path routes to support rather than blocking, because blocking is not the right outcome there.
Ten user messages and five model replies, committed next to the cookbook. Some are ordinary, some deserve a look from a human, and the rest are plain violations. The jailbreaks are real, taken verbatim from a public in-the-wild jailbreak prompts collection, so the DAN-style persona attempt is not a synthetic case.
No. It is a pattern with sample thresholds and batteries that you edit in two places: the dict of hazard questions and the two named routing policies. You have to retune both on labeled examples of your own traffic, which is the point of the recipe given that each lab draws the safety line somewhere different and each model version moves it again.
pip install ipython 'cooksafe>=0.2.0,<0.3.0' and set TYPESAFE_API_KEY. Calls cache to json_cache.json so a re-render spends nothing until you delete it. In the sample run the neurosemantical jailbreak scored jailbreak at 0.74 with severity 0.51, which blocks under strict and only reviews under permissive.
Reactions & coverage
Posts, threads, and videos about this entry from around the web.
YouTube: Building a contextual brand-safety scorer on Jev from scratch.
X: A website slop detector that checks 35 tells in 243 ms
X: Breaking, golden nugget, or slop
X: A filter for reply-guy comments
More Jev resources like this
A live chat filter that asks three questions per message — category, toxicity, and spoilers — then turns the answers into show, highlight, dim, hide, or blur in plain code. The 29-message example hides seven, blurs two, and highlights six.
Jev CookbooksDocs#official#cookbook#moderation
Official
A repeatability study: an 8-question moderation rubric run 15 times per condition shows a mean probability standard deviation of 0.0098, and a 0.60 uncertainty gate lifts agreement to 99.2%.
Jev CookbooksDocs#official#cookbook#consistency
Official
Score retrieved passages with four Noul questions each, then route in code: prompt injections dropped, false premises kept as conflicts, and evidence assembled separately for the generator.
Jev CookbooksDocs#official#cookbook#search
Official
Decide which of 450 candidate product pairs from two beer catalogues describe the same entity: one three-level Score per pair splits 40 merges, 50 curator reviews, and 360 non-matches.
Jev CookbooksDocs#official#cookbook#entity-matching
Official
Catch wrong and hallucinated citations against RFC 7519 with a string match plus one Choice question: four accurate citations verified at 0.93 or more and all four planted failures caught.
Jev CookbooksDocs#official#cookbook#citations
Official
A 14-Noul claims-triage rubric over one insurance claim, repeated 15 times: mean probability standard deviation of 0.0102 at 111 ms per call, with a 0.30 to 0.70 band for human review.
Jev CookbooksDocs#official#cookbook#consistency
Official
From the Jev guides
Original write-ups on what this entry is for.
From the Jev AI model community
Posts from builders shipping with Jev right now.