Is a model verdict a real security boundary or just theatre?

Treat it as a policy gate, not a sandbox. The layer runs before your function, obvious destructive and exfiltration commands are denied locally with no network call, and there is deliberately no local fast-pass, so the model cannot wave something through by omission. What it cannot do is contain a command that already passed, and the passive-data wrapping of untrusted arguments is prompt framing, not execution isolation.

What happens in CI when the policy wants to ask for approval?

An ASK falls back to an interactive terminal confirmer only when a TTY is present. In a headless worker, container, CI job or Kubernetes pod, an ASK with no explicit confirmer is denied on the spot. An explicit confirmer is bounded by policy.ask_timeout at 30 seconds maximum, and a timeout, failure or non-approval also denies the call.

How much latency does this add to every tool call?

One evaluation per guarded call, structured as three primitives against the TypeSafe endpoint, bounded by the client timeout. The client default is 2 seconds and JEV_TIMEOUT_SECONDS or an explicit constructor value overrides it. Because ProductionPolicy denies on timeout, tune that number from observed provider latency and the longest your tool can block, or legitimate calls start failing closed.

What actually leaves my machine?

The tool docstring and arguments, after redaction, go to the configured evaluator endpoint. Redaction is two-tier: recognized credentials are stripped before the request and audit-bound data is redacted again on the way out, and original arguments are never attached to decisions, exceptions or audit events. The audit sink receives exactly one terminal event per guarded call with outcome, tool name, redacted arguments and evaluation source, but recognition is pattern-based, so treat it as a safety net.

What three primitives does JevShield evaluate on every pass?

Choice assigns a risk tier (safe, medium_risk, critical_danger), Noul assesses whether the action is destructive, and Score quantifies failure blast radius across five ordered levels.

When does JevShield block an action?

When the tier is at or above the threshold and P_destructive is above 0.75, or when blast radius is at least 3 and the action is destructive.

Why does JevShield fail closed in production?

ProductionPolicy denies evaluator timeouts, malformed responses, transport errors and local-rule failures; unknown risk tiers and missing blast-radius scores are also never allowed through.

CommunityJev Practices & Patterns

Jevshield

Framework-agnostic guard layer that puts Jev in front of an agent's tool calls: a Choice risk tier, a Noul destructiveness check and a Score blast radius decide allow, deny or ask.

See highlights

Open github.com

Stars: 4
Language: Python
License: APACHE-2.0
Published by: Community
Author: lgy1027
Last verified: Oct 2026

lgy1027/jevshield

User repository on GitHub

View on GitHub

Sub-100ms security gate for AI agent tool calls, powered by TypeSafe's Jev (System-1) decision model. Single-request Choice/Noul/Score evaluation, dual-factor blocking matrix, calibrated-confidence routing, fail-closed parsing, zero-config local fallback. LangChain-ready.

Forks: 0
Last pushed: Updated Sep 2026

Repo stats from the GitHub API, cached Oct 2026.

About this project

Framework-agnostic decision control for AI Agent routing and tool execution, powered by Jev (System-1 Models). Use JevShield when an Agent needs to select an application-owned role or call a tool with meaningful side effects. Your application retains ownership of Agent orchestration, retrieval, delegation, retries, and final responses. JevShield is not an Agent runtime, retriever, or workflow engine. Typed decisions use explicit Choice results and statuses.

Quoted from the project's README. Read the full README.

Tagscommunity awesomejev catalog-import

Works forJev for Classification Jev for Routing Jev for Ranking Jev for Moderation

Used inJev for Software & DevTools

Languages: Python

Highlights

Three primitives run on every pass: Choice for risk tier, Noul for is_destructive and Score for a 0 to 4 blast radius.
The blocking rule is explicit: tier at or above threshold with destructiveness over 0.75, or blast radius 3 and up with a true answer.
ProductionPolicy fails closed on evaluator timeout, malformed response, transport error or local-rule failure.
In a headless worker, container, CI job or pod, an ASK with no explicit confirmer is denied immediately rather than waiting.

Watch out

This is a pre-check layer, not an agent runtime: your application keeps orchestration, retrieval, delegation, retries and the final response, and the README says so directly. policy= is required on guard() and guard_langchain_tool(), and the older risk_threshold, interactive and min_confidence decorator keywords are rejected. JevClient defaults to a 2 second HTTP timeout, tunable via JEV_TIMEOUT_SECONDS or the constructor, which under a fail-closed policy turns a slow provider into a denial rather than a slow tool. Development and staging policies keep heuristic fallback for local iteration, and the README warns against using them as a production availability workaround. Tool docstrings and arguments are wrapped as passive data before evaluation, which is framing rather than a sandbox, and there is intentionally no local fast-pass path. Copy reviewed against the repository README on 2026-10-04, not from running it.

Questions about this entry

Short answers drawn from the linked project or page.

More Jev resources like this

dsh-jev-decide

A DSH plugin, published to npm, that registers one agent tool, jev_decide, so a coding agent can ask TypeSafe's Jev a typed question and get a calibrated probability instead of guessing from intuition.

Jev Practices & Patterns#community#awesomejev#catalog-import

Community

nanami-0713/dsh-jev-decideJavaScript

jev-benchmark

Runnable benchmark putting Jev, jev-preview and Claude Sonnet 5 through one real agent task — classifying a tool call as readonly, destructive, privileged or exfiltration — on the same 60 labelled cases, with raw per-call results committed.

Jev Practices & Patterns#community#awesomejev#catalog-import

Community

themsquared/jev-benchmarkPython

decide

pydecide is one Python client for typed System One decisions — Choice, Score and Noul — over hosted Jev, OpenRouter's Decisions endpoint, local laya on PyTorch or MLX, a sentence-transformers CrossEncoder, or a JSON-prompted LLM fallback.

Jev Practices & Patterns#community#awesomejev#catalog-import

Community

gopaljigaur/decidePython

jev-rag-benchmark

Vendor-neutral harness that tests whether Jev reranking improves a small RAG stack, using frozen hybrid BM25 plus BGE-M3 candidates and isolating retrieval, rerank, and generation stages.

Jev Practices & Patterns#community#jevbest#catalog-import

Community

erendikmenn/jev-rag-benchmarkPython

local-jev

Local offline System One server speaking the hosted /v1/systemone wire format, so existing SDK code runs unchanged against small on-machine models.

Jev Practices & Patterns#community#awesomejev#catalog-import

Community

amithgc/local-jevPython

jev-search

Line-oriented semantic search that adds a Jev meaning pass over your own shortlisted files next to exact search. Real search is the default with a key, while dry-run previews the payload offline with no network or credentials.

Jev Practices & Patterns#community#awesomejev#catalog-import

Community

larguesa/jev-searchPython

From the Jev guides

Original write-ups on what this entry is for.

Designing the State: What to Include and What to Drop

Oct 12, 2026

Most Jev accuracy problems are state problems. What belongs in a state, what is a pre-made judgment to leave out, and why naming the slice you ask about matters more than the wording.

Jev Practices & Patterns#state#design#primitives

Read article

Noul, End to End: One Probability and a Dozen Thresholds

Oct 12, 2026

A Noul returns one number and no separate confidence. How to read the value, pin its boundary with criteria, split compound questions, and set a per-action threshold that matches the cost of being wrong.

Jev Practices & Patterns#noul#primitives#confidence

Read article

Scoring Without Measuring: Bands, Rubrics, and Composite Triage

Oct 12, 2026

A Score is a weighted position, not a ruler. Why the number can land between levels, why levels are judged separately, and how to combine several atomic scores in code instead of one crowded rubric.

Jev Practices & Patterns#score#primitives#scoring

Read article

Back to all resources

From the Jev community

Posts from builders shipping with Jev right now.

Follow @typesafeai