Conduct is Guard: the all-in-one AI compliance and security platform.
One platform. One control plane for every AI call, every security finding, every fix, every audit line. Guard is the wire, Guard is the loop, Guard is the evidence. Everything Conduct ships lives under one compliance and security surface.
The problem with breadth
Over the last quarter Conduct shipped 36 playbooks. PR reviewers, release notes generators, incident responders, dependency updaters, docs drift detectors, flaky test triage, third-party autopilot fix, bulk PR reviewers, terraform reviewers. All useful. All shipped. All in the registry, all working today.
But if you asked five people what Conduct is, you got five answers. Governance platform. Playbook framework. Security loop. AI cost control. Compliance evidence engine. Every answer was partially right, which meant every buyer had to work out for themselves which part applied to them. That's a bad demo, and it's a slow deal.
So we're collapsing the pitch surface into one thing. Guard. The all-in-one AI compliance and security platform.
One platform — Guard
Guard sits synchronously on every AI call your engineers make. Claude Code, Cursor, Copilot, Windsurf, ChatGPT desktop, Claude desktop, Codex. Any LLM API call routed through the Guard proxy. Every MCP tool call. Every playbook block that talks to a model.
For each call, the policy engine returns allow, warn, or block before the call proceeds. Fail closed. Hash-chained audit trail. The governance decision is a first-class artifact, not a log line.
Guard answers a specific question a CISO gets asked by their board: what is the AI in our environment actually allowed to do, and where is the proof?
The security loop is part of Guard
Guard catches things at the wire. The same platform catches things in the code. Scanner runs, threat model runs, third-party audit runs, all file into one findings table inside Guard. Findings above a threshold chain into an autopilot-fix playbook that drafts the mitigation PR. A human approves. A metric moves. Same identity, same audit chain, same dashboard.
The loop is what turns a scanner from a checklist into an outcome — and because it's the same platform as the wire-level control, it's also the compliance artifact. Every call, every finding, every fix, every approval is one hash-chained entry. SOC 2 CC7.3, PCI DSS 12.3.1, ISO 27001 A.14.2.1, the EU AI Act — all point at the same table.
Everything else runs on Guard
The PR reviewer playbook still ships. The release-notes generator still ships. Incident responder, dependency updater, docs drift, flaky test, all still ship. Installable from the registry, documented, supported, on the roadmap.
They all run under Guard's policy, spend, and audit envelope. Every playbook call is a Guard call. Every fix is a Guard-signed artifact. There is no second product — the registry is Guard's workload catalog.
Why this is the right cut
Autopilot-for-general-dev is a crowded market. Cursor, Copilot Workspace, Devin, Cognition, GitHub Agent HQ — a lot of well-funded companies fighting for it. We can't win on breadth there, and we shouldn't try.
Compliance and security outcomes are measurable. MTTR, findings fixed per week, blocks per day, compliance evidence per audit, spend under policy. One platform for all of them collapses tool sprawl in the exact place a CISO is being asked to justify AI adoption.
Guard is a control. Guard is the evidence. Guard is the remediation loop. All three are things CISOs already know how to buy. We're not inventing a new category — we're taking the AI compliance and security stack that's stuck across five tools and putting it on one shelf.
What this changes for you
If you already use Conduct: nothing about the code. Every playbook you installed still works. Your Guard rules still enforce. Your loop still runs. It's all Guard now, in name and in surface. The website will get simpler. The demo will get shorter.
If you're evaluating: the pitch is now short enough to fit on one screen. One platform for AI compliance and security. Wire-level governance, closed-loop remediation, hash-chained evidence. Fifteen-minute demo, three questions, a decision either way.