Conduct Registry
Browse the Conduct Registry.
Playbooks are how Guard responds: incident response, approved production changes, and remediation. Every playbook combines a brain block for reasoning, a guard block for policy enforcement, approval gates for consequential actions, and hash-chained evidence for every decision.
Compliance packs
5 shippedPre-built rule sets, one per compliance standard. Each pack is enforced by the same Guard engine that runs your custom policies.
Rule set for OWASP LLM security categories — insecure output handling, model DoS, and related risks.
Hook-scoped rules that fire on file edits and writes for SOC 2 Trust Services Criteria.
45 CFR §164.312 Technical Safeguards — access controls and transmission security.
Requirements 3.3.1 and 3.3.2 — mask PANs, avoid storing sensitive authentication data.
Detection pack for common LLM prompt patterns that indicate untrusted or adversarial input.
20
Shipped playbooks
15
Compliance packs
6
BYO gateway adapters
3
Enforcement surfaces
What every playbook is made of
Playbooks are not scripts. They are structured compositions of typed blocks. The same block types appear across every playbook — which means policy, approval, and evidence are never bolt-ons.
Reasoning step. Reads context, decides what to do next. One brain per decision boundary.
Policy check. Every action that touches an external system passes through a guard block before it executes.
Human-in-the-loop gate. Pauses the run and routes to Slack or Lens until a human decides.
Hash-chained receipt for every decision in the run. Replay any action, answer any auditor.
Incident Response
3 playbooksincident-responder
Triages on-call alerts, collects context, and pages the right owner. Guard checks before any action.
postmortem-drafter
Drafts a structured postmortem from incident timeline and Slack threads.
ai-incident-drill
Runs a synthetic incident scenario to test your response runbook.
Security
4 playbooksai-risk-assessment
Assesses AI-generated code for risk patterns mapped to the OWASP Agentic Top 10.
thirdparty-autopilot-fix
Autopilot that triages and fixes issues surfaced by third-party security scanners.
compromised-support-agent
Demo: a support agent hit by prompt injection tries credential harvest and exfil. Guard blocks each attempt; the agent falls back to a safe escalation.
nemo-guardrails-demo
Demo: a NeMo-style input rail calls Guard, which blocks a prompt-injection payload with a rule ID and writes a hash-chained audit row.
Governed Changes
4 playbooksrelease-gating
Holds a release until Guard clears all policy checks and a human approves.
dependency-updater
Opens PRs for outdated dependencies; Guard blocks known-vulnerable versions.
multi-env-smoke-test
Fans smoke tests across staging and production in parallel.
security-patch-updater
Automatically applies security patches and routes high-severity changes to human approval.
Monitoring & Observability
4 playbooksnetwork-diagnosis-agent
Diagnoses network degradation by correlating logs and metrics across infrastructure.
codebase-guard-monitor
Monitors Guard activity across your codebase; surfaces policy-coverage gaps.
ai-drift-detector
Detects when AI-generated code diverges from established team patterns.
ai-output-auditor
Audits a sample of AI completions for quality, accuracy, and policy compliance.
Change Review
1 playbooksterraform-reviewer
Static analysis plus Guard policy check on every Terraform plan before apply.
Autopilot & Demos
4 playbooksself-driving-network-approval-demo
Demo playbook: network change requires human approval via Slack before Guard allows.
base-autopilot
Reference autopilot skeleton — extend with domain-specific brain and guard blocks.
autopilot
Full autopilot reference — brain-guided loop with Guard on every action and approval gates.
autopilot-approved
Autopilot variant where every action requires explicit human approval.
Cross-agent extension
The same playbook runs across any agent surface.
Install a playbook once. It governs Claude Code, Cursor, Codex, and custom agents through the same policy engine. No per-tool configuration. No parallel audit trails.
Lens
“Ask Lens: ‘which playbooks ran this week?’”
Coming — Design Partner Preview
Operations will extend the playbook runtime to correlate events across external systems — letting Guard decisions account for what happened before this action, not just the action itself. Available to design partners first.
Every pack runs under Guard enforcement.
Policies apply instantly — no registry.
Step 1
Choose a pack
Browse compliance packs or automation playbooks.
Step 2
Inspect every rule
YAML in the repository. No black-box engine.
Step 3
Install to workspace
One click. Rules apply to every agent surface.
Step 4
Guard enforces
Every decision hash-chained. Every action inspectable.
Start with Discovery. Add playbooks as you go.
Discovery maps what your agents are doing today. Playbooks extend that into governed, repeatable automation — with policy at every step.