How he works

Two judgements per turn, at the two moments they can still change something

Ron is not a wrapper around your model and not a proxy that reads messages. He is asked twice on every turn — once before the prompt reaches the model, once after it comes back and before the agent acts — and each time he answers within the budget the caller is already holding open.

The two seams

Before the model, and before the action

These are the only two places a decision is worth anything. Earlier, there is nothing to judge; later, the action has already happened and all you can write is an incident report.

the shape of a turn

one turn, two seams — Ron is asked twice

  user / caller
        │
        ├─▶  step/request   ─▶  [ RON ]  ─▶  model
        │                         │
        │                         └─ is this prompt an injection?
        │                            is a secret about to leave?
        │
        │    model replies with a tool call
        │
        ├─▶  step/response  ─▶  [ RON ]  ─▶  the tool actually runs
        │                         │
        │                         └─ should this action happen at all?
        │                            is it inside the agent's mandate?
        │
        └─▶  next step carries the tool RESULT — judged as input again

The tool result is deliberately judged as input on the next step: it is not evidence, it is text an agent is about to believe.

Where he sits

At the gateway, or inside the harness

At the gateway

One plugin on the AI gateway your agents already call. Every agent behind it is covered — including the ones nobody registered — and the agent's own code is untouched. This is the position that scales to a fleet.

Inside the harness

A plugin for the coding harnesses, sitting on the HTTP client rather than on a hook — which is the only place that sees the system prompt as well as the messages. It also masks secrets on the host, so the value never leaves the machine at all; a gateway is one hop too late for that.

Both positions speak the same open protocol, and when both are present Ron recognises the duplicate and judges the step once.

What he reads

He reassembles the conversation first

A gateway sees one request at a time, the way a firewall sees packets. Ron reassembles them into sessions → turns → steps → calls before judging, because most of the questions worth asking are not about one message: whether a tool result answers the call that asked for it, whether an instruction arrived from a person or from a page the agent fetched, whether this conversation has anybody in front of it at all.

That is also what makes an answer explainable afterwards — the console shows the whole conversation around a finding, not a stray sentence with a score attached.

What you configure

Per workspace, in one file's worth of settings

A workspace is a group of agents plus one policy. Each guardrail is on or off, and what each risk level costs is yours to set — the same finding can be a note in one workspace and a refusal in another.

a workspace policy

workspace: support-agents
mode: enforce                 # or observe: judge everything, stop nothing

guardrails:
  command-danger:      block on high        # destructive / persistence / exfil
  permission:          block on high        # tools this agent may not call
  prompt-injection:    block on medium      # on the way IN
  indirect-injection:  block on medium      # in what it fetched
  secrets:             redact on any        # masked on the host, before egress
  pii:                 redact on high
  content-safety:      block on high        # what the agent itself says

observe is the honest way to start: everything is judged, nothing is enforced, and the console marks what would have been stopped — never as though it had been.

What he leaves behind

A record you can argue with

Every evaluation records which policies and guardrails were considered, which judges ran, what they cost, what they found — and, for the ones that did not run, the routing reason why. “Judged and clean” and “nobody looked” are different answers, and a security console that cannot tell them apart is not one.

one step, as recorded

# every decision, kept — not only the ones that stopped something
session   ses_8c1…   support-bot · 34 turns · 2 findings
 └ turn   trn_2f0…   "book the flight and email the receipt"
    └ step st-1f7c9a  model_output
       ├ guardrails run: command-danger, permission, secrets, pii   (4 checks)
       ├ judge calls:    1 · 148 ms · 0 timeouts
       └ finding:        security.malicious_command · high · BLOCKED

What it costs

Inside the budget the caller already has

Ron answers inside a bounded budget, and the budgets are ordered so that whoever runs out of time first can say so. Deterministic checks run beside the model judges rather than in front of them, and a step nobody is waiting on — the recording half — is judged off the critical path entirely. If a judge cannot answer in time, that is reported as an unjudged path rather than passed off as a clean verdict.