Prompt guardrail

Package: @zox/judge. Optional TypeSafe Jev review runs on human prompts (not subagent task prompts). Off by default.

Enable

Set TYPESAFE_API_KEY (or judge.apiKeyEnv) and:

{
  "judge": {
    "enabled": true
  }
}

Outcomes

• allow — continue
• ask — you must confirm; --auto-approve does not skip this
• deny — no model call

Jev (TypeSafe System One) answers structured noul questions:

• injection — override system / tools / sandbox / hooks.
• policy_violation — user request vs the policy string (secret leak, crime, disable sandbox, …).

Scores P(yes) + confidence map to bands (defaults in packages/judge/src/defaults.ts):

Tune with judge.prompt.injection / policyViolation (denyMinYes, denyMinConfidence, askMinYes, askMinConfidence).

Fail-open

Subagents: task turns set skipJudge so model-written prompts are not treated as user injection.

Events: prompt.guardrail, prompt.blocked, prompt.permission_required. Eval runner answers prompt-ask with approved: false (does not silently continue).

Related

• Permissions — prompt vs tool permission
• Configuration — judge strict schema