An instruction injected through a person's turn, a tool result or a retrieved document is refused before the model receives it, and so is a secret. A secret in the answer is withheld from the agent. Every call leaves a record of the model you asked for and the model that actually answered.
{
"type": "tool_call",
"agent": "excubitor.enforce",
"payload": {
"phase": "provider",
"decision": "answered",
"provider": "self-hosted",
"model": "acme-assist-70b",
"served_model": "acme-assist-70b",
"substituted": false,
"status": 200,
"duration_ms": 1184,
"input_tokens": 2210,
"output_tokens": 312
},
"evidence": {
"input_hash": "4be0…19",
"output_hash": "c7a2…f0"
}
}
Injected instructions and secrets are refused before the call is sent. Personal data is recorded, and refused when you choose.
The model you asked for against the model that answered, the status, the time and the tokens the provider reported. A different model answering is flagged.
Point an application's model address at the model proxy and every call is read, refused, withheld and recorded exactly as in the package.
The standard chat completions format, the messages format, local model servers and the generateContent format, hosted or on your own hardware.
It is not scanned for injection, so an agent whose prompt says "act as" is not refused. A secret in it still is: a key in a prompt leaves with every call.
A run that keeps trying to send injected instructions is contained after three attempts in ten minutes.
Runs beside the gateway, holds no key, and passes your provider key through without recording it. A refused call answers 403 with the rule and the record.
Every item names the release that carries it. Releases are signed, and each lists the commands to check them before you install.
Model-call inspection: injection, secrets and personal data on the way out, secrets withheld on the way back; runs contained on repeated injection.
One record per model call with the provider, model asked for and model that answered, status, time and tokens. The model proxy, and its chart.
No standing vendor access, ever. Managed with evidence, never on faith.