Why not use an LLM to judge whether traffic is safe?

Because a model’s verdict changes with the phrasing, the temperature, and the day — and you can’t take that to an auditor. AnchorGate compiles a deterministic DSL instead: the same input always gets the same verdict, the policy version is on the record, and a human approved the bundle before it activated. LLM-based classifiers can still feed signals in, but the enforcement decision itself is deterministic.

Can I roll out policies without blocking production traffic?

Yes — that’s what verify mode is for. The gate evaluates every request and records the verdict it would have issued, without blocking anything. You watch the decision stream, tune the policy set, and switch to full mode when the refusals you see are the refusals you want.

Who writes the policies?

Either your GRC team in the no-code editor — which emits the exact DSL, not an approximation of it — or your platform team directly in the DSL. Both paths end in the same place: a human-approved, compiled, versioned bundle. There is no policy that activates without sign-off.

What does a verdict look like on the record?

Every enforcement decision is a signed decision event: the verdict, the policy and bundle version that fired, the actor, and what was touched — graded on the evidence maturity ladder. When someone asks why a request was refused three months ago, the answer is on the record, not in someone’s memory.

Inline policy enforcement

Deterministic verdicts, before the request leaves.

A compiled policy DSL runs against every request in the hot path — before it egresses to any model provider. The same input always gets the same verdict, in under 50ms of added overhead. And when the gate can’t evaluate policy, it refuses rather than waves traffic through.

Get started — it's free View on GitHub

The mechanisms

Enforcement you can put on the record

Every mechanism here is named because an auditor will eventually ask about it. These are the four that make enforcement defensible.

A compiled DSL, not a model

Policies are IF condition THEN redact, alert, or block — written or generated in the no-code editor, human-approved, then compiled into a versioned bundle the proxy evaluates. No LLM judging LLMs: enforcement is deterministic and auditable.

Fail-closed where it matters

In full mode, no policy evaluation means no egress. Refused means refused at the gate — not logged later. Telemetry is the deliberate opposite: fail-open with a durable local spool, so observability loss never blocks your product.

Deontic verdicts

Four outcomes, each on the signed record: admitted, narrowed, refused, quarantined. High-band risks from the 5×5 risk matrix synthesize quarantine rules automatically — a matching session is held and a human is alerted.

An honest on-ramp

Start in verify mode: the gate observes and records verdicts without blocking anything, so you build confidence in your policy set on real traffic before turning enforcement on.

The policy DSL

IF condition THEN verdict. That’s the whole trick.

Policies are conditions and actions, nothing else — written in the no-code editor or directly in the DSL, reviewed by a human, and compiled into the versioned bundle the proxy evaluates. Because the language is deterministic, a policy review is an actual review: what you approve is exactly what will execute.

Actions are deontic: redact, alert, block, quarantine — no scores to interpret.
Bundles are versioned; the version that fired is on every signed decision event.
Quarantine rules are synthesized automatically from high-band risks in the register.

In the box

What ships today

Deterministic policy DSL: IF condition THEN redact, alert, or block
Human approval before a policy bundle activates
Compiled, versioned bundles evaluated in the proxy hot path
Under 50ms added overhead — regression-gated in CI
Fail-closed in full mode: no evaluation, no egress
verify mode: observe-only enforcement for rollout
Verdicts admitted · narrowed · refused · quarantined
Quarantine rules synthesized from high-band risks, human alerted
Policy version recorded on every signed decision event
No-code policy editor that emits the exact DSL

As shipped in AnchorGate v0.1 — every line above is checkable against the repository.

<50ms: added overhead — inline enforcement, regression-gated in CI
4: deontic verdicts: admitted · narrowed · refused · quarantined
3: interception modes: full · verify · dns-redirect

Budgets as shipped and CI-gated in AnchorGate v0.1.

FAQ

Policy enforcement questions

Why not use an LLM to judge whether traffic is safe?: Because a model’s verdict changes with the phrasing, the temperature, and the day — and you can’t take that to an auditor. AnchorGate compiles a deterministic DSL instead: the same input always gets the same verdict, the policy version is on the record, and a human approved the bundle before it activated. LLM-based classifiers can still feed signals in, but the enforcement decision itself is deterministic.
Can I roll out policies without blocking production traffic?: Yes — that’s what verify mode is for. The gate evaluates every request and records the verdict it would have issued, without blocking anything. You watch the decision stream, tune the policy set, and switch to full mode when the refusals you see are the refusals you want.
Who writes the policies?: Either your GRC team in the no-code editor — which emits the exact DSL, not an approximation of it — or your platform team directly in the DSL. Both paths end in the same place: a human-approved, compiled, versioned bundle. There is no policy that activates without sign-off.
What does a verdict look like on the record?: Every enforcement decision is a signed decision event: the verdict, the policy and bundle version that fired, the actor, and what was touched — graded on the evidence maturity ladder. When someone asks why a request was refused three months ago, the answer is on the record, not in someone’s memory.

Enforce it in the path, or don’t call it policy.

A policy PDF nobody executes is a wish. Put a compiled, fail-closed policy bundle in front of your LLM traffic this afternoon — the full stack is open source.

Deploy the stack

or email hello@anchorgate.ai