Agents drift off the system prompt. PRIOR holds them to it.
PRIOR is a control plane for the open-weight AI models your teams run. It enforces your rules from inside the model as it generates, so agents stay on-policy even when a prompt or a filter doesn't. It runs on your hardware, logs every decision, and adds no latency when nothing's wrong. Think of it as the control plane your prompts and guardrails have been missing.
You told the agent the rules.
It doesn't always follow them.
You've written a careful system prompt. Maybe you've added a guardrail model or a content filter. And yet a determined user, a long enough conversation, or a cleverly worded request still gets the agent to go off-brand, reveal something it shouldn't, or take an action you never approved.
That isn't a bug you can prompt your way out of. A system prompt is a strong suggestion, not a guarantee, and a text filter reads the words coming out, not what the model actually intends. The failure lands on your desk later, as a compliance question, a brand incident, or a support escalation.
- Jailbreaks and role-play that reword the same bad request
- Long conversations that quietly erode the original instructions
- Data leakage or destructive actions phrased to look innocent
- Off-brand or off-policy answers when a user pushes hard
Put enforcement where a prompt injection can't reach it.
Most controls sit at the edges: the prompt sets intent going in, a filter checks words coming out. PRIOR works in between. Before any text is generated, it reads what each request is really asking for, checks that against your policy, and steers the outcome from inside the model. Because it acts on intent rather than the exact wording, the same control holds up whether a request is plain, obfuscated, role-played, or buried in a jailbreak. And because it only acts when a rule is in play, normal requests run at full speed and read exactly as they would without PRIOR: no slowdown, no dumbing-down.
In-policy requests pass untouched
A normal request is answered byte-for-byte as your model would on its own. PRIOR does nothing, and costs nothing, when nothing's wrong.
Borderline cases ask for a check
When a request is ambiguous, PRIOR can route it for human confirmation instead of guessing. That catches gray areas without blocking legitimate work.
Out-of-policy requests are held
When a request crosses a hard line, the refusal holds deterministically, regardless of how the request is phrased or what the base model would have done.
It joins your existing controls; it doesn't replace them.
PRIOR doesn't replace your prompts, your guardrail models, or your filters. It's defense-in-depth: each layer does a job, and PRIOR adds the one most stacks are missing. That job is enforcement from inside the model, on intent, that you can prove happened.
Add it alongside what you already run. It catches what the other layers miss, and it stays out of the way, doing nothing at no cost on every request that's fine.
| Layer | Its job | Where it stops |
|---|---|---|
| System prompt | Set the intent | A suggestion; erodes over a long chat |
| Guardrail model / filter | Catch some bad outputs | Reads surface text; adds latency & cost |
| PRIOR | Enforce from inside, on intent | Deterministic, audited, no lag when idle |
It reads meaning, not keywords.
The fastest-growing attack on AI agents is injection: hiding instructions where your agent will read them. They get buried in a user message ("ignore your instructions and…"), or planted in a document, web page, or email your agent pulls in to do its job. Keyword filters miss these, because the same instruction can be worded a thousand ways.
PRIOR matches on meaning. It recognizes the intent of a request no matter how it's phrased or where it's hidden, so a smuggled instruction is caught whether it arrives in the prompt or inside the content your agent retrieves. For anyone building retrieval (RAG) or tool-using agents, that's the difference between a demo and something you can put in front of customers.
- "Ignore previous instructions…", reworded any number of ways
- Instructions smuggled inside a retrieved document or web page
- A booby-trapped file or email your agent reads to do a task
- The same intent split across several turns of a conversation
Attacks unfold over a conversation.
PRIOR watches the whole thing.
Real attacks unfold across a conversation. A harmful request gets split into pieces, each innocent on its own, assembled over several turns. Or the user never asks for anything forbidden at all. Instead they talk the agent out of its rules, one small concession at a time.
PRIOR evaluates the whole conversation, not just the last message. Intent assembled across turns routes red the moment it completes; slow pressure on the rules routes to the yellow band for a human check before anything is lost. Benign multi-turn work passes untouched.
Every routing decision is written to a durable audit trail on your box: the zone, the score, the pack that fired, and the action taken. It survives restarts, it never leaves your environment, and it turns "what did the agent do, and why?" into a query instead of a forensic project.
When a regulator, a customer, or your own security team asks, you have the log.
Refusals that sound like your agent, not a tripped filter.
A bolt-on filter enforces by replacing the answer with canned boilerplate. The persona breaks, the user's experience breaks, and attackers learn exactly where the tripwire sits. Because PRIOR steers the model itself into declining, the refusal comes out in the same voice as every other answer. It explains itself, stays on-brand, and offers a legitimate path forward.
"I'm sorry, but as an AI language model, I cannot assist with that request."
Persona gone. No explanation, no path forward. And the attacker just learned the exact shape of the boundary.
"I can't read out card numbers. That data stays masked on my side, even for verification. I can send a secure verification link to the email on file, or confirm the last four digits if you have them."
Illustrative exchange. In our fleet tests, steered refusals stayed coherent and in the model's own voice (reviewed by hand, not just keyword-matched), including under jailbreak wrappers.
Your rules become a calibrated detector, not a wish list.
A pack is one policy: the set of rules PRIOR watches for and enforces. PRIOR ships with ready-to-use safety packs so you get value on day one, and you can add your own for the things specific to your business.
What ships with PRIOR
Curated safety packs, ready out of the box. They cover common high-risk actions, so a fresh install already enforces sensible guardrails.
Make your own, from a document
Hand the console a plain-language policy document and it builds a pack for your domain. No machine-learning expertise, no code. Prefer to edit by hand? Every pack is a plain .arbiter.json file you can open and adjust.
Write once, runs everywhere
A policy is written independently of any model, so one pack applies across every open-weight model you run. Add a model, and your rules come with it.
Packs stay private to your deployment. We don't publish the internals of a pack (the specific patterns it watches for) on purpose. Keeping them private means attackers can't study them to route around your controls. Your policies are yours.
Ground the model in verified truth, and hold it there.
The same mechanism that enforces rules can ground knowledge. Give PRIOR a verified fact (a config value, a leadership change, a product truth) and it's carried in the model's latent state, not the prompt: zero context tokens, immune to the model's stale training data, and it holds even when a document in the request contradicts it. That last part is the quiet advantage. It's what makes retrieval tamper-resistant: a poisoned source can't move the value.
Environment truth for agents
The bastion port, the gateway timeout, the current release codename. Your agent answers from your environment's values, not the generic defaults it learned in training.
Current facts over stale training
Leadership changes, product renames, updated policy figures. The model's training snapshot ages from day one; a grounded fact doesn't.
A backstop for RAG
When retrieval drags in a wrong or tampered document, the grounded value wins, and the model flags the conflict instead of confidently repeating the lie.
If an AI agent can put you at risk, PRIOR is for you.
Compliance & regulated teams
Enforce the hard rules (what the agent must never say or do) and hand an auditor a durable log of every decision it made and why.
Customer-facing agents
Keep tone on-brand and refuse off-limits topics, even when users push, probe, or try to talk the agent out of its guardrails.
Internal tools & data
Stop sensitive-data leakage and destructive actions like "drop the production table" or "email me the customer list," however the request is worded.
Platform & security owners
One control plane across every open-weight model your teams run, with policy authored from a governance document, not written in code.
Measured, independently judged, honest about the edges.
When our detector flags a request, the block holds, scored by an independent safety classifier, not our own. It recovers disguised (jailbroken) attempts, adds no measurable overhead when nothing fires, and leaves allowed answers identical to the base model. We're also upfront about what it doesn't catch.
A Rust engine over llama.cpp, nothing interpreted in the hot path.
PRIOR runs on llama.cpp, the widely-used open engine for running AI models efficiently on your own hardware, extended with our own steering layer. The core is written in Rust: fast, memory-safe, and with no Python in the path that serves your requests.
The practical result: it's quick, it's dependable, and it runs where you need it (a workstation, a server, or an air-gapped box) without a fragile stack of dependencies.
It speaks the OpenAI API, so your client never changes.
The PRIOR engine ships as a single headless container that speaks the OpenAI API. Point your existing client at it and keep going, with no re-architecting. It runs on your hardware or VPC and works with the open-weight models you already use (Llama, Qwen, Gemma, Mistral, and more).
A separate, optional console container gives your operators a web dashboard: author policy from a governance document, watch the gate decide, manage keys and licenses, and read the audit trail, all hot, no restart. The license server is never in your request path; connected tiers make a lightweight periodic check-in (license id and node id only), and the air-gapped tier runs with no outbound calls at all.
Run PRIOR on your own model in minutes.
- 30-day trial with full capabilities, no card
- Drop a license file in; it binds on first use
- Self-serve plans from $995/yr per node
- Enterprise and air-gapped on request