The AI proposes. The rules decide.
Local AI planner
A language model on the Guardian box reads the evidence, works out the cause and proposes the next step. It never touches a device directly.
Permission engine
Deterministic rules, not AI, check every single step against your manager’s settings, time windows and hard limits before anything runs.
Typed tools
Narrow, tested actions like “extend DHCP scope” or “block IP”, never “run any command as root”. Each captures the before-state and can undo itself.
Check. Lock. Snapshot. Change. Verify.
- Check The permission engine approves this exact step.
- Credential A short-lived credential is issued from the vault, then revoked.
- Snapshot The before-state is captured so the change can be undone.
- Verify The result is checked. If it fails, Guardian rolls back automatically.
- Re-test The original fault is re-tested before the incident can close.
It shows its working.
Before Guardian changes anything, it records a diagnosis: the root cause, the evidence it relied on and its plan. If it can’t back a conclusion with evidence, it keeps investigating or asks your manager.
Unsure? An action Guardian isn’t confident about is downgraded from Auto to Ask. Two failed attempts on one problem means it stops and escalates.
It sits an exam before it touches your network.
Every release is graded against a lab of deliberately broken networks: DNS failures, DHCP exhaustion, lockout storms, VPN attacks and planted prompt-injection traps. Safety gates are pass/fail. Break one and the run scores zero.