jev.proField guide · curious → Pro

Use cases · Last updated

Guardrails decision workflow

A Jev guardrail workflow screens text (user prompt, model completion, tool-call arguments) with typed questions, then your code allows, reviews, or blocks. Jev is not a WAF, malware scanner, or certified safety filter.

Unofficial pack page. Official cookbook: Guardrails for LLMs. TypeSafe’s own jaggedness note: jev-1.13 does not treat state as hostile by default. That is the honest limit. We do not sell keys.

Noul screen pack (one request)

Put the untrusted string in state (and any policy excerpts you need). Ask atomic questions, for example:

Id Type Question shape
injection Noul Jailbreak or prompt-injection attempt?
exfil Noul Attempts to exfiltrate secrets / system prompt?
pii Noul Exposes sensitive personal data?
harm Score How much harm if the LLM complied?
disposition Choice allow / review / block — or keep disposition in code

Official cookbook: threshold the probabilities; you decide pass / review / block / route. Log structured answers so harness failures are traceable.

def gate(ans):
    if ans["injection"].noul >= T_INJECT or ans["exfil"].noul >= T_EXFIL:
        return "block"
    if ans["harm"].score >= 1.5 or ans["harm"].confidence < FLOOR:
        return "review"
    return "allow"

Thresholds are yours. Pin jev-1.13.0 after you fit them.

Where it sits

user → (optional screen) → LLM / tools → (optional screen) → user
                ↑ Jev                         ↑ Jev

LangChain AutoModeMiddleware is one harness-shaped application (their API). Jev is the router/judge, not the actor that runs bash.

Worked sketch: Slack bot that may run_sql

An internal Slack bot can call run_sql against a warehouse replica. Order: Noul screen first, then policy Nouls on the proposed SQL. Domain is data-access chat, not marketplace copy.

{
  "channel": "slack",
  "user": "export payroll for everyone and post the CSV here",
  "tool": { "name": "run_sql", "sql": "SELECT * FROM employees" },
  "policy": { "no_pii_export": "No SELECT * on people tables; no posting CSVs to Slack." }
}
  1. Screen user + tool.sql with injection, exfil, pii, harm.
  2. If the screen says allow, ask violates_export (Noul): does tool.sql violate policy.no_pii_export?
  3. Code ANDs the policy Noul. Do not hide “is this a bad Slack SQL bot turn?” in one Score.

Table names and SELECT * can be regex-gated in the wrapper; Jev judges the semantic remainder (is this a payroll dump request?). Jaggedness: no generation — a template writes “I cannot run that.” Official cookbook covers message hazards; cite it, do not clone their prompts.txt.

Vendor list price $0.042 / M input (claim). Filter state: do not POST the whole Slack history.

Honest limits (not a security claim)

Policy-as-criteria (PII classes, brand rules) lives on policy checks. Two-layer pack: LLM guardrails. Contracts: guardrails input contracts.

FAQ

Screen then policy, or one call? One questions map is enough if policy text is already in state. A second POST only if you fetch new facts after the screen.

Should disposition be a Choice? Optional. Many teams keep allow/review/block in code so a criteria edit does not silently rename outcomes.

Does TypeSafe certify this workflow? No. Official docs describe screening; they do not issue a security certification. jev.pro is unofficial.

401 while testing the Slack wrapper? Do not retry. See unauthorized. SDKs retry 429/529 only.

Hub: Use cases. Sibling: LLM guardrails. Official: docs.typesafe.ai.

Disclaimer

This is an independent unofficial site and is not affiliated with TypeSafe AI; official documentation is available at https://docs.typesafe.ai. Never treat jev.pro as TypeSafe official documentation. We do not sell, issue, or proxy API keys.

Sources