Comparison

EVE CoreGuard vs Open-Source Agent Guardrails

Open-source guardrails are good and getting better. This page is not an attack on any of them — it is an honest account of what most application-side guardrails provide, and where EVE differs. Every EVE claim below links to source, a test, a sample certificate, or a demo you can run in five minutes.

Run it yourself first. The claims here are backed by examples/quickstart/ — one command produces an ALLOW, a BLOCK (whose side effect never runs), a WITHHELD model output, a signed eve.decision.v3 certificate, and offline verification in Python and TypeScript, plus tamper-evidence. See the five-minute quickstart.

What open-source guardrails typically provide

Depending on the project, application-side guardrails may offer: policy checks, action interception, human approval, prompt/output scanning, anomaly detection, hash-chained receipts, and an application-local audit trail. These are real and useful. The difference is not usually whether a decision is made — it is whether a party that does not trust the application can later verify exactly what was decided, over which inputs, under which policy, and that the result was enforced before the side effect.

Side-by-side

"Varies" means behaviour differs across projects and we have not independently verified a specific competitor — we will not assert "No" about software we did not test.

Capability	Typical application guardrail	EVE CoreGuard	EVE evidence
Pre-execution policy check	Yes	Yes	`core/coreguard/evaluator.py`; quickstart
Tool-call / action blocking	Yes	Yes	`core/governance/governed_execution_gate.py`; test `tests/test_governed_execution_gate.py`
Human approval	Sometimes	Yes	Action Registry propose/approve/execute
Prompt / output scanning	Sometimes	Yes	policy packs incl. `pii_handling_v1`, `harmful_content_v1`
Fail-closed external-action boundary	Varies	Demonstrated	`interfaces/gateway/forward_proxy.py` (451 + signed cert); `validation/sidecar_brutal_pass.py`
Request and response binding	Varies	Demonstrated	request/response digests in `eve.decision.v3`; test `tests/test_coreguard_audit_binding.py`
Policy & rule-result binding	Varies	Demonstrated	`rule_results_sha256` + `policy_version` in the signature
Portable signed decision certificate	Varies	`eve.decision.v3`	certificates; sample in `examples/quickstart/evidence/`
Independent OFFLINE verification	Varies	Python, TypeScript, browser	`scripts/verify_eve_decision.py`, `examples/quickstart/typescript/verify.mjs`, /verify
Cross-language negative vectors	Varies	Demonstrated	`python scripts/verify_quickstart.py` (tamper -> FAIL in both languages)
Replayable governance decision	Varies	Demonstrated	`CLI/replay_verify.py`; anti-replay `core/coreguard/replay_guard.py`
Separate evidence plane	Varies	EVE architecture	`core/coreguard/evidence.py`, durable `data/audit/`
External witnessing & custody	Varies	Preview (not shipping)	EVE Trust Services — see Limitations
Response-admissibility governance	Varies	Demonstrated	`response_disposition=WITHHELD`; post-response gate `core/model_routing/governed_router.py`

Honesty note. "External witnessing & custody" is a preview in EVE — it is described on the Trust Services page but is not implemented in this codebase, so it is marked accordingly here. See Limitations. We do not present preview capabilities as shipping, and we do not claim benchmarks (e.g. latency) that are not measured in the repository.

The one difference that matters

Most guardrails answer "did my application allow this?" EVE additionally answers "can a third party who does not trust my application confirm what was decided, over exactly these inputs and this policy, and that a blocked side effect did not run?" — offline, with only a public key. That is the portable eve.decision.v3 certificate, and it is why the quickstart ends by tampering one field and watching verification fail.