EVE vs Prompt Filtering
A common first control for AI agents is prompt filtering — screening or rewriting the text sent to or returned by a model. This page compares that approach to EVE, sourcing only EVE's capabilities from the EVE claims registry. Prompt filtering is a general technique rather than a single product, so we describe its typical properties; rows we cannot source are marked "not independently verified here."
Positioning
Prompt filtering operates on text at the model boundary — blocklists, pattern matches, classifiers, or an LLM judging another LLM's input/output. EVE operates on the action: it makes a deterministic decision (ALLOW / BLOCK / MODIFY) before a governed action executes, with no LLM in the decision path, and produces signed evidence bound to each decision that is verifiable offline without trusting the EVE server.
The difference is the control point and its determinism. Prompt filtering tries to catch bad text; EVE governs whether a tool call or side effect proceeds, with a decision computed by deterministic policy code rather than a model.
Capability matrix
| Capability | EVE | Prompt filtering (technique) |
|---|---|---|
| Deterministic pre-execution decision on a tool call / side effect | Yes — PILOT_READY | not applicable (operates on text) |
| No LLM in the governance decision path | Yes — deterministic policy code; PILOT_READY | LLM-judge filters are model-driven; not independently verified here |
| Signed decision evidence bound to the decision | Yes — SUPPORTED | not independently verified here |
| Offline independent verification (Python / Node / browser) | Yes — SUPPORTED | not independently verified here |
| MCP approved-vs-executed binding (at-most-once) | Yes — PILOT_READY | not applicable |
| Action-sequence governance (block prohibited combinations) | Yes — PILOT_READY | not applicable (per-message text) |
| Deterministic budget / resource limits | Yes — PILOT_READY | not applicable |
| Deterministic file-content scanning with signed scan evidence | Yes — PILOT_READY | not independently verified here |
| Screening / rewriting model input and output text | not the focus of EVE's sourced claims | Yes — the purpose of prompt filtering |
Where EVE fits
Use EVE when the risk is the action an agent takes, not only the wording of a prompt. Text filters can be evaded through paraphrase, and an LLM-judge filter puts a model in the decision path; EVE's verdict is computed by deterministic policy code with no LLM in the decision path, so the same input yields the same decision. EVE can also detect the real media type of an ingested file from its content and block, quarantine, or require approval before use, emitting signed scan evidence — a control that operates on artifacts, not prompt text.
Prompt filtering and EVE are complementary layers: screen the text, then govern the resulting action with a deterministic decision and independently verifiable evidence.
Readiness
- EVE SDK core is a RELEASE CANDIDATE WITH EXCLUSIONS.
- Python (
eve-coreguard0.2.2) and TypeScript (@eve/coreguard0.1.0-rc1) are release-candidate core clients, distributed privately for pilots — not on public registries at this stage. - Core governance architecture is pilot-validated; signed evidence and offline verification are SUPPORTED. Artifact scanning is customer-pilot ready at supported boundaries.
- Framework adapters other than the generic adapter are experimental.
Limitations
- EVE's rows are sourced. "Prompt filtering" is described by its typical properties, not a specific product; rows we cannot source are marked "not independently verified here."
- The pip client governs via hosted mode (needs an endpoint); embedded evaluation is the EVE service.
- Independent verification requires the Ed25519 public key; the HMAC fallback is not independently verifiable.
- Deterministic scanners are pattern/structure-based; OCR, vision, and QR/barcode reading are probabilistic and disabled by default, and incomplete extraction is reported as partial.
- MCP binding is at-most-once, not remote exactly-once.
- Framework adapters other than the generic adapter are experimental; wrapper-enforced adapters are bypassable by a direct underlying-tool call, and hard enforcement requires a gateway or sidecar.
- EVE governs the action and evidence layer; it does not replace text-level screening of prompts and responses.