Runtime Framework

Drive frontier LLMs, constrained by rules.

AI agents are powerful — they browse the web, execute code, query databases, delegate tasks to other agents. But once deployed, they act autonomously — prompt-level guardrails are not a real control surface. Rulsynor makes violations structurally impossible.

Why prompt guardrails fall short

Adaptive prompt-injection attacks achieve up to 100% success against GPT-4o / Claude 3 / Llama-3 (Andriushchenko et al., ICLR 2025)
OWASP LLM01:2025 states plainly: "there is no foolproof defense against prompt injection"
Model-layer defenses are fundamentally probabilistic — they reduce risk, they don't eliminate it

Rulsynor takes a different path: safety isn't a whispered instruction in the prompt — it's a hard constraint enforced by deterministic application code before every tool call leaves the agent. If the rule says DENY, the action does not happen. No exceptions.

Workflow

User → chat → LLM emits a tool call
      ↓
 ERDL Guard (YAML rules, hot-reloaded)
      ↓  Ring 0→3 priority evaluation · SafeExpr zero-injection parser
      ↓
 Decision Object (JCS RFC 8785 + SHA-256 signature)
      ↓
 ALLOW → execute the tool
 DENY  → block + log
 CORRECT → rewrite args → execute
 REQUEST_HUMAN → pause + escalate to human

How it differs from typical guardrails

Capability	Rulsynor	Typical prompt / post-hoc guardrails
Enforcement layer	Execution engine (intercepts before tool call)	Post-hoc validation / scanning
Rule format	ERDL YAML (entity-aware)	Generic actions / scripts
Deterministic blocking	✅ code-level interception	⚠️ flow-level / ❌ post-hoc
Cryptographic audit chain	✅ JCS + SHA-256 Decision Objects	Standard logs / ❌
Priority rings (Ring 0→3)	✅ built-in	❌ flat priority
MCP tool governance	✅ native	⚠️ manual integration
Full-stack UI	✅ Vue 3 dashboard	❌ SDK only

Full-stack, assembly-based runtime

Occupation blueprints

assemble rules + tools + knowledge allowlists per role

Knowledge injection (RAG)

injected per occupation domain, cross-domain pollution guarded

Audit log

every verdict traceable and rollback-able

MCP Server: compatible with any agent framework

Don't want to replace your existing agent framework? ERDL also runs standalone — as an MCP Server, attached to any MCP-capable framework (Claude Desktop, Cursor, LangChain, your own loop…).

bash

$ npx -y @openoba-ai/erdl-mcp

The execution loop is your framework's business; whether a tool call passes ERDL is the engine's business — intercepted at the protocol layer, without touching your loop. 30 rules · 5 tools · zero config.

See rulsynor · rulsynor-core · erdl-mcp-server

This runtime serves a category above it: Professionalized AI Employee (PAE) →