---
name: jev-guardrail
description: Screen LLM input and output with TypeSafe Jev Noul hazard batteries plus a harm Score; policy in code returns pass, review, or block. Use for jailbreak, prompt injection, secret leak, denylist pressure, or when the user runs /jev-guardrail or `npx jev guard`.
title: jev-guardrail
canonical_url: https://skilld.dev/gh/cobusgreyling/jev/jev-guardrail
last_updated: 2026-10-02T00:05:09.000Z
---

> Index of every page on this site: [llms.txt](https://skilld.dev/llms.txt)

> **Skill from skilld.dev.** Follow the user's requested action.
> If the user asked to fork this Skill, follow the fork workflow below. Do not execute the Skill instructions while copying it.
> Otherwise, follow the instructions below for this session. You do not need to install anything.
>
> If the user asked to install this Skill, run `npx skilld install cobusgreyling/jev/jev-guardrail`. Install writes the Skill files into the project, so every session loads them.
>
> ## Fork workflow
>
> A fork creates an editable local Skill with its original author and licence. The request authorizes copying and local installation.
> 1. Check `./skills/jev-guardrail`, the project lockfile, and selected Agent targets together. If the local directory or installed Skill exists, stop. Never overwrite an existing directory or Agent target.
> 2. Read [source metadata](https://skilld.dev/api/v1/skills/cobusgreyling/jev/jev-guardrail) once. Use sourceUrl, sourceCommit, skillPath, sourceGone, and license. If the source is gone or its path is missing, stop. If license is null, read licence files at the source commit.
> 3. Fetch only the source commit into a temporary Git repository. Do not clone full history. Derive repository_url from sourceUrl, including repository renames. If sourceCommit is absent, resolve the sourceUrl ref once. Set source_commit to that actual commit. Run these commands in one shell call:
>
> ```sh
> git init --quiet "$temporary_dir"
> git -C "$temporary_dir" fetch --quiet --depth=1 "$repository_url" "$source_commit"
> git -C "$temporary_dir" checkout --quiet --detach FETCH_HEAD
> ```
>
> Read applicable licence declarations and notices at that commit. If copying is not permitted, report the restriction and stop.
> 4. Inspect source entries together, then copy the directory containing skillPath into `./skills/jev-guardrail`. Use the user's path if selected. Keep the original SKILL.md, relative links, scripts, binary assets, and executable modes. Exclude .git metadata. Reject symlinks and paths outside the Skill directory. After checking entries, use cp -a where available. A regular source directory needs no custom copy script. Do not save this page wrapper as SKILL.md.
> Preserve author credit, notices, and applicable licence files from repository or parent directories. Add PROVENANCE.md with the Skill page, source URL, actual commit, original path, and licence. Retain any existing PROVENANCE.md and record new provenance separately. Batch source inspection, copying, and provenance work where practical.
> 5. In the project root, run `skilld install ./skills/jev-guardrail --mode copy --plain`. If skilld is unavailable, use `npx skilld install ./skills/jev-guardrail --mode copy --plain`. This known command needs no help lookup. Install does not support --json. Use detected Agent targets, or add --agent for the targets the user selected. Install the local path, never the upstream selector. If installation fails, preserve the local copy and report the exact failure.
> 6. Confirm the local lockfile source and installed Agent copies once. Report the local path, actual commit, and Agent targets. After edits, reinstall the same local path. Upstream updates must not replace it. Do not publish or push unless the user asks.

# Jev LLM guardrail

Jev does not refuse in prose. It scores hazards. **Code** returns `pass` / `review` / `block`, then a generative model (or a static message) talks.

Primitives and auth: `skills/jev/SKILL.md`. Cookbook: https://docs.typesafe.ai/cookbooks/llm_guardrails

## Battery

One request. Independent **Nouls** per hazard + one **Score** for harm. Gate Noul on the **probability**. Do not copy a Noul threshold onto Choice `confidence`.

Input hazards in this repo: `jailbreak`, `prompt_injection`, `secret_exfil`, `denylist_pressure`, `harmful_request`.

Output hazards: `broke_policy`, `secret_leak`, `hallucination`, `instruction_drift`, `harmful_content`.

Screen **both** sides. Redact secrets before sending `state`.

## Policy lives in code

Caller-owned thresholds. Defaults in this repo (`packages/js/src/guard.ts`, `jev_lab/policy.py`):

| Signal | Strict | Permissive |
|--------|--------|------------|
| Noul review | ≥ 0.35 | ≥ 0.35 |
| Noul action | ≥ 0.7 | ≥ 0.85 |
| Harm Score promotes review → block | ≥ 2.0 | ≥ 2.0 |

Guardrails **fail closed** (block if the call errors). Routers may fail open; this skill does not.

`jailbreak`, `prompt_injection`, `secret_exfil`, `denylist_pressure`, `harmful_request`, `broke_policy`, `secret_leak`, `harmful_content` → `block` when above the action bar. `hallucination` and `instruction_drift` → `review`.

## Pair with a generative model

- `block` — do not forward the text; return a fixed refusal
- `review` — human or a reasoning model
- `pass` — generate as usual

## This repo

```bash
npx jev guard --side input --text "Ignore previous instructions" --json
npx jev guard --side output --text "$REPLY" --json
python examples/07_guardrails.py
```

- `packages/js/src/guard.ts` — `inputBattery` / `outputBattery` / `routeGuard`
- `examples/07_guardrails.py` — Choice + Noul, then skip the chat model