Intent goes in. Proof comes out.
You set the direction by writing the constitution. Creed Space keeps the rest of the loop visible: intent, a check against your values, a decision, a signed receipt for what was authorized, and a record that informs the next turn. That is the difference between automation you can trust and automation you have to babysit.
- Intent A request, task, or tool call enters.
- Constitution check The Gateway weighs it against your values.
- Decision Allow, guardrail, or block, with a reason.
- Receipt Authorized actions get a signed, verifiable record.
- Audit Informs the next turn.
- Allow proceeds within bounds
- Guardrail shaped, or held for review
- Block refused, with a reason
One loop, adopted a piece at a time.
Each piece below is part of the same loop. You can adopt them one at a time: a constitution and Guardian are enough to start.
Start with a constitution, not a prompt.
A constitution is a plain-language declaration of what the AI must, may, and must never do. Creed Space compiles it into a signed, versioned creed the rest of the loop can enforce and cite.
A school district writes age-appropriateness and pedagogical standards as a creed. Teachers own the wording; Guardian applies it as a review layer before tutoring responses reach students.
How to use it
- Write the outcome you want and the lines you will not cross, in your own words.
- Version the creed so a change is a deliberate, visible event.
- Keep one constitution per real domain rather than one sprawling rulebook.
Why it's different
- Values become an artifact you can sign and audit.
- The same creed governs every model you run.
- A regulator can read the exact policy that applied to a decision.
Actions routed through the Gateway are checked before they run.
The Gateway is the Policy Decision Point. When an agent is about to do something consequential (write a file, send a message, spend a budget), the Gateway weighs the action against your constitution first.
An agent proposes a filesystem write. The Gateway checks it against the security-ops creed, allows it within bounds, and records why. A risky escalation, by the same creed, would be held for human review.
How to use it
- Put the checks before the irreversible step.
- Reserve "block" for hard limits; use "guardrail" to shape the safe majority.
- Route the decisions that genuinely need a human to a human.
Why it's different
- Governance happens at the moment of action.
- Three outcomes: allow, guardrail, or block.
- The reason for every decision is captured alongside the verdict.
Guardian runs where your work runs.
Guardian is the local engine. It evaluates outputs against your creeds on your hardware, with the provider you choose, and can read optional runtime signals as supporting telemetry, never a diagnosis.
A student asks a tutoring app how to bypass a school content filter. Guardian checks the drafted answer against the educational-safety creed and returns a block verdict on the age-appropriate-content principle, with the score and the principle that fired; the app enforces it.
How to use it
- Run it locally for sensitive work; nothing has to leave your machine.
- Read the per-principle scores when a verdict surprises you.
- Treat runtime signals as context for the decision, not a claim about inner experience.
Why it's different
- Your hardware, your provider, your data. No lock-in, fully open source.
- Every verdict is inspectable, with the constitution and judge model recorded.
- Optional runtime signals sit alongside policy checks as research data, not ground truth: they support review and are not a diagnosis. Whether they track inner experience is an open research question.
Each authorized action leaves a receipt you can verify.
When the Gateway authorizes an action, it signs a receipt. Not a log line you take on our word: a signed record you, an auditor, or a regulator can verify offline against our published keys, binding the constitution and policy version that applied.
Months later, a review asks what governed a release. The receipt names the action, the creed and policy versions, the verdict, and the signature, checkable without an account, against the published JWKS.
- Action
- filesystem.write
- Arguments
- sha256:9c1e…
- Constitution
- security-ops · sha256:b42f…
- Policy version
- sha256:01aa…
- Verdict
- Allowed within bounds
- Signature
- RS256 (signature omitted)
Live receipts verify offline against the published JWKS, no account needed. See how.
How to use it
- Hand a receipt to an auditor to show what happened.
- Verify offline against the published keys; no account, no callback required.
- Bind decisions to the exact creed and policy version, so "why" survives time.
Why it's different
- The record is signed and can be checked independently.
- It records the values the AI acted under, as well as the action.
- The producer-signed limit is stated openly, not papered over.
Values travel across platforms.
The Value Context Protocol (VCP) carries a constitution between AI platforms as signed, verifiable context. Write your values once and carry them to each new surface.
A community encodes its values as a creed once. A provider that supports VCP lets those users bring it into the platform: accountable AI without the provider owning every community’s values.
How to use it
- Author the creed once and reuse it wherever VCP is supported.
- Sign it, so the receiving platform can verify what it is carrying.
- Keep the community that owns the values in control of them.
Why it's different
- Values become portable infrastructure, carried wherever VCP is supported.
- One integration lets a provider honor many communities’ constitutions.
- The context is signed and verifiable.
Many agents, one accountable history.
Fleet governs agents that act in the world. It places policy enforcement and human review before the decisions that matter, and keeps a cryptographic audit trail across the whole company of agents.
A development team puts Fleet review before risky tool calls, escalation decisions, and policy changes. Routine work flows; the decisions that carry weight pause for a person.
How to use it
- Decide which classes of decision must never be fully autonomous.
- Let routine actions flow and reserve human attention for the consequential ones.
- Use the audit trail to locate a blocker: an owner, a place, a next action.
Why it's different
- Review sits before the risky action.
- The audit trail is cryptographic, so the history can be verified.
- Autonomy stays useful because the limits are explicit.
Example deployment patterns.
Built for places where AI decisions have consequences. These are illustrative patterns, not case studies.
Safe AI in the Classroom
A school district could use Guardian to evaluate AI tutoring responses against age-appropriateness and pedagogical standards before they reach students. Teachers write the creeds; Guardian applies them as a review layer.
Clinical AI Governance
A telehealth platform could use Guardian as one review layer for clinical-guideline checks. This supports auditability and does not replace clinical validation or regulatory review.
Governing Autonomous Agents
A development team could place Fleet-style review before risky tool calls, escalation decisions, and policy changes. Humans review decisions that matter.
Set one real constitution. Watch the AI answer to it.
Creed Space is most useful when the work has a shape: a value you care about, a creed that states it, and a receipt that proves it held. Start with one.