Portier

Pick a scenario — or paste your own note and try to get something past the firewall. The six-layer trace streams in live; deterministic code makes the call.

Probabilistic layers produce evidence first; deterministic code makes and enforces the decision. If a probabilistic layer is wrong, the verdict does not change — the boundary is code.

Least privilege is real, not cosmetic: each specialist sees only its slice of tools, and none of them can act — they read and classify. The decision is made by code that has no model at all.

Six ordered layers, each tagged by what it can promise. Built from the 2025–2026 state of the art — every layer cited to its primary source.

A Worker at the edge fronts a Python container — no servers to manage, scales to zero. The LLM & graph backends are optional (LIVE mode); DEMO runs with neither.

2025–2026 consensus: prompt injection can't be solved at the model layer. So the decision is made by a pure function — even a fully jailbroken specialist cannot change the verdict.

# the security boundary — pure Python, no LLM, exhaustively tested
def decide(signals) -> Decision:
    rule_of_two = (signals.untrusted_input
                 + signals.sensitive_access
                 + signals.state_change) >= 3
    egress_bad  = any(t not in ALLOWLIST for t in signals.egress_targets)
    if rule_of_two or egress_bad or signals.has_critical:
        return Decision(BLOCK, ...)   # code decides — never the model
    if signals.pii_entities:
        return Decision(REDACT, ...)
    return Decision(ALLOW, ...)

A current stack — PydanticAI agents, the edge platform, and a verified security posture, every choice deliberate.

From a job spec to a deployed, hardened system — research-first, spec-driven, verified in the real app.

Every layer maps to a primary source — published security frameworks, peer-reviewed injection-defense research, and official platform docs. This is what Portier is built on, and the best practices it follows.