How Warden Compares
vs. Guardrail Tools
| Feature | Warden | Guardrails AI | NeMo Guardrails | Prompt rules (CLAUDE.md) |
|---|---|---|---|---|
| Enforcement | Deterministic (compiled patterns) | Model-based validation | LLM-based rails | Advisory (model may ignore) |
| Latency | Sub-second (local binary) | 100ms+ (API call) | 200ms+ (LLM call) | 0ms (static text) |
| Scope | Tool calls + output | API input/output | Conversation flow | Conversation only |
| Local | 100% local | Cloud API required | Cloud or local LLM | Local |
| Multi-agent | Claude Code + Gemini CLI + Codex CLI | OpenAI only | OpenAI/NVIDIA | Per-assistant |
| Config | Zero config (compiled rules) | Schema definitions | Colang DSL | Markdown |
| Session awareness | Phase tracking, drift, focus, loops | None | Topic control | None |
| Output efficiency | Aggressive compression | None | None | None |
| Cross-session learning | Resume packets, repair patterns | None | None | None |
Key difference: Warden’s safety enforcement is deterministic — compiled pattern matching, not an LLM call. When Warden blocks rm -rf /, it’s a regex match, not a model decision. This means no latency variance, no non-determinism, and no prompt injection that can bypass the check.
vs. Multi-Agent Harnesses
Anthropic’s harness design article describes a pattern gaining traction: planner/generator/evaluator agents coordinated in a loop, with context resets between sprints. This is external orchestration — multiple agents coordinated from the outside.
Warden takes the complementary approach: runtime governance from the inside. It doesn’t orchestrate multi-agent workflows. It makes each individual agent session safer, more focused, and more context-efficient.
| Multi-Agent Harness | Warden | |
|---|---|---|
| Architecture | External orchestration (planner → generator → evaluator) | Runtime injection (hooks inside each agent’s loop) |
| Problem solved | Task decomposition, quality evaluation, context management across sprints | Safety enforcement, session degradation, context waste, tool quality |
| Scope | The overall workflow | Each individual session |
| Relationship | Coordinates agents | Governs agents |
These aren’t competing approaches. A harness coordinates the work; Warden makes each agent’s individual session safer and more efficient. A multi-agent harness would benefit from Warden running on each of its sub-agents.
vs. Prompt Rules
Prompt rules (CLAUDE.md, system prompts, .gemini instructions) are valuable but fundamentally advisory. The model may ignore them, reinterpret them, or forget them after context compaction.
Warden’s deterministic rules operate outside the model’s context window. The agent cannot bypass them. Prompt rules and Warden are complementary — use prompt rules for coding style and preferences, use Warden for safety and runtime governance.
Key Principles
Deterministic where it matters. Safety enforcement is compiled pattern matching — same input, same output, every time. No model in the loop for safety decisions.
Local-first, always. Every decision happens on your machine. No cloud API, no telemetry, no network calls during operation.
Bounded intelligence. Session guidance is heuristic and clearly labeled as such. Warden is precise about what it guarantees vs. what it approximates.