Guardrails should be compiled, not prompted.
- Research Notes · · 9 min read
Evaluating Logic-Based Policies via Fixpoints
How a compiled Datalog policy reaches a verdict: facts accumulate through monotone updates until the policy reaches its unique least fixpoint.
Prasad Chalasani - Policy Notes · · 9 min read
Guarding against hidden prompt injections and unvetted packages
A close read of two rules from the sasy-guard security policy: taint any message that arrives carrying hidden Unicode, and hold brand-new package releases at the door until the ecosystem has had time to look at them.
Nils Palumbo - Research Notes · · 14 min read
Agentic Security Policies as Compiled Logic
Why an agent-security policy is better written as a declarative logic program and compiled, rather than hand-coded as if-then hooks: what the imperative version cannot do, and what a policy compiler buys instead.
Sasy Labs - Survey · · 14 min read
A survey of coding-agent security guards
A survey of Claude Code guardrails organized by what each tool can observe: a command, an audit trail, a sandbox boundary, or the provenance of data across a session.
Prasad Chalasani, Nils Palumbo, Guy Amir, Somesh Jha - Release · · 4 min read
Claude Code has your shell. What's watching it?
sasy-guard rebuilds a Claude Code session as a dependency graph and checks every tool call against a policy the agent can't switch off.
Nils Palumbo, Prasad Chalasani, Guy Amir, Somesh Jha - Paper Companion · · 7 min read
Agentic Security: An Aspect-Oriented Programming Perspective
A 30-year-old idea from programming-language research, aspect-oriented programming, provides the right conceptual frame for securing LLM-based agent systems.
Nils Palumbo, Sarthak Choudhary, Jihye Choi, Guy Amir, Prasad Chalasani, Somesh Jha