How Warden Compares
vs. Guardrail Tools
| Feature | Warden | Guardrails AI | NeMo Guardrails | Prompt rules (CLAUDE.md) |
|---|---|---|---|---|
| Enforcement | Deterministic (compiled patterns) | Model-based validation | LLM-based rails | Advisory (model may ignore) |
| Latency | ~55ms p50 per hook, measured locally | 100ms+ (API call) | 200ms+ (LLM call) | 0ms (static text) |
| Scope | Tool calls + output | API input/output | Conversation flow | Conversation only |
| Local | 100% local | Cloud API required | Cloud or local LLM | Local |
| Multi-agent | Claude Code + Gemini CLI + Codex CLI | OpenAI only | OpenAI/NVIDIA | Per-assistant |
| Config | Zero config (compiled rules) | Schema definitions | Colang DSL | Markdown |
| Session awareness | Phase tracking, drift, focus, loops | None | Topic control | None |
| Output efficiency | Aggressive compression | None | None | None |
| Cross-session learning | Resume packets, repair patterns | None | None | None |
Key difference: Warden’s safety enforcement is deterministic — compiled pattern matching, not an LLM call. When Warden blocks rm -rf /, it’s a regex match, not a model decision: the same command produces the same verdict every time, and no prompt injection can talk the check out of it.
Deterministic is not the same as constant-time. Most of a hook’s cost is the operating system starting a process, so the measured latency is a distribution, not a number — a p50 near 55ms on a developer machine, with a floor set by process spawn and a tail set by whatever else the machine is doing. Antivirus that scans every process launch will move both. What determinism buys is a stable verdict, not a stable clock.
vs. Multi-Agent Harnesses
Anthropic’s harness design article describes a pattern gaining traction: planner/generator/evaluator agents coordinated in a loop, with context resets between sprints. This is external orchestration — multiple agents coordinated from the outside.
Warden takes the complementary approach: runtime governance from the inside. It doesn’t orchestrate multi-agent workflows. It makes each individual agent session safer, more focused, and more context-efficient.
| Multi-Agent Harness | Warden | |
|---|---|---|
| Architecture | External orchestration (planner → generator → evaluator) | Runtime injection (hooks inside each agent’s loop) |
| Problem solved | Task decomposition, quality evaluation, context management across sprints | Safety enforcement, session degradation, context waste, tool quality |
| Scope | The overall workflow | Each individual session |
| Relationship | Coordinates agents | Governs agents |
These aren’t competing approaches. A harness coordinates the work; Warden makes each agent’s individual session safer and more efficient. A multi-agent harness would benefit from Warden running on each of its sub-agents.
vs. Prompt Rules
Prompt rules (CLAUDE.md, system prompts, .gemini instructions) are valuable but fundamentally advisory. The model may ignore them, reinterpret them, or forget them after context compaction.
Warden’s deterministic rules operate outside the model’s context window. The agent cannot bypass them. Prompt rules and Warden are complementary — use prompt rules for coding style and preferences, use Warden for safety and runtime governance.
Key Principles
Deterministic where it matters. Safety enforcement is compiled pattern matching — same input, same output, every time. No model in the loop for safety decisions.
Local-first, always. Every decision happens on your machine. No cloud API, no telemetry, no network calls during operation.
Bounded intelligence. Session guidance is heuristic and clearly labeled as such. Warden is precise about what it guarantees vs. what it approximates.