---
title: "Shield"
tagline: "Content safety"
language: "Go"
license: "Apache-2.0"
since: "2026"
canonical: "https://xraph.com/work/shield"
---

# Shield

Content safety arranged in layers that can short-circuit, roughly the way people react to danger. Instincts catch injection and exfiltration in under 10ms. Awareness spots PII, topic and intent. Boundaries are hard deny lists. Values apply toxicity and brand rules, and judgment scores grounding and compliance last, because it is the expensive one.

## Install

```bash
go get github.com/xraph/shield
```

## What it is

Shield is content safety for Go, arranged as six layers ordered by cost and precision, any of which may end evaluation early.

## The layers

- **Instinct**, under 10ms: injection, jailbreak and exfiltration detection.
- **Awareness**, under 50ms: PII, topic, sentiment and intent.
- **Boundary**, under 5ms: hard deny lists on topics, actions and data.
- **Values**, under 100ms: toxicity, brand safety, honesty rules.
- **Judgment**, under 500ms: grounding, relevance and compliance scoring.
- **Reflex**, under 10ms: custom condition-to-action policy rules.

Short-circuiting is the design, not an optimisation. A prompt with an obvious injection string never reaches the grounding check, because no grounding score could contribute to that decision.

## Why ordering beats scoring

A flat pipeline that runs everything needs a combination rule, and combination rules destroy explanation. "Blocked at instinct: jailbreak classifier, confidence 0.94" is auditable, showable to a customer, and testable. "Composite risk 0.71" is none of those, and tuning it moves the score for every other input too.

## Safety profiles

A profile composes the six primitives into a reusable safety character, the counterpart to a Cortex persona. A bank's support bot and an internal engineering assistant get different profiles rather than different toggle combinations on one shared pipeline.

## The blind spot

A message blocked at instinct is never scanned for PII, so its PII content is unknown. That is correct for blocking and wrong for analytics. Running the full chain in shadow mode on a sample is the current workaround, not an answer I am happy with.

---

*Unpublished draft. Not peer reviewed and not submitted to a venue.*


## Anatomy

- **Instinct**: The cheapest check, run first.
- **Awareness**: Context the later layers need.
- **Boundary**: Hard limits that do not negotiate.
- **Judgment**: The expensive layer, reached only when the others allow it.

## Constraints and trade-offs

- (decision) Ordering beats scoring. A layered pipeline fails closed; a weighted score fails ambiguously.
- (known gap) The blind spot is anything that only looks unsafe in aggregate across a session.