LLM safety kernel

Why a safety kernel

LLMs are probabilistic. The control plane cannot be. A safety kernel makes decisions deterministically and logs the outcome so approvals and audits remain consistent.

Decision flow

Every job takes the same path: request, evaluation, decision, and enforced execution.

Job request
  |
  v
Safety Kernel
  |
  +--> ALLOW -> dispatch
  +--> REQUIRE_APPROVAL -> pause -> resume
  +--> ALLOW_WITH_CONSTRAINTS -> dispatch with bounds
  +--> DENY -> stop + record

Decision matrix

Most systems need the same four outcomes:

ALLOW
DENY
REQUIRE_APPROVAL
ALLOW_WITH_CONSTRAINTS

Policy example

Policies match on context and return decisions with constraints. The policy is versioned and tied to a snapshot hash for approvals.

tenants:
  default:
    rules:
      - match:
          risk_tags: ["prod", "write"]
        decision: REQUIRE_APPROVAL
      - match:
          capability: "incident.remediate"
        decision: ALLOW_WITH_CONSTRAINTS
        constraints:
          max_lines_changed: 500
          max_runtime_sec: 900

Constraint examples

• - max_runtime_sec to cap long-running tasks
• - max_lines_changed to bound patches
• - network_egress_allowlist for outbound calls
• - deny_paths for sensitive repositories

Simulate and explain

Simulations let you test policy changes before they go live. Explanations show which rule matched and why.

POST /api/v1/policy/simulate
{
  "tenant_id": "default",
  "job": {
    "topic": "job.incident.remediate",
    "risk_tags": ["prod", "write"],
    "capability": "incident.remediate"
  }
}

200 OK
{
  "decision": "REQUIRE_APPROVAL",
  "reason": "prod write requires approval",
  "constraints": {
    "max_lines_changed": 500,
    "max_runtime_sec": 900
  },
  "snapshot_hash": "7f3d...9c2b"
}

Deterministic core, autonomy at the edges

The safest architecture keeps the orchestration deterministic and pushes autonomy to the edges. The control plane decides, the worker executes within constraints, and the audit trail records the result.

How Cordum implements it

Cordum runs the Safety Kernel as a dedicated service. It evaluates every job, binds decisions to a policy snapshot, and enforces constraints during execution. Decisions appear in the run timeline and are available for audit.

Learn more in the Safety Kernel overview.