| title | Why Sponsio |
|---|---|
| description | How Sponsio differs from prompt-injection filters, output validators, LLM-as-judge guardrails, sandboxing, and other deterministic enforcers. |
Sponsio operates at the action boundary — checking which tool a model is about to call, with what arguments, given everything that has already happened in the trace, before any side effect fires. That's a different position from every other guardrail category.
| Approach | When it works | Where it fails | How Sponsio solves |
|---|---|---|---|
| Prompt-injection Filters | Pre-generation, on input text | Drifts on novel phrasings; sees text, not tool calls; no notion of action history | Enforces which tools may run, in what order, with what arguments, before function call executes, with full trace context |
| Output Validators | Post-generation, on response strings | The mistakes (e.g. refund, DB write, API call) may already have fired | Blocks the call before execution; reasons over the full action history, not just the latest string |
| LLM-as-Judge | Flexible, handles fuzzy properties; useful for offline eval | Stochastic verdicts, hundreds-of-ms latency, itself prompt-injectable — unsuitable as a synchronous gate | Sub-0.01ms deterministic checks, zero LLM in the hot path; stochastic pipeline is opt-in for fuzzy properties |
| Sandboxing & Access Control Lists | Strong perimeter for identity- and resource-level isolation | Narrows agent capability. Gates by who and what resource, not by behavior sequence | Enforces temporal contracts over the action sequence, including ordering, history, and multi-step invariants, preserving agent capability |
1. Temporal contracts over sequential actions, not stateless rule matching. Existing enforcers evaluate each action in isolation. Sponsio reasons over the full trajectory: "verify_recipient before send_email", "no external calls after PII access", "refund_payment ≤ 3 calls per session".
2. Machine-checkable, not heuristic. Contracts compile to LTL formulas, then to deterministic finite automata. Every verdict is a deterministic DFA transition, not a probabilistic confidence score. Same proof technique used in hardware verification (Intel FPU correctness, AWS S3 TLA+). How it works →
3. Zero to protected in minutes, no DSL learning curve. Existing tools require hand-written YAML / Rego / Cedar policies from scratch. Sponsio offers four paths in:
- Auto-inferred —
sponsio init(interactive wizard) reads your tool signatures and writes starter contracts - Contract library — include pre-built bundles by capability (
sponsio:capability/shell,…/filesystem) or by incident (sponsio:incident/openclaw); each bundle composes 44 det patterns underneath (sto atoms ship in Sponsio Cloud) - Natural language —
sponsio validate "..."compiles plain English to LTL - Policy doc —
sponsio scan --policy security.mdparses an existing compliance document
4. Framework-agnostic and low-dependency. Other tools ship as opinionated stacks — bundling identity, SRE, dashboards, orchestration. Sponsio is a single enforcement library that plugs in alongside whatever observability, IAM, and orchestration you already use.
← Back to README · Architecture deep dive · Formal methods primer