Trust packet

Proof, not promises.

Architecture boundaries, Cloud data paths, release provenance, and redacted SIEM samples with current sources and limitations shown below.

Enterprise assistOpen docs

Source claims verified 2026-09-16.

Architecture

What Guard actually does, and what it doesn't.

ArchitectureVerified

Local-first runtime and receipts

Guard uses local harness discovery, launch interception, policy evaluation, approvals, and receipts. Cloud connectivity is optional.

Current Guard architecture
PrivacyVerified

Local protection with optional Cloud sync

Local interception, blocking, approvals, and receipts work without Guard Cloud. When Cloud is connected, receipt and decision history can sync, and Safe Decode sends only redacted summaries when receipt sync is enabled.

Local Guard vs Guard Cloud
GovernanceVerified

Private vulnerability reporting, with a support-line caveat

The current security policy requires private vulnerability reports to [email protected] and says not to open a public issue. It still lists 2.x as supported and does not state 3.x support, so this page does not infer a 3.x security-support SLA.

HOL Guard security policy
EnterpriseVerified

Shared governance is additive to local protection

Team Cloud adds shared workspaces, roles, managed controls, routing, review workflows, and evidence exports. Local protection continues independently of Cloud availability or sign-in state.

Local Guard vs Guard Cloud
FederationConfirm

Identity integration remains under review

This packet does not verify a SAML or SCIM login path. Confirm the supported identity flow and workspace role mapping before treating enterprise federation as available.

Guard enterprise evaluation scope
DeploymentConfirm

Self-hosted and VPC scope remains under review

This packet does not claim a supported self-hosted or VPC control plane. Confirm deployment prerequisites, ownership, and evidence paths during review.

Guard enterprise evaluation scope
SIEMVerified

Canonical redacted event taxonomy

Guard Cloud uses the guard.siem.v1 event taxonomy for redacted exports and generic webhook delivery. The documented vendor mappings are webhook schema examples; native Splunk, Elastic, Sentinel, and Datadog integrations remain planned until provider delivery and test coverage are complete.

Guard enterprise event taxonomy
Release provenance

Release provenance and publishing evidence.

1

Stable

Verified

PyPI is the public release index for hol-guard and exposes the current stable release, release history, upload dates, and distribution files.

hol-guard on PyPI
2

Trusted publishing

Verified

Current PyPI file details show Trusted Publishing and attestation provenance for hol-guard distributions.

hol-guard on PyPI
3

Release channel

Verified

GitHub Releases is the public release history reviewed here. This packet does not advertise a separate prerelease or edge channel without a current public source.

HOL Guard releases
SIEM integration

Redacted SIEM payload examples.

These guard.siem.v1 samples are the canonical redacted event shapes used by Guard's webhook and vendor formatters. Production delivery depends on the configured integration and plan.

receipt.created

JSON
{
  "actor": {
    "actorHash": "actor_agent_7f3a",
    "actorType": "agent"
  },
  "eventType": "receipt.created",
  "eventVersion": "guard.siem.v1",
  "occurredAt": "2026-06-08T18:00:00.000Z",
  "receiptId": "receipt_01jz_guard_created",
  "redaction": {
    "rawCommandIncluded": false,
    "rawPromptIncluded": false,
    "secretMaterialIncluded": false
  },
  "routing": {
    "enterpriseTrigger": null,
    "suggestedSink": "siem"
  },
  "severity": "info",
  "subject": {
    "artifactId": "tool:codex-shell",
    "artifactType": "receipt",
    "ecosystem": null
  },
  "workspaceId": "workspace_9d21"
}

approval.resolved

JSON
{
  "actor": {
    "actorHash": "actor_human_42",
    "actorType": "human"
  },
  "eventType": "approval.resolved",
  "eventVersion": "guard.siem.v1",
  "occurredAt": "2026-06-08T18:02:00.000Z",
  "receiptId": "receipt_01jz_approval",
  "redaction": {
    "rawCommandIncluded": false,
    "rawPromptIncluded": false,
    "secretMaterialIncluded": false
  },
  "routing": {
    "enterpriseTrigger": null,
    "suggestedSink": "ticketing"
  },
  "severity": "medium",
  "subject": {
    "artifactId": "approval:workspace-scope",
    "artifactType": "approval",
    "ecosystem": null
  },
  "workspaceId": "workspace_9d21"
}

policy.mutation

JSON
{
  "actor": {
    "actorHash": "actor_admin_42",
    "actorType": "human"
  },
  "eventType": "policy.mutation",
  "eventVersion": "guard.siem.v1",
  "occurredAt": "2026-06-08T18:04:00.000Z",
  "receiptId": "policy_receipt_01jz",
  "redaction": {
    "rawCommandIncluded": false,
    "rawPromptIncluded": false,
    "secretMaterialIncluded": false
  },
  "routing": {
    "enterpriseTrigger": null,
    "suggestedSink": "siem"
  },
  "severity": "medium",
  "subject": {
    "artifactId": "policy:strict-release",
    "artifactType": "policy",
    "ecosystem": null
  },
  "workspaceId": "workspace_9d21"
}

incident.created

JSON
{
  "actor": {
    "actorHash": "actor_system_guard",
    "actorType": "system"
  },
  "eventType": "incident.created",
  "eventVersion": "guard.siem.v1",
  "occurredAt": "2026-06-08T18:06:00.000Z",
  "receiptId": "incident_receipt_01jz",
  "redaction": {
    "rawCommandIncluded": false,
    "rawPromptIncluded": false,
    "secretMaterialIncluded": false
  },
  "routing": {
    "enterpriseTrigger": "incident_export_use",
    "suggestedSink": "case-management"
  },
  "severity": "high",
  "subject": {
    "artifactId": "incident:package-block",
    "artifactType": "incident",
    "ecosystem": null
  },
  "workspaceId": "workspace_9d21"
}

feed.degraded

JSON
{
  "actor": {
    "actorHash": "actor_system_guard",
    "actorType": "system"
  },
  "eventType": "feed.degraded",
  "eventVersion": "guard.siem.v1",
  "occurredAt": "2026-06-08T18:08:00.000Z",
  "receiptId": "feed_receipt_01jz",
  "redaction": {
    "rawCommandIncluded": false,
    "rawPromptIncluded": false,
    "secretMaterialIncluded": false
  },
  "routing": {
    "enterpriseTrigger": "custom_notification_routing",
    "suggestedSink": "siem"
  },
  "severity": "medium",
  "subject": {
    "artifactId": "feed:osv",
    "artifactType": "feed",
    "ecosystem": null
  },
  "workspaceId": "workspace_9d21"
}

package.blocked

JSON
{
  "actor": {
    "actorHash": "actor_agent_7f3a",
    "actorType": "agent"
  },
  "eventType": "package.blocked",
  "eventVersion": "guard.siem.v1",
  "occurredAt": "2026-06-08T18:10:00.000Z",
  "receiptId": "package_receipt_01jz",
  "redaction": {
    "rawCommandIncluded": false,
    "rawPromptIncluded": false,
    "secretMaterialIncluded": false
  },
  "routing": {
    "enterpriseTrigger": "siem_export_schema_request",
    "suggestedSink": "siem"
  },
  "severity": "critical",
  "subject": {
    "artifactId": "package:npm/acme-risky-install",
    "artifactType": "package",
    "ecosystem": "npm"
  },
  "workspaceId": "workspace_9d21"
}
Enterprise handoff

Ready for a security pilot?

Identity, routing, retention, and SLA terms are agreement-specific. Local protection does not depend on Guard Cloud.

Talk to enterpriseEmail [email protected]Security policy