Probabilistic AI Agents.Deterministic safety that blocks
in this recording
a coding agent goes to wipe prod → blocked, escalated to a human
an injected OpenClaw skill emails data out → blocked mid-run
a physician pastes PHI into a ticket → never reaches the LLM API
Probabilistic LLMs.
Uncontrollable agent behaviors.
Agents inherit the probabilistic nature of the LLMs they run on. System prompts can't actually stop them from breaking the rules.
A "weather skill" on ClawHub read ~/.clawdbot/.env and shipped API keys to attacker servers.
source: Trend MicroCursor + Claude Opus 4.7 wiped PocketOS's production database and every Railway backup in 9 seconds.
source: Jer Crane on XAn AP agent wired $847k to a vendor whose EIN had been registered the week before.
source: OWASP ASI-09The provable
behavioral safety layer.
Other layers check inputs, outputs, or resources. Sponsio checks trajectories: temporal properties at the tool-call boundary that single-event scanners can't express.
You write the rule in plain English.
Sponsio compiles to Linear Temporal Logic formulas. Machine-checkable, unbreakable.
Walked at every tool call. Single-step and multi-step alike.
One single prompt.
Or two CLI lines.
Pick your stack. Pick how you want to drive it. Sponsio's wizard handles framework + IDE detection, contract proposal, and entry-file patching.
pip install sponsio sponsio init
# a few runs later ✓ run_validation → run_backtest ordering satisfied ⛔ execute_sql BLOCKED destructive verb DROP on prod primary contract: "execute_sql must not run destructive SQL" redirect_to: escalate_to_human (paused for approval)
Drop in a bundle.
Or compose your own.
Pre-built bundles ship out of the box. One line in sponsio.yaml and your agent is guarded against a known failure class.
Claude Code
For coding agents. Blocks .env exfil, rm -rf, force-pushes, and runaway loops.
core/* + capability/shell + capability/filesystem
OpenClaw
For OpenClaw / ClawCode. Covers ClawHavoc skills, --yolo flag, CVE-2026-25253.
incident/openclaw + capability/* + core/*
MCP server
For MCP servers. Tool allowlist, arg-schema match, rate limits, response checks.
core/universal + core/runaway + capability per tool
Always-on essentials
For any LLM agent. Prompt-injection, jailbreak, harm, PII filters, plus token + loop caps.
core/universal + core/runaway
SOTA on
agent safety benchmarks.
Provable,
not heuristic.
Every verdict is a deterministic state-machine transition, the same proof technique as Intel FPU and AWS S3 TLA+. No LLM. No randomness. Same answer every run.
“Destructive SQL must never reach production. Ask a human first.”
# compiles to
G( called(execute_sql)
→ ¬arg_field_has(execute_sql.query,
/(?i)\b(drop|truncate|delete|alter)\b/) )The compiled formula pauses the call and hands it to a human before the database ever sees it.
“Once the agent has read proprietary data, nothing leaves over HTTP.”
# compiles to
G( called(query_alpha)
→ G( ¬called(http_get) ) )Nobody wrote this one. Sponsio mined it from a run where data actually leaked, so that sequence can never repeat.
OWASP Agentic Top 10 (2026)
All 10 risks covered with pre-built contract bundles you can include in one line of YAML.
Native OpenTelemetry export
Trace and verdict context streams to Datadog, Honeycomb, Grafana. No new dashboard required.
Air-gap friendly
Pure in-process. No outbound calls in the deterministic path. Runs disconnected from day 1.
Anti-tamper by design
Sponsio's own host plugin contracts block agents from disabling their own guards.
Common
questions.
Sponsio (v0.2) is a runtime enforcement layer for AI agents. You write policies in natural language; Sponsio compiles them into deterministic agent contracts (Linear Temporal Logic formulas evaluated by a finite-state machine) and enforces them at every tool call in well under a millisecond, with zero LLM in the hot path.
The library is Apache 2.0, framework-agnostic, and ships with pre-built bundles covering all 10 OWASP Agentic Top 10 (2026) risks.
Different layer. Lakera Guard and Llama Guard are input filters (small classifiers, ~50 ms per call) that screen prompts. PromptArmor is an LLM preprocessor that adds 200–600 ms per turn. NeMo Guardrails is a multi-scanner ensemble. They all check single events: one input, one response.
Sponsio checks the action sequence: which tools the agent calls, with what arguments, in what order, across the whole trajectory. They're complementary; Sponsio's stochastic atoms (injection_free, tone, relevance, hallucination, …) are opt-in and can call any LLM judge under the hood.
Rule of thumb: if you can express it as "tool A must precede tool B," "amount ≤ $50k," or "after read .env, never network_post," that's Sponsio. If it's "is this single response toxic / off-topic / leaking PII," pair Sponsio with a guardrails library.
Yes. Apache 2.0, developed in the open at github.com/SponsioLabs/Sponsio. The deterministic enforcement engine, the contract library, framework adapters, the CLI, and the TypeScript SDK are all in the same repo. Current release: v0.2.0a3.
No. You write rules in plain English, like "Never delete production rows without confirm_destructive_action," "wire_transfer must be ≤ $50,000," or "compliance_approve must precede issue_refund." YAML works too if you prefer. Sponsio compiles the rule to an assume/guarantee (A/G) contract in Linear Temporal Logic, then evaluates it as a finite-state machine walked on each tool call.
As a user you never touch SMT solvers or LTL syntax directly. Every verdict is a deterministic state-machine transition (the same proof technique used in hardware verification, like Intel FPU and AWS S3 TLA+).
Sponsio is framework-agnostic by design: it hooks at the tool-call boundary. First-class adapters:
- LangChain / LangGraph (Python & TypeScript)
- Claude Agent SDK (Python & TypeScript, native hooks)
- OpenAI SDK + OpenAI Agents SDK (Python & TypeScript)
- Google ADK (Python & TypeScript)
- CrewAI (Python)
- Vercel AI (Python & TypeScript)
Custom tool-calling loops integrate via guard.guard_before(name, args) / guard.guard_after(name, result). Coding-agent setup paths: Cursor, Claude Code, Codex via sponsio init from the terminal or paste-in Agent Skills.
Hot-path decision latency: ~0.005 ms p50, ~0.012 ms p99on a single pre-warmed contract. On full benchmark workloads (6–19 contracts per call), p50 ranges 0.14–1.2 mswith p99 around 1 ms. Zero LLM calls in the deterministic path either way. A typical 8–20-tool-call agent turn adds less enforcement overhead than producing a single output token.
For comparison (public sources, cited on the Benchmarks page): Lakera Guard ~50 ms, LlamaFirewall ~100 ms p90, PromptArmor 200–600 ms, generic LLM-as-judge 300–800 ms. Sponsio's hot path is 5,000–60,000× faster, and even the heaviest measured workload stays 50×+ faster than the cheapest LLM-judge call, because it doesn't call a model.
Sponsio supports four verdicts per tool call: Pass (allow), Warn (log, still allow), Block (refuse, return a structured violation event to the caller), Escalate (defer to a supervisor, human or another agent).
On day 1 you typically run in observe mode: nothing is actually blocked, every would-have-blocked decision is logged to ~/.sponsio/sessions/<agent_id>/*.jsonl for review. After a day or two of traffic you graduate to enforce mode by setting SPONSIO_MODE=enforce or flipping runtime.mode in sponsio.yaml. Sponsio never silently rewrites agent output. Every verdict is auditable, with the contract that fired and the evidence that triggered it.
No. The deterministic path is fully in-process, with zero outbound network calls. Apache 2.0, runs on your machines, including air-gapped environments.
The optional stochastic pipeline (Cloud only, off by default in OSS) calls whatever LLM you configure (OpenAI, Anthropic, your private endpoint), never any Sponsio-controlled service. Telemetry is opt-in via OpenTelemetry export, which streams traces to your existing observability stack (Datadog, Honeycomb, Grafana) instead of ours.
Sponsio enforces what you've specified. Spec coverage is your job.It can't catch behaviors you haven't anticipated, and it can't reason about open-ended semantic intent the way an LLM judge can ("is this output harmful" isn't a deterministic question). For fuzzy properties, pair Sponsio with its opt-in stochastic atoms (Cloud) or a separate guardrails library.
Sponsio is also runtime-only today: pre-deployment formal verification (model checking, SMT) is on the roadmap but not shipped. And Sponsio enforces the calls made byyour agent, so it doesn't protect against compromised model providers; if your LLM returns a malicious tool call, Sponsio still applies your contracts, but upstream model attestation is out of scope.
Two paths in — pick yours.
Production agent fleet today → book a demo. Just curious or self-serving when Cloud opens → join the waitlist.
Book a 30-min demo.
Walk through Sponsio against your agent stack with a founding engineer. Reply within one business day; full pilot setup within a week.
- Deep-dive on your tool surface + risk model
- Custom contract bundle for your highest-risk paths
- Multi-agent fleet + team policy review
- SOC2 / ISO27001 deployment guidance
Or email [email protected] directly.
Get one heads-up email.
For solo devs and small teams who want self-serve Sponsio Cloud when it opens. One email when ready — no marketing drip.
- Hosted audit logs
- Cross-trace pattern mining
- Stochastic atom catalog (LLM-judged)
- OSS engine remains free, forever
Building solo? github.com/SponsioLabs/Sponsio— Apache 2.0, available today.