How a request flows through Clevername.

One gateway, four guards. Every call gets CleverGuard. Governed agents also get ScopeGuard, DriftGuard, and ClaimGuard. This page follows a single call from arrival to response, and shows what is on by default and what needs a governed agent.

Join waitlistFollow one call

Two lines of config. Your provider keys stay yours.

WRWeekly Report BotGovernedIllustrative trace

Request

POST /api/hub/v1/chat/completions Authorization: Bearer cn-live-…

  1. CleverGuardClean. No injection, no credentials.0.6 ms
  2. ScopeGuardInside the approved mandate.118 ms
  3. DriftGuardWithin baseline.<1 ms
  4. ProviderForwarded on your OpenAI key.1.4 s
  5. ClaimGuard2 claims checked after delivery. 0 contradicted.async

Response returned with x-clevername-trace-id in the headers. The whole trace is in the audit log.

One call, start to finish.

CleverGuard runs on every call, whoever makes it. The other three guards arm only when the token belongs to a governed agent: one that has been through Agent Review and has a compiled mandate.

  1. Request arrives at the gatewayEvery call

    POST /api/hub/v1/chat/completions with your Clevername token. It is the same call your client would have sent to OpenAI, Anthropic, or Gemini.

  2. CleverGuard scans the inputEvery call

    Four tiers, fastest first. Clean traffic exits early; only ambiguous content climbs. Two more things happen on the way through: leaked credentials are stripped, and the call is written to a tamper-evident audit log.

    • Data label gate. Deterministic, Enterprise only<1µs
    • Pattern shield. Regex + evasion decode<1ms
    • ML classifier. Gemma 3 4B + LoRA~50–350ms
    • LLM deep scan. Self-hosted beta; every call if governed, else ambiguous only~300ms–1.5s
    • Credential interception. Strips keys, offers vault storageinline
    • Tamper-evident audit write. Hash chain; 7 days on Free, 30 days on Proinline

  3. Is this a governed agent token?

    The answer decides whether the next two guards have anything to work from.

    Yes: a governed agent

    • ScopeGuard compares the request to the compiled mandate. Detects out-of-scope requests; blocks when enforcement is on.
    • DriftGuard checks the call against the agent’s behavioral baseline and flags deviations.

    No: a human key or an ungoverned agent

    • No mandate to enforce, no baseline to compare. ScopeGuard, DriftGuard, and ClaimGuard are skipped.
    • The call goes to your provider straight after CleverGuard.

  4. Forwarded to your providerEvery call

    Your provider bills you, not Clevername. Clevername never supplies LLM compute.

  5. ClaimGuard checks the answerGoverned agents

    After delivery, the factual claims in the response are checked against the tool results captured earlier in the same session. Contradictions are written to the audit trail while the response goes through unchanged.

  6. Response returned to the callerEvery call

    With three headers you can read in your own code: x-clevername-trace-id x-clevername-scan-result x-clevername-enforcement-stage

Which layer applies to me?

It depends on how you connect. These are the three common setups.

A developer using Clevername as a BYOK gateway

  • Layer 1 on every call
  • CleverGuard scans all traffic
  • Credential interception active
  • Tamper-evident audit log
  • Layers 2–4 not active
  • No mandate enforcement until you create a governed agent

An engineering team deploying an AI agent

Start with Agent Review
  • Layer 1 on every call (same as above)
  • Layers 2–4 on governed agents
  • ScopeGuard reports mandate violations by default
  • ClaimGuard output verification + DriftGuard behavioral baseline

A security team operating at scale

Contact us about Enterprise
  • All four guards, every agent
  • SOC console with full visibility
  • Shadow AI discovery
  • SIEM forwarding
  • SCIM sync to tie every agent to an owner

CleverGuard, tier by tier.

Tier 1 runs on every request. Tier 0, the data-label gate, runs only for Enterprise orgs that send classification labels. Tier 2 (ML) launches concurrently with Tier 1 on every eligible call (input direction, or a tool response with agent context) rather than waiting for Tier 1 to flag something first. The two run in parallel so the ML round-trip overlaps with the regex pass instead of adding to it. Tier 3 is a Clevername-operated self-hosted judge in beta, not a customer BYOK provider call. It fires on every request for governed agents, and on ambiguity/disagreement escalation for ungoverned traffic.

Tier 0

Data Label Gate

<1µs

Compares the request's data-classification header (Purview, Google DLP, AWS Macie, or custom) against the agent's sensitivity clearance. Deterministic rank comparison: no ML, no content inspection. Blocks in under a microsecond if the content is classified above the agent's cleared level.

Tier 1

Pattern Shield

<1ms

Regex matching across the known universe of injection patterns, plus 11 decoding passes for obfuscation: ROT13, base64 (recursive 2 levels), HTML entities, URL percent-encoding, Unicode homoglyphs, BiDi override characters, Zalgo text, zero-width characters, whitespace compaction, reversed text. Also matches credential patterns (AWS, OpenAI, GitHub, Stripe, Slack, JWTs, private key headers).

Tier 2

ML Injection Classifier

~50–350ms

Gemma 3 4B Instruct with two LoRA adapters: CleverGuard injection v7.1 (detects semantic injection patterns that survive character-level mutation) and ScopeGuard v1 (detects mandate violations on governed agents). Results are cached on content hash, so repeat scans skip the RTT and return in ~30ms. A circuit breaker fails over to a standby Cloud Run GPU replica when the primary host is unreachable; the standby can trail the primary's adapter generation, so failover is a degraded mode rather than parity. If neither host answers, Tier 2 is skipped and Tier 1 and Tier 3 carry the scan. Orgs on strict mode get a blocking finding instead of a silent pass.

Tier 3

LLM Deep Scan

~300ms–1.5s

Full intent analysis using a Clevername-operated self-hosted judge model. The scanner prompt includes the agent's compiled guardrail profile so the LLM can distinguish content that's ambiguous in isolation but clearly wrong for this agent's context. There is no customer Tier-3 key or managed-provider fallback. Tier 3 is wired for governed production traffic, fires on every request for governed agents, and escalates ambiguity/disagreement for ungoverned traffic. It is still labeled beta while we continue tuning latency and failure handling.

What governed agents get.

Layers 2–4 (ScopeGuard, ClaimGuard, and DriftGuard) are only active on calls from governed agent CNK tokens. If the token is a human personal-access key, they are skipped.

Agent Review

27-question security intake across 6 groups. Answers are compiled into a guardrail profile: allowed topics, forbidden actions, sensitivity limits, and tool allowlist. The profile is hashed and version-locked at approval. If the agent's code changes materially after approval, the hash mismatch triggers a re-review requirement.

ScopeGuard enforcement

On every call from the governed agent's CNK, ScopeGuard compares the request against the compiled mandate using the Gemma 3 4B + ScopeGuard v1 LoRA. In production it defaults to report-only visibility; out-of-scope requests return a structured 400 only when ScopeGuard enforcement is explicitly enabled. In-scope requests pass through to Layer 1's output scan after the LLM responds.

ClaimGuard verification

On the response side, after delivery, ClaimGuard extracts the factual assertions in the agent's answer and checks them against the tool results captured earlier in the same session. Contradicted or unsupported claims are logged to the audit trail and the agent's Governance tab with what was claimed and what the source actually said. ClaimGuard reports; it does not hold the response.

Behavioral baseline (DriftGuard)

After enough calls (configurable minimum, default 10), the agent's behavioral baseline locks using Good-Turing missing-mass coverage and Jensen-Shannon divergence. Features tracked: tools used, token bucket, time-of-day distribution, content modality, sensitivity levels, and PII frequency. The baseline lock is call-count driven, so cron agents that run infrequently don't get locked prematurely.

Drift detection and auto-governance lifecycle

Baseline deviations surface as drift events: observe (silent, no enforcement), flag (warnings shown in SOC console), enforce (automatic restriction). Enterprise orgs can configure per-org enforce mode. Drift events include the specific feature that deviated and the magnitude of the deviation.

What Clevername is not.

Clevername is not IAM. We don’t authenticate humans, we don’t enforce per-user role policy, and we don’t run your agents. Layer 1 secures the traffic. Layers 2–4 secure the agents you’ve approved. Anything between those, like “should this user be allowed to ask this kind of question”, is your IAM’s job, not ours.

This matters because a common misconception when evaluating Clevername is: “I sent a prompt through the API and nothing got blocked, so protections aren’t firing.” That can mean three different things:

  1. The content was clean and correctly passed all tiers. (Most likely.)
  2. You used a human personal-access key and the content didn’t contain injection patterns, credentials, or PII. Layer 1 ran and found nothing. That’s correct behavior.
  3. You used a human personal-access key and expected mandate enforcement. Mandate enforcement only fires on governed agent tokens. It doesn’t apply to humans.

Go deeper on each guard.

Each guard has its own page, including what it does not do.

Start governing your agents.

Free for individuals with BYOK. Connect your provider keys and CleverGuard starts scanning every call. No credit card.

Join waitlistSee pricing