How a request flows
through Clevername
Four guards, one gateway. This page walks through what happens on every call, what’s enabled by default, and what requires a governed agent.
Request arrives at Clevername gateway
POST /api/hub/v1/chat/completions · Authorization: Bearer cn-live-...
Is this a governed agent token?
Response returned to caller
x-clevername-trace-id · x-clevername-scan-result · x-clevername-enforcement-stage
Which layer applies to me?
Developer using Clevername as a BYOK gateway
Layer 1 on every call
CleverGuard scans all traffic
Credential interception active
Tamper-evident audit log
Layers 2–4 not active
No mandate enforcement until you create a governed agent
Engineering team deploying an AI agent
Layer 1 on every call (same as above)
Layers 2–4 on governed agents
ScopeGuard reports mandate violations by default
ClaimGuard output verification + DriftGuard behavioral baseline
Security team operating at scale
All four guards, every agent
SOC console with full visibility
Shadow AI discovery
SIEM forwarding
SCIM sync to tie every agent to an owner
Traffic Security in detail
Tiers 0 and 1 run on every request. Tier 2 (ML) launches concurrently with Tier 1 on every eligible call (input direction, or a tool response with agent context) rather than waiting for Tier 1 to flag something first — the two run in parallel so the ML round-trip overlaps with the regex pass instead of adding to it. Tier 3 is a Clevername-operated self-hosted judge in beta, not a customer BYOK provider call — it fires on every request for governed agents, and on ambiguity/disagreement escalation for ungoverned traffic.
Tier 0
Data Label Gate
<1µs
Compares the request's data-classification header (Purview, Google DLP, AWS Macie, or custom) against the agent's sensitivity clearance. Deterministic rank comparison — no ML, no content inspection. Blocks in under a microsecond if the content is classified above the agent's cleared level.
Tier 1
Pattern Shield
<1ms
Regex matching across the known universe of injection patterns, plus 11 decoding passes for obfuscation: ROT13, base64 (recursive 2 levels), HTML entities, URL percent-encoding, Unicode homoglyphs, BiDi override characters, Zalgo text, zero-width characters, whitespace compaction, reversed text. Also matches credential patterns (AWS, OpenAI, GitHub, Stripe, Slack, JWTs, private key headers).
Tier 2
ML Injection Classifier
~50–350ms
Gemma 3 4B Instruct with two LoRA adapters: CleverGuard injection v7.1 (detects semantic injection patterns that survive character-level mutation) and ScopeGuard v1 (detects mandate violations on governed agents). Results are cached on content hash — repeat scans skip the RTT and return in ~30ms. A circuit breaker fails over to a standby Cloud Run GPU replica when the primary host is unreachable; the standby can trail the primary's adapter generation, so failover is a degraded mode rather than parity. If neither host answers, Tier 2 is skipped and Tier 1 and Tier 3 carry the scan — orgs on strict mode get a blocking finding instead of a silent pass.
Tier 3
LLM Deep Scan
~300ms–1.5s
Full intent analysis using a Clevername-operated self-hosted judge model. The scanner prompt includes the agent's compiled guardrail profile so the LLM can distinguish content that's ambiguous in isolation but clearly wrong for this agent's context. There is no customer Tier-3 key or managed-provider fallback. Tier 3 is wired for governed production traffic, fires on every request for governed agents, and escalates ambiguity/disagreement for ungoverned traffic. It is still labeled beta while we continue tuning latency and failure handling.
Agent Governance in detail
Layers 2–4 — ScopeGuard, ClaimGuard, and DriftGuard — are only active on calls from governed agent CNK tokens. If the token is a human personal-access key, they are skipped.
Agent Review
27-question security intake across 6 groups. Answers are compiled into a guardrail profile: allowed topics, forbidden actions, sensitivity limits, and tool allowlist. The profile is hashed and version-locked at approval. If the agent's code changes materially after approval, the hash mismatch triggers a re-review requirement.
ScopeGuard enforcement
On every call from the governed agent's CNK, ScopeGuard compares the request against the compiled mandate using the Gemma 3 4B + ScopeGuard v1 LoRA. In production it defaults to report-only visibility; out-of-scope requests return a structured 400 only when ScopeGuard enforcement is explicitly enabled. In-scope requests pass through to Layer 1's output scan after the LLM responds.
ClaimGuard verification
On the response side, after delivery, ClaimGuard extracts the factual assertions in the agent's answer and checks them against the tool results captured earlier in the same session. Contradicted or unsupported claims are logged to the audit trail and the agent's Governance tab with what was claimed and what the source actually said. ClaimGuard reports; it does not hold the response.
Behavioral baseline (DriftGuard)
After enough calls (configurable minimum, default 10), the agent's behavioral baseline locks using Good-Turing missing-mass coverage and Jensen-Shannon divergence. Features tracked: tools used, token bucket, time-of-day distribution, content modality, sensitivity levels, and PII frequency. The baseline lock is call-count driven — cron agents that run infrequently don't get locked prematurely.
Drift detection and auto-governance lifecycle
Baseline deviations surface as drift events: monitor (silent, no enforcement), flag (warnings shown in SOC console), enforce (automatic restriction). Enterprise orgs can configure per-org enforce mode. Drift events include the specific feature that deviated and the magnitude of the deviation.
What Clevername is not
Clevername is not IAM. We don’t authenticate humans, we don’t enforce per-user role policy, and we don’t run your agents. Layer 1 secures the traffic. Layers 2–4 secure the agents you’ve approved. Anything between those — like “should this user be allowed to ask this kind of question” — is your IAM’s job, not ours.
This matters because a common misconception when evaluating Clevername is: “I sent a prompt through the API and nothing got blocked — so protections aren’t firing.” That can mean three different things:
- 1.
The content was clean and correctly passed all tiers. (Most likely.)
- 2.
You used a human personal-access key and the content didn't contain injection patterns, credentials, or PII. Layer 1 ran and found nothing. That's correct behavior.
- 3.
You used a human personal-access key and expected mandate enforcement. Mandate enforcement only fires on governed agent tokens — it doesn't apply to humans.
Deep dives
CleverGuard
Full Layer 1 documentation — tier architecture, detection rates, latency budgets, comparison with Lakera / NeMo / Promptfoo.
Read more →
ScopeGuard
Full Layer 2 documentation — mandate compilation, Gemma 3 4B + LoRA architecture, differential test results, honest limits.
Read more →
ClaimGuard
Full Layer 3 documentation — how response claims are extracted and verified, and what lands in the audit trail.
Read more →
DriftGuard
Full Layer 4 documentation — behavioral baselines, which drift signals run against live traffic today, and what is still rolling out.
Read more →
Pricing
Layer-by-layer breakdown of what's included on each plan. Free, Pro, and Enterprise — with the plan comparison split by layer.
Read more →