Local first for meaning,
cloud last for residual inference.
Wardrail routes every prompt across a Mixture-of-Models pool — local open-weight GGUF, on-device NPU, and cloud APIs — on task type, prompt size, policy and cost budget instead of a standing choice of the most expensive provider. Safety, locality and minimisation are all decided on the device, before anything may leave it.
Sovereignty, privacy and cost, decided before egress
The decisions with ethical weight are taken before anything leaves the device — and the boundaries of those decisions are written down rather than discovered in production.
Locality is decided before egress
Prompt safety, complexity scoring, pool filtering and Sensitive Sources screening all run before dispatch — and screening applies to the composed egress payload, so tool output or file content injected into context cannot bypass the locality check.
Minimisation before the cloud, not after
Cloud Privacy Hardening minimises the cloud-facing artifact locally through a persistent pseudonym vault, configurable identifier detection and conversation compartmentalisation. Three artifacts stay distinct: original prompt, composed payload, and what actually leaves.
Data at rest under one key you hold
Optional at-rest encryption seals conversations, settings, the vault, the Sensitive Sources index, logs and telemetry as AES-256-GCM envelopes. Windows Hello gates the DPAPI unwrap and decrypts nothing itself; the Master Key is machine-bound and never leaves the process.
Separation, roles and an audit trail
Named workspaces keep conversations, vault, sources, telemetry and logs from cross-contaminating on one machine. With sign-in enabled, four roles govern in-app actions and the identity audit carries automated twelve-month retention with calendar-month rotation.
An internal-network posture, by construction
Wardrail is explicitly not a public-internet server product. The Server bind is loopback-enforced, worker listeners default to loopback and may take an explicit LAN address, and binding to all interfaces is rejected outright rather than discouraged.
Cost treated as a governance signal
Requests route on task type, prompt size, policy and cost budget — and the cost comparison itself is published with its asymmetries visible: what is priced from public lists, what awaits a measured run, what is excluded.
One fixed order of evaluation, from prompt safety to dispatch
Stages 1 to 7 are decided locally, on the device, before anything may leave it. Requests are normalised — schemas, token accounting, safety settings, error classes — before traffic reaches any downstream provider.
Always run, on the normalised payload.
Optional. Large tool or file output is analysed locally; only a compact result travels.
A 6-D skill space plus the preference knob r, biasing cost (−1) to quality (+1).
Disabled and unavailable models are removed, with exclusion reasons recorded.
A match restricts the pool to local models.
CapabilitySpace or Hybrid routing mode, per active profile.
Only if the request is still cloud-bound. Off, Advisory or Enforced.
Local GGUF, on-device NPU, loopback server or cloud API.
Per-request telemetry written to local JSONL — sealed when encryption is on.
are evaluated on the device. The original prompt drives intent classification, the composed egress payload drives locality screening, and a separate transformed artifact is what actually leaves.
From one machine to a governed estate
Three deployment modes — Standalone, Client, Server — control where the routing pipeline executes. Six documented scenarios follow the natural adoption path.
Controls that hold before, during and after the request
Sensitive Sources
Files are indexed locally — keyword index for text formats, local text extraction for PDF — and the composed egress payload is screened, not just the typed prompt. TriggerBased allows cloud until a match restricts the pool; TopicBoundary keeps matches above an advisory threshold local unless egress is explicitly acknowledged.
Cloud Privacy Hardening
Local minimisation with a persistent pseudonym vault, Standard or Strong identifier detection, and Off / Soft / Strict compartmentalisation. Provider privacy tiers — Trusted, Standard, Restricted — bind stricter modes to riskier providers.
At-rest encryption
Opt-in AES-256-GCM envelopes over conversations, settings, the pseudonym vault, the Sensitive Sources index, logs and telemetry. One machine-bound Master Key wraps per-category content keys; Windows Hello gates a DPAPI unwrap and decrypts nothing itself. Encrypted full-bundle export moves an install to another machine; the Server and worker listeners stay down until unlock.
Workspaces and audit trail
Named workspaces isolate conversations, settings, vault, sources, telemetry, logs and a per-workspace audit log on one PC — client A from client B, work from personal. Create, switch, rename and soft-delete are journalled; the audit log filters by date, action and resource and exports to CSV or JSON.
Enterprise sign-in and RBAC
OIDC DEVICE CODE · IDP-AGNOSTIC · v4.0.1Two independent gates sit in front of every session: unlock at-rest encryption, then sign in. Unlock is deliberately not an Admin privilege. Per-workspace memberships use an email allowlist with no SMTP, the first successful sign-in bootstraps Admin across pre-existing workspaces, and service-layer authorization is authoritative — the UI only hides dead ends.
Members, workspace lifecycle, security settings, Sensitive Sources, vault admin, backup and encryption lifecycle, audit view and export.
Create and send, delete own conversations, vault runtime write during chat.
Read conversations; Send and Close are disabled up front, never enabled-then-denied.
Audit log view and export, no chat send.
A knob, four seeded profiles, and metrics that explain the choice
Prefer NPU, aggressive context optimization.
Prefer NPU and caching, aggressive context optimization, Cloud Privacy Hardening off.
Aggressive context optimization with Cloud Privacy Hardening enforced.
Stronger coverage preferred, higher context-optimization threshold, on-device SLM only for trivial pre-analysis.
What the router records about itself
Live latency, tokens, cost, cache behaviour, open-weight against cloud share, CPU/GPU/NPU device mix and context savings all surface on the Metrics page, next to the active preference-knob indicator.
Cost benchmark harness
A reproducible harness for cost-per-completed-task comparison: a fixed set of 16 prompts across 4 categories, a manual quality rubric, cited provider price lists, NPU amortisation assumptions and an NDJSON-aware live runner.
Live measured comparative results are still pending an operator run. Empty cells are not wins, and they are not "$0 local".
The boundaries, stated plainly rather than discovered in production
Every commitment above is documented in the handbook chapter that also carries its limits. These are the limits.
Anyone with the same Windows profile, or raw access to the data folder, can read local files.
Workspace and identity logs detect corruption on read. That is not a hash chain and not cryptographic verification.
The twelve-month window covers the identity audit log. Pending-invite emails in the memberships store still hold plaintext addresses with no retention policy, deferred to a later release.
Once unlocked, data stays reachable in memory until the application closes, and a memory dump on that running process can expose the Master Key.
Sensitive Sources applies before every worker POST. Cloud Privacy Hardening does not apply to workers.
HTTPS still needs a manual netsh SSL binding by an administrator. ARM64 builds force GGUF inference to CPU; CUDA is x64 only. The experimental GPU on-device path ships off by default. Full-text context indexing is unavailable while encryption is on.
Bring the routing decision inside your perimeter.
Wardrail targets engineers and technical operators who already run at least one model and want a second tier — then internal servers, then governed cloud. Ask for the deployment handbook, a walkthrough of your target scenario, or an evaluation build.