Governing an operation
| Capability | State | Where |
|---|---|---|
| Engine-neutral parsing and classification (structure, never the leading keyword) | Shipped | Architecture |
| Blast-radius analysis — is this provably bounded? | Shipped | Blast radius |
| Policy: resources, columns, classes, approvals, limits | Shipped | Policy |
| Per-agent scoping, enforced inside the statement | Shipped | Architecture |
| Column restriction and field masking (redact, hash, tokenize, partial) | Shipped | Masking |
| Row limits, statement timeouts, attribution comments | Shipped | Policy |
| Read-only transactions for reads | Shipped (PostgreSQL) | PostgreSQL |
| Relationship scoping (scope a child table through its parent) | Planned | Roadmap |
| Native row-level security as a second layer | Planned | Roadmap |
Putting a human in the loop
| Capability | State | Where |
|---|---|---|
| Approvals: changes wait for a person | Shipped | Approvals |
| Exact before/after previews, labelled by fidelity | Shipped | Previews and fences |
| Commit-time fences — a stale approval is refused | Shipped | Previews and fences |
Async mode: proposed now, outcome polled later | Shipped | Approvals |
| Debug Mode: step through an agent’s traffic live | Shipped | Debug Mode |
| Operator view in the browser, with a live event stream | Shipped | Operator view |
| Signed webhook notifications with the preview inline | Shipped | Notifications |
| Slack approve/reject buttons | Planned | Roadmap |
| Automatic re-preview of a stale change | Planned | Roadmap |
Keeping it accountable
| Capability | State | Where |
|---|---|---|
| Tamper-evident audit chain (hash-linked, verified on demand) | Shipped | Audit |
| Leases: agent access with an expiry, revocable | Shipped | Leases |
| Circuit breakers: freeze a looping or misbehaving agent | Shipped | Reliability |
| Plan-aware idempotency, surviving a crash | Shipped | Reliability |
| Suspiciously-empty results flagged rather than returned as fact | Shipped | Reliability |
| Metrics: latency, denials, approval waits and expiry, breaker and lease events | Shipped | Metrics |
| A real database role per lease, terminated on revoke | Shipped (PostgreSQL) | PostgreSQL |
| SSO/SCIM, RBAC, signed policy bundles | Planned | Roadmap |
Proving it
| Capability | State | Where |
|---|---|---|
| Capability ladder: every guarantee labelled by who enforces it | Shipped | Capability ladder |
| A connection refuses to start when policy exceeds the engine | Shipped | Capability ladder |
| Certification harness, run against a real server in CI | Shipped | wardencert |
| Adversarial corpus (homoglyphs, smuggled writes, parameter escapes) | Shipped | wardencert |
Engines
| Engine | State |
|---|---|
| PostgreSQL | Reference connector, certified 84/84 strict |
| MongoDB | Second engine, certified strict against a replica set in CI — MongoDB |
| Neo4j | Third engine, certified strict against a live server in CI — Neo4j |
| In-memory reference engine | Shipped (testing and demos), certified 123/123 strict |
| MySQL | Designed, not built |
| Custom connectors (plugin SDK) | Planned |
Interfaces
| Interface | State |
|---|---|
| HTTP data plane (agents) and control plane (operators) | Shipped |
MCP server (warden-mcp) | Shipped |
CLI (warden serve, debug attach, audit tail, policy lint, keygen) | Shipped |
| Operator view in the browser | Shipped |
| Python and TypeScript SDKs | Planned — see why |
| Hosted control plane / console | Planned |