Guardrails
Every major platform gates tool calls and data access.
The final answer, the one you act on, goes out unchecked.
Source: AWS AgentCore Policy, Google Agent Gateway, Anthropic Agent SDK documentation
Stop acting on confident wrong answers.
Merlin checks every AI answer your engineering team acts on against what was actually read, run and finished, and refuses what it can't prove. It runs on your own hardware.
Google's Harness² improves the harness around a model. Merlin is the harness, and it also guards the answer. Source: Harness², Google Cloud AI Research, October 2026 ↗
Try Merlin on our infrastructure, with access to the Merlin clients.
01 / The gap
AI guardrails watch what a model does. Nothing checks what it tells you.
Merlin checks the claim against the record before you see it.
Self-reports
In a 2026 benchmark, the best model followed a company handbook on 36.2% of tasks.
Failed runs nearly always ended with a confident claim the handbook was followed.
Source: HANDBOOK.md, arXiv 2607.25398
Checks
Where answers are checked at all, another model usually does the checking.
On a sample, after the answer has gone out.
Source: Mastra scorers, AWS AgentCore Evaluations documentation
02 / Purpose
What you use it for.
Work where a confident wrong answer costs more than an honest partial one.
Merlin lets engineering teams put AI to work on their own codebase and documents, with every claim checked against the record before anyone acts on it, on hardware the company controls.
Analysis
Analyze a codebase.
Findings that cite the files and symbols they came from. A finding that does not survive rebuttal is marked refuted, not quietly dropped.
Findings your engineers can act on without re-checking.
Specification
Specify a whole repository.
Specifications written from the code itself. Each claim cites the code it rests on, and a claim a reviewer could not verify is marked, not hidden.
A specification the team can trust because every claim names its code.
Documents
Ask your documents.
Answers with page and section citations across nine formats. Extraction stays on your hardware.
Answers with the page behind them, so nobody rereads the document to confirm.
03 / Proof
The model said done. Merlin said no.
A real production run from August 2026. The model reported the job finished while one of 25 tasks was still open. A rule checked the claim against the task record and refused it.
Over the 30 days to 18 October 2026, Merlin made 432 final-answer decisions and refused 50 of them.
Source: Merlin operating logs, final_authorization_decision records, 30 days to 18 October 2026
From the operating record
24 of 25 tasks complete.
Full-success answer rejected
- task_total
- 25
- task_completed
- 24
- task_in_progress
- 1
- committed_writes
- 11
The model said done. The record said 24 of 25. The record won.
Open the recordHistorical production excerpt. Identifiers omitted.
04 / How it works
Every step can stop the answer.
Plan the work. Gather the evidence. Challenge the findings. Verify the changes. Authorize the answer — or refuse it.
05 / How Merlin earns the right to claim
The model reasons. The harness keeps the receipts.
Merlin is the system a model works inside, bringing tools, evidence and verification into one harness. Its defining responsibility is deciding what that system has earned the right to claim.
01 / Evidence
Every claim points to what was read.
A file, a command's output, a retrieved source. Merlin records what it observed, so each claim can name the evidence it rests on.
You can audit every claim back to its source.
Read the requirement02 / Challenge
Every finding has to survive a challenge.
Before a finding is reported, Merlin argues against it. It comes back survived, refuted or inconclusive, and a refuted finding stays on the record.
A finding you act on has already survived a challenge.
Read the requirement03 / Authority
Open work can't be called done.
If a task is still open, a claim of full success is rejected by a rule, not left to the model. Merlin reports what it finished and what it didn't.
You never act on “done” while work is still open.
Read the requirement06 / Your infrastructure
It runs where you put it.
Local execution keeps change and answer authority. Cloud escalation is configuration-gated and can be switched off. The boundary should be a decision you can inspect.
Explore the local boundary ↗