> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sector8.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Welcome to Sector8

> Security & Observability for Enterprise AI

# Security & Observability for Enterprise AI

Monitor, protect, and govern your AI applications in real-time. Turn AI black boxes into secure, auditable systems.

<Info>
  **Sector8 enforces security before execution — not after.** Every LLM tool call passes through a policy gate before the OS acts on it. Data never moves until a decision is made.
</Info>

***

## What you can do with Sector8

<CardGroup cols={2}>
  <Card title="Block threats in real time" icon="shield-halved">
    Stop prompt injection, shell injection, PII exfiltration, and data leakage before they execute. Denied calls carry forensic fields for audit and replay.
  </Card>

  <Card title="Govern Claude Code" icon="plug">
    The Guard MCP Server intercepts every Claude Code tool call — bash, file access, web fetch — before OS execution. One config file, zero code changes.
  </Card>

  <Card title="Full audit trail" icon="file-lines">
    Every blocked call produces a tamper-evident record with an evidence hash, policy version, and decision trace ID. Built for GDPR, HIPAA, and PCI-DSS.
  </Card>

  <Card title="Drop into existing apps" icon="code">
    Wire the Guard Module into any LLM application via the Python SDK or REST API. Works with any model, any agent framework.
  </Card>
</CardGroup>

***

## How it works

The LLM proposes actions. Sector8 decides whether they run.

```
LLM Output
    │
    ▼
Spotlighting          ← trust-tags all content by source
    │
    ▼
Pre-Filter            ← low-latency fast path, blocks obvious threats
    │
    ▼
Admission Controller  ← 5-check policy gate, 7 invariants enforced
    │
  DENY │ ALLOW
    │       │
Blocked  Executes
+ trace  + telemetry
```

Unlike output filters or SIEM tools — which run after data has already moved — Sector8 enforces policy **before the OS executes the tool call**. There is no path around the gate.

***

## Get started

<CardGroup cols={3}>
  <Card title="Guardrails" icon="shield" href="/guides/guardrails">
    Understand the Guard Module — invariants, admission checks, spotlighting, and forensic telemetry
  </Card>

  <Card title="Python SDK" icon="python" href="/guides/python-sdk">
    Wire the Guard Module into your application in minutes
  </Card>

  <Card title="Guard MCP Server" icon="plug" href="/guides/mcp-server">
    Govern Claude Code tool calls — no code changes required
  </Card>
</CardGroup>

***

## Why pre-execution matters

| Enforcement point             | Timing                       | Data exposure              |
| ----------------------------- | ---------------------------- | -------------------------- |
| **Sector8 Guard Module**      | Before OS execution          | None — data never accessed |
| Output filters / model safety | After LLM generates response | LLM has already seen data  |
| SIEM / DLP                    | After network transmission   | Data has already moved     |
| Audit logs                    | After everything             | Detective only             |

***

## Live system status

```json theme={null}
{
  "status": "healthy",
  "phase": "2",
  "invariants_active": 7,
  "policy_version_id": "0dbca364d664...ebc7",
  "capabilities": {
    "admission_controller": true,
    "semantic_engine":      true,
    "pre_filter":           true,
    "multi_turn_analyzer":  true,
    "output_compliance":    true,
    "file_scanner":         true,
    "rag_integrity":        true,
    "memory_integrity":     true,
    "guard_mcp_server":     true
  }
}
```