Skip to content

The Stalwart user guide

This guide is for the people who build agents with Stalwart, and for the people who answer for those agents. It says what each product does, how to use it, and where each guarantee stops.

The products

One API key reaches all of them. The guide names them as the website and the API reference do.

  • The Bot Builder builds your own AI agent from the tools your business already has, declared in one file, with your rules checked on every tool call before it runs. A component inside it, the selector, reads each turn of a conversation and picks the tool by a named rule, with no model call.
  • Agent Graph Verification checks every route through an agent, or a team of agents, before it goes live, and returns each route that reaches a tool without its check, its confirmation or its order rule.
  • The Guardrail Bug Hunter finds every way through your guardrails to a forbidden action, shows each one happening, and hands you a fix it has already checked by scanning again.
  • Guardrail Verification answers whether one action can fire without its safety context, or a whole table of such questions, and returns a counterexample with a repair, or a certificate.
  • Guardrail Writing drafts a guardrail policy from a rule written in prose, on your own model, then verifies the draft and repairs it where it is wrong.
  • Random Forest Verification checks a trained random forest against robustness, monotonicity, fairness and reachability properties, or searches around real records for the smallest change that flips a decision.

The hunter and the selector, together

The two are built to be used together. A guardrail can make every tool action wait for the selector's decision: the selector reads the turn, and the guardrail runs a tool only where the selector's plan says run for that tool. The Guardrail Bug Hunter then searches every path through the guardrail for one that reaches a tool without that decision, and fails the pull request that adds one. Chapter 29 works through that example. A clean scan proves the policy sends every tool through the selector; it does not prove the selector chose the right tool, which chapter 20 explains.

Language support

The selector understands turns written in English. Portuguese is its next grammar, and has not shipped yet; until it does, a turn written in Portuguese is not read as Portuguese.

One agent, in one file

A team puts the products to work through one agent, without learning an agent framework. You declare the agent in one file: its tools, its rules, and which writes undo which. Before it runs, its routes are verified; while it runs, every turn is read and every tool call is checked on your own machine; and a run that fails is undone, last write first. This is the shop agent the guide uses throughout Part I:

# The shop's support desk, and the billing desk it hands refunds to.
agents:
  desk:
    model: "anthropic:claude-sonnet-5-5"   # your provider; the key comes from your environment
    tools: [get_order, charge_card, send_receipt, read_inbox]
    hands_off_to: [billing]
    on_unread: refuse                      # a turn no tool covers is refused, by name
  billing:
    privilege: high
    tools: [refund_card]
tools:
  - python: shop.tools                     # every public function of shop/tools.py
rulebook: ./policy.co                      # the rules every call is checked against
runs: atomic                               # a failed run is undone, last write first
storage: sqlite:///runs.db                 # where runs and waiting confirmations are kept

Part I builds it step by step, in the words of the file above and in no framework's.

Where to start

The guide is in five parts: the Bot Builder, the Bot Builder's selector, the Guardrail Bug Hunter, the hunter and the selector together, and verification and writing. Chapter 39 is for governance and security teams: what each product maps to in the OWASP Top 10 lists of 2026 and the NIST AI Risk Management Framework, and what such a mapping is not. The appendix holds the reference tables, the glossary and the changelog.

Checking our work without us

A certificate can be checked with no key, no network and none of our software. The certificate specification says how to read one, the reference checker is one file you can read in an afternoon, and the certificate corpus gives you real certificates to run it on.

The guide offline. The whole guide in one file, for reading with no network or for an audit file: English · Portuguese.

Each file's SHA-256 is in SHA256SUMS, so a copy can be checked against the one published here. Links that leave the guide -- the API reference, the website -- need the network, and say so; the offline guide has no search.

Elsewhere

Chapter numbers are identifiers: a chapter keeps its number whatever page it moves to, so an audit file that cites chapter 7 keeps pointing at the same chapter.