Architecture overview

This page gives the high-level architecture.
For deeper diagrams, see Architecture diagrams. QWED separates untrusted model translation from deterministic verification so you can enforce AI reliability, tool call verification, and zero-trust policy boundaries at runtime.

Core principle

Translation is useful but untrusted. Verification is the trust anchor.

Layered architecture

1) API gateway

Authentication and authorization
Rate limiting and tenancy controls
Request routing and transport security

2) Translation layer (untrusted)

Converts natural language into structured inputs
Can use any LLM provider (cloud or local)
QWED treats all output as untrusted until the verifier confirms it

3) Verification engines (deterministic)

Engine	Purpose
Math	Symbolic arithmetic and algebra checks
Logic	SAT/SMT verification and constraint solving
Code	AST and symbolic security analysis
SQL	Query safety and structure validation
Schema/Taint/Graph/Stats/Fact/Image/Reasoning	Domain-specific verification paths

4) Agent security guards

Guards inspect tool calls, contexts, and policy boundaries before execution.

Guard	Purpose
RAGGuard	Defends retrieval contexts from injection/poisoning
ExfiltrationGuard	Prevents unauthorized data movement
MCPPoisonGuard	Validates MCP tool definitions and safety
SovereigntyGuard	Enforces data residency and routing policy
SelfInitiatedCoTGuard	Checks reasoning flow integrity
ProcessVerifier	Milestone-based process validation
StateGuard	Deterministic workspace rollback via shadow git snapshots

5) Attestation and audit

Each verification can emit signed evidence for traceability and compliance workflows.

{
  "query_hash": "sha256(...)",
  "verification_result": true,
  "engine": "QWED-Math-v2",
  "timestamp": 1735689600
}

v5.2.0 introduces the unified DiagnosticResult model with 3-layer diagnostics — agent-safe, developer, and proof. See the Verification Diagnostics guide for the full model.

Request lifecycle

Security model snapshot

Threat	QWED response
Hallucinated claim	Rejected or corrected by deterministic check
Prompt injection	Translation can be poisoned; verifier and guards enforce policy regardless
Unsafe code or SQL	Blocked by parser, AST checks, and guard rules
Untrusted tool action	Guarded and policy-checked before execution

Verification Diagnostics

The 3-layer DiagnosticResult model — agent-safe, developer, and proof diagnostics.

LLM verification

See how QWED verifies LLM outputs with formal methods instead of probability-only confidence.

AI agent verification

Apply policy enforcement and pre-execution checks to autonomous agents.

Prompt injection defense

Review production guidance for prompt injection defense and OWASP LLM risks.

Deployment modes

Mode	Fit
Cloud API	Fastest start, hosted control plane
Self-hosted	Data control in your VPC/Kubernetes
Hybrid	Mix cloud scale with local policy boundaries

Start here

Configure and understand

Releases

Help

Core principle

Layered architecture

1) API gateway

2) Translation layer (untrusted)

3) Verification engines (deterministic)

4) Agent security guards

5) Attestation and audit

Request lifecycle

Security model snapshot

Verification Diagnostics

LLM verification

AI agent verification

Prompt injection defense

Deployment modes

Next steps

​Core principle

​Layered architecture

​1) API gateway

​2) Translation layer (untrusted)

​3) Verification engines (deterministic)

​4) Agent security guards

​5) Attestation and audit

​Request lifecycle

​Security model snapshot

​Related verification guides

Verification Diagnostics

LLM verification

AI agent verification

Prompt injection defense

​Deployment modes

​Next steps

Core principle

Layered architecture

1) API gateway

2) Translation layer (untrusted)

3) Verification engines (deterministic)

4) Agent security guards

5) Attestation and audit

Request lifecycle

Security model snapshot

Related verification guides

Deployment modes

Next steps