A trust-first AI assistant with hardened agent security.
AI assistants that take real actions need real security — most treat the prompt as the only guardrail.
A trust-first assistant on a hardened two-plane agent architecture (trusted control separated from untrusted input), with LiveKit real-time and least-privilege tool design.
Hardened two-plane agent security with real-time voice.
Most assistants that take real actions treat the system prompt as the security boundary. It is not one. A prompt is a request made in the same channel as everything else the model reads, which means any document, any web page and any tool result can compete with it — and only has to win once.
Stewra starts from the opposite assumption: that the model will at some point be persuaded to try something it should not, and that the system's job is to make the attempt fail rather than to make it unlikely.
The trusted control plane — the code that decides what is permitted — is isolated from untrusted input, which includes model output as well as anything read from the outside world. Untrusted content can influence what the assistant says. It cannot become an instruction the system acts on, because the component that authorises actions never reads it as one.
Every tool is scoped to least privilege on top of that, so the question at each call site is not "should the model be allowed to do this?" but "what is the worst this tool can do if it is invoked wrongly?" — a question with a bounded answer.
Stewra runs real-time voice on LiveKit, over multi-provider LLM routing. Real-time is where safety work usually gets quietly traded away: there is no room to retry, no room for a slow check, and a guardrail that adds latency is under constant pressure to be removed.
Designing the boundaries so they are cheap to enforce — structural rather than inspective — is what lets them survive contact with a live conversation. It is the architecture the studio's agent safety engagements are built on.