Lock a topic. Prove you locked it.
A rule in a system prompt is a request. Ours is a gate: the message is classified before it reaches the model, refused if it lands on a locked topic, and recorded either way. No second model in the loop, and nothing to re-send on every turn.
Lock “options pricing” and watch it hold.
Including against a rephrase that never says the word "option" — and without catching the adjacent consumer-complaints question, which is the harder half of the problem.
What a lock gets you
Refused before inference
A locked topic never reaches the model, so you're not billed for the completion and nothing off-policy gets generated.
Survives rephrasing
Matching is semantic, not keyword — which is why the second question above is caught too.
Bound to the API key
Policy travels with the credential, not the prompt. One base-URL change and every call is governed.
Auditable, not asserted
Show a reviewer what was refused, when, and on what basis. CSV and JSON on every plan; webhook and SIEM on Enterprise.
Reliable enough to depend on
A lock is only as good as the recognition behind it. Across the governance roster — the 63 regulated topics, which deliberately sit close together, plus a catch-all for everything outside them — it picks the right one 94.8% of the time. Adding the 151 capability topics alongside them costs that 2.6 points — which is why we measured it before shipping the two together.
63 regulated topics, not 14 harm categories.
Content guards answer "is this harmful?". A regulated business needs a different question answered: "is this about a topic we are not licensed to discuss?"
| Guard | Categories | Organized around |
|---|---|---|
| ShieldGemma · Azure Content Safety | 3–4 | harm |
| Qwen3Guard · Granite Guardian | 9 | harm |
| OpenAI Moderation · WildGuard | 13 | harm |
| Llama Guard 4 | 14 | harm |
| NemoGuard ContentSafety | 23 | harm |
| Tileward | 63 | regulated business topics |
| Tileward — plus the rest of the roster | 151 | everything else |
In Llama Guard's whole taxonomy, finance, medicine and law collapse into one bucket: S6, "Specialized Advice." That is not a policy you can run a regulated business on. We ship AML & KYC, options pricing, personal medical advice and 60 more regulated topics, each individually lockable and none of which you have to write a definition for — plus 151 more covering everything from programming languages to the sciences, which lock the same way. 214 lockable tiles in total.
Llama Guard is free, and you should use it. It answers is this harmful? We answer a different question: is this about mortgage refinancing, and is that topic locked for this key? Most serious deployments run both — a harm filter and a topic policy are not substitutes.
The knowledge isn't deleted from the model. Erasing a concept from trained weights is an unsolved problem, and anyone claiming otherwise is selling something. What you get is a gate at the door that catches the topic however it's phrased, declines, and writes it down — which, unlike a system-prompt rule, you can actually audit.
False positives are the number we watch hardest, and ours is not where we want it yet. Fine-grained topics mean more chances to misfire on classes that sit next to each other. Today, roughly 1 in 7 unrelated queries trips a lock it should not, and that number comes down with every calibration pass. Read it with the right scope: it is an average across the roster measured on our own benign test set, not XSTest and not OR-Bench, and it is a false lock: an over-refusal, not a leak. We publish the rate because a control you cannot quantify is not a control, and because you would find it in the first hour of an evaluation.
214 lockable tiles. These 63 are the regulated ones.
If you are here to check whether your topic is covered, this is the list — scan it rather than book a call. Every tile switches off independently, and none of them needs a definition written by you.
The topics a licence, a regulator or a compliance officer turns on. Broken out below.
Programming languages, frameworks, the sciences, reasoning, general knowledge. Same lock, same audit record.
Every one independently switchable per API key. Private tiles of your own are an Enterprise feature.
The 63 regulated topics, in full
Finance
Market risk, Credit risk, Operational risk, Options pricing, AML & KYC
Safety
Self-harm & crisis, Weapons & dangerous goods, Biosecurity
Industries
Energy & utilities, Pharma & life sciences, Real estate
Legal
Legal & contracts, Personal legal advice, Data privacy & PII
Healthcare
Clinical medicine, Personal medical advice, Public health
Business functions
Sales, Marketing, Customer support
Tax & insurance
Insurance underwriting, Tax accounting, Personal tax advice
Civic & world
Political affairs, Geopolitics, News & current events
Content integrity
Misinformation, Deepfakes & synthetic media, Copyright
Security
Cybersecurity defense, Exploits & malware
Public sector & HR
Public procurement, HR & employment
Technology
Software engineering
Each domain lists a few of its tiles to show the grain, not all of them.
We build it. Give us the topic as your regulator, licence or internal policy words it — plus a handful of questions you would and would not want answered — and we train it as a private tile on your account: visible only to you, never added to the public roster, and enforced exactly like the 214 above. Same lock, same audit record, same refusal before the model runs.
It does not have to be regulated, either. Teams use private tiles for an unreleased product name, an internal codename, a client under NDA, or a subject a particular deployment simply should not discuss. Private tiles are an Enterprise feature; bring us the topic and we will tell you what it takes before you commit to anything.
Tileward Governance is included with every model plan.
Governance is not a separate line on the bill. Every tier on the main pricing table comes with the full roster of 214 tiles — no tier gets a better classifier or a smaller taxonomy. What changes is how many requests you can check, how many tiles you can lock at once, and how long the record is kept.
- 200 guard checks
- 3 tiles locked · 2 keys
- 7-day audit window
- 100 requests/min
- CSV, JSON export
- 2K guard checks
- 25 tiles locked · 10 keys
- 30-day audit window
- 300 requests/min
- CSV, JSON export
- 40K guard checks
- Unlimited tiles · 50 keys
- 30-day audit window
- 1,000 requests/min
- CSV, JSON export
- 200K guard checks
- Unlimited tiles · 100 keys
- 1-year audit window
- No rate limit
- CSV, JSON · SSO
- Committed-use pool
- Private tiles of your own
- Retention you set, locally
- Webhook & SIEM · SSO + SCIM
A guard check is one classification of one message, allowed or refused — a refusal costs a check and no model tokens, which is the point. Private tiles built to your own definition are an Enterprise feature; see the roster for what the 214 already cover.
Before you commit to anything.
What happens to our deployment if Tileward goes away?
The air-gapped build keeps running. It is a flat licence against weights and a binary already on your hardware, with no call home and no metering — nothing we operate has to stay up for it to keep serving. What you would lose is us: new tiles, model updates and support.
What that is worth in writing — source escrow, a perpetual fallback licence, the exact terms on wind-down — is a contract question, and the honest answer today is that it is negotiated per deal rather than published. Ask before you sign, not after.
Is the topic locked, or is the knowledge removed from the model?
Locked. Erasing a concept from trained weights is an unsolved problem and anyone claiming otherwise is selling something. What you get is a gate at the door that catches the topic however it is phrased, declines, and writes it down — which, unlike a system-prompt rule, you can audit.
We already run Llama Guard. Why add this?
For a lot of cases you do not, and we would rather say so. Llama Guard answers is this harmful? We answer a different question: is this about mortgage refinancing, and is that topic locked for this key? Most serious deployments run both — a harm filter and a topic policy are not substitutes.
What does a refusal cost?
One guard check and no model tokens. The classification happens before inference, so a refused request never reaches the model and never appears on the token bill.
Bring us a topic you can't let the model discuss.
We'll lock it, try to get past it, and show you the record. Thirty minutes, an engineer, no deck.