RAME Guardian

Personal AI that repairs its work when decisions change—preserving human edits, rejecting stale actions, and keeping users in control. Powered by NVIDIA Nemotron on Nebius.

Comment

Inspiration

AI assistants are becoming increasingly capable of remembering information, planning tasks, and acting on behalf of their users. But persistent memory introduces a problem that ordinary chat history does not solve:

What happens when a user's authorized decision changes after an AI agent has already planned work based on it?

An assistant may continue executing an outdated plan, overwrite a human correction, or treat instructions hidden inside a document as if they came from the user.

We wanted to explore a different approach: personal AI that can understand changing decisions without losing track of who authorized them, what work depends on them, and what must remain protected.

That led us to RAME Guardian.

Rather than giving the language model authority over persistent memory and actions, Guardian separates intelligent planning from deterministic authorization and execution.

Our guiding principle is simple:

Nemotron proposes. Guardian verifies. The user authorizes.

What it does

RAME Guardian is a personal AI assistant with authorized, versioned memory and selective work repair, powered by NVIDIA Nemotron through Nebius Token Factory.

It demonstrates three connected capabilities.

1. Recovery Studio — Repair work without losing human decisions

Imagine a professional preparing a client delivery.

The assistant has already created four versioned work products: a delivery plan, a client proposal, an execution board, and an independent research note.

The original plan assumes 12 hours of availability. The user has also made important decisions and corrections, including an approved price of €2,600, an accessibility requirement, and a completed architecture audit.

Now the user's availability changes to 8 hours.

A previously approved draft based on 6 hours is still pending. Applying it would conflict with the newer authorized decision.

Guardian rejects the stale operation before it changes any of the four work products.

NVIDIA Nemotron 3 Super then analyzes the current state and proposes a selective repair.

Guardian checks the proposal against the latest authorized decision, current result versions, protected fields, and approval preconditions.

The user reviews and authorizes the exact repair.

Guardian then commits the approved changes atomically: either the complete valid update is applied, or none of it is.

In our tested scenario:

  • Three affected work products are updated.
  • The human-edited €2,600 price remains unchanged.
  • The accessibility requirement remains protected.
  • The completed architecture audit retains its completed state.
  • The independent research note is not modified.
  • Stale operations are rejected with zero partial writes.
  • Repeating an already committed operation does not duplicate the changes.
  • The resulting state persists across page reloads.

The benefit is not simply remembering a preference. It is keeping existing work coherent when the decisions behind it change.

2. Guardian Lab — Untrusted content cannot authorize decisions

AI agents routinely read documents, repository files, web content, and tool outputs.

Those materials may contain useful information, but they may also include instructions attempting to override the user's choices.

Guardian Lab demonstrates this distinction using a document that contains both a legitimate task and an attempted instruction override.

Nemotron analyzes the document and proposes actions. Guardian independently checks whether those actions are authorized.

An instruction embedded in the document cannot authorize a new persistent decision or bypass the current execution policy.

The demonstration shows the rejected action and its recorded outcome.

This protection is implemented in deterministic application logic rather than relying exclusively on prompt instructions.

3. Conversation — Memory requires explicit authorization

RAME Guardian also provides a real conversation experience using NVIDIA Nemotron 3.5 Lightning.

When the user expresses a potentially reusable preference, Nemotron can propose a memory entry.

Guardian presents the proposed decision before it is stored.

The user can approve or reject it.

Approved memories are versioned, linked to their authorization records, and available across subsequent conversations.

The model cannot silently turn its own suggestions or untrusted document content into authorized persistent memory.

How we built it

RAME Guardian combines NVIDIA open models, Nebius inference, a web application, persistent storage, and a deterministic authority engine.

NVIDIA Nemotron through Nebius Token Factory

We use two models through the Nebius Token Factory inference API:

NVIDIA Nemotron 3.5 Lightning

  • Interactive conversation.
  • Understanding user preferences.
  • Proposing candidate memories.

NVIDIA Nemotron 3 Super

  • Analyzing documents and work dependencies.
  • Preparing selective repair proposals.
  • Reasoning about changed requirements and current project state.

Both models perform inference through Nebius Token Factory during application execution.

The models provide interpretation and proposals. They do not independently grant permissions or commit protected changes.

Deterministic Memory Authority Engine

Guardian implements the controls outside the language model.

Its responsibilities include:

  • Explicit user authorization.
  • Versioned decisions and persistent memory.
  • Authorization receipts using Ed25519 signatures.
  • Provenance and audit records.
  • Protected human-edited fields.
  • Stale-version detection.
  • Approval-bound modifications.
  • Transactional, atomic execution.
  • Idempotency for repeated operations.

A proposal is checked against the current state when it is applied, not merely when it is generated.

This prevents an old session from silently executing a repair after the relevant authorization or work product has changed.

Web application and storage

The public demonstration runs as a web application using Cloudflare Workers and Cloudflare D1.

Workers handle the application API, model requests, authorization checks, and execution logic.

D1 persists authorized memories, decisions, work products, versions, repair proposals, and audit evidence.

The Nebius API key is stored server-side and is never exposed to the browser.

The public demonstration supports isolated anonymous sessions, secure session cookies, individual scenario resets, and inference usage limits.

Testing and reproducibility

We implemented automated tests covering authorization, version conflicts, stale operations, atomic updates, preservation of protected fields, and idempotent execution.

We also tested the deployed application using live Nemotron inference.

Production acceptance checks verified the rejection of stale repairs, successful application of a valid repair, persistence after reload, and isolation between independent anonymous visitors.

The public repository includes the application code, database migrations, tests, setup instructions, and an Apache-2.0 license.

Challenges we ran into

Separating model intelligence from authority

A language model can understand a user's intent and propose a useful action. That does not mean its output should be treated as authorization.

We had to design a clear boundary between model-generated proposals and user-approved changes.

Handling concurrent changes

An approval may be valid when a proposal is prepared but become outdated before execution.

We addressed this by validating decision versions, work-product versions, approval integrity, and operation preconditions at execution time.

Preserving human work during repairs

Regenerating an entire plan can unintentionally remove human edits or overwrite completed work.

We needed to distinguish affected content from protected or independent results, and to expose those differences clearly before committing a repair.

Making technical guarantees understandable

Hashes, version identifiers, and transactional logs are useful evidence, but they do not immediately explain the benefit to a user.

We developed a visual Changed / Preserved comparison so that the consequences of a proposed repair can be inspected directly.

Testing real model behavior

Model-generated proposals are not always identical across executions. We therefore separated model reasoning from deterministic execution checks and tested both the application logic and live model integration.

Accomplishments that we're proud of

  • Built an interactive personal AI demonstration using NVIDIA Nemotron through Nebius Token Factory.
  • Implemented explicitly authorized and versioned memory.
  • Added cryptographically verifiable authorization receipts.
  • Demonstrated rejection of stale operations with zero partial writes.
  • Implemented atomic and idempotent repair execution.
  • Preserved human-edited fields, completed tasks, and independent results during a selective repair.
  • Connected model-generated repair proposals to deterministic execution checks.
  • Verified state persistence across page reloads and subsequent conversations.
  • Tested anonymous session isolation and protected the Nebius API key on the server.
  • Published a reproducible open-source implementation with automated tests and documentation.

What we learned

Persistent memory is not the same as persistent authority.

An agent may remember a decision correctly and still perform the wrong action if that decision has changed since the work was planned.

We learned that useful long-running assistants need to distinguish observations, proposed changes, authorized decisions, and executable actions.

We also learned that model reasoning and deterministic controls complement each other.

Nemotron is valuable because it understands documents, interprets changes, and proposes meaningful repairs.

Guardian is valuable because it checks whether those proposals are still valid and authorized before producing persistent effects.

Finally, we learned that a technical guarantee becomes much more meaningful when a user can see exactly what changed, what was preserved, and why an operation was rejected.

What's next for RAME Guardian

RAME Guardian is a working demonstration of authorized memory and selective repair, not a claim that every possible agent action or prompt-injection attack is solved.

Our next priorities are:

  • Expand the system to additional everyday workflows and tools.
  • Improve dependency tracking and repair explanations.
  • Support reusable agent skills and additional integrations.
  • Extend adversarial and long-horizon evaluations.
  • Measure the amount of human review and rework avoided.
  • Improve recovery and coordination across longer-running agent sessions.
  • Continue developing the open-source project using feedback from real users.

Our long-term goal is to make personal AI more dependable when users change their minds, update their requirements, or delegate work over time.

RAME Guardian demonstrates a practical principle: an AI assistant should adapt to your latest authorized decisions without silently discarding the work you have already approved.

Try the live demo: https://guardian.ramesystem.com

Source code: https://github.com/caimari/rame-guardian

Powered by NVIDIA Nemotron through Nebius Token Factory.

Built With

Share this project:

Updates

Submission history