AI Firewall — Constitutional rule engine with 3-layer enforcement. YAML setup, natural language rules, immutable core. If the AI can't solve the logic, it can't do anything.
n2-ark provides 5 tools with clear safety-focused naming (ark_check, ark_status, ark_load_rules, ark_stats, ark_reset). All tools have descriptions (avg 120 chars, within 10-1024 range). Input schemas are present and typed. However, parameter descriptions are sparse or missing entirely, most params lack guidance on format, constraints, or usage context. Output schemas are not documented. Error handling is minimal; responses lack recovery guidance. The tool set is well-composed (single responsibility per tool) but lacks the LLM-optimization depth expected of A-grade tools.
Check if an AI action is allowed by the safety rules. Call this BEFORE executing any action. Returns { allowed: boolean, reason?: string, layer?: string }.
Load additional safety rules from a string (general layer only). Constitutional rules cannot be modified.
Reset all state machines to initial state.
Get audit statistics: blocked vs passed actions over N days.
Get current n2-ark status: loaded rules summary, state machine states, and layer breakdown.
Output schemas not documented. LLMs cannot infer response structure (e.g., what fields does ark_check return beyond 'allowed' and 'reason'?). Agents cannot plan downstream calls or extract chaining IDs.
Parameter descriptions are minimal or absent. 'rules' param in ark_load_rules says 'Rules in .n2 format' but does not explain what .n2 format is, valid syntax, or constraints. 'days' in ark_stats has no description of valid range (1-365? 1-30?).
No error handling guidance. If ark_load_rules fails (invalid .n2 syntax), what does the error response look like? Can the agent retry? Should it ask the user? No recovery path documented.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 53 | 2026-07-28+ | v2 |
ark_check description does not clarify when to call it. 'Check if an AI action is allowed' is vague, does this check before every tool call? Only for sensitive actions? What constitutes 'content'? Needs dependency hints and usage context.
ark_stats 'days' parameter lacks constraints. No min/max specified. Can an agent pass days=999999? Unbounded numeric parameters invite absurd values that break APIs or cause timeouts.