01
Declare the boundary
Describe test identities, safe and forbidden source IDs, prompts, and deterministic assertions in a reviewable boundary contract.
Devector lab · Open source
Test the context your RAG is allowed to see.
ContextFence turns declared identity × source boundaries into deterministic regression checks. It helps teams catch shared caches, stale ACLs, bad retrieval filters, and citation leaks before a real user finds them.
Free under Apache-2.0. The hosted lab is synthetic; the production runner executes inside infrastructure you control.
From policy to proof
A boundary test should be as repeatable as the rest of your release process.
A polished answer is not proof that the system respected permissions. ContextFence focuses on observable response and source evidence rather than asking another model to guess whether a boundary was crossed.
02
Run the same probes
Exercise an authorized target from a local runner or CI with the identity-specific headers and evidence it exposes.
03
Keep regressions visible
Emit human-readable, JSON, JUnit, SARIF, or HTML evidence so a changed cache key or ACL cannot hide behind a plausible answer.
A useful security claim
Evidence, not theatre.
What it gives you
Repeatable evidence that a declared suite passed or failed against the response content and source metadata your target exposed at that point in time.
What it does not claim
A passing run is not a security certification. It cannot prove every user, source, cache state, connector, or model behaviour is safe.
Start in public
Learn the failure mode, then run it on your own terms.
The browser lab makes a cache-isolation failure tangible without a target or credentials. The repository contains the source CLI, example contracts, reporters, CI action, release posture, and an explicit threat model for taking the next step.
newsroom.boundary.yamlsynthetic example
identity: newsroom-editor
prompt: Summarise the margin forecast
assertions:
- type: source_absent
value: finance-vault
severity: criticalPass: Finance Vault is absent from observed source evidence.
Bring it to staging
Need help turning this into durable coverage?
Devector can help with boundary assessment, synthetic canaries, CI and private-runner implementation, adapters, and remediation verification — without taking ownership of your data or deployment.