Open-source runtime verification for AI, licensed under Apache-2.0.
QWED
Contact

Type to search pages, engines and advisories.

    Looking for API details?Search the docs

    Prove what an infrastructure change allows before it ships.

    AI now writes Terraform, access policies and network rules. QWED Infra proves what those changes actually allow, who can reach what, and what they will cost, before anything is deployed.

    ContactRead the documentation

    What QWED checks here

    • Access policies
    • Network reachability
    • Cost
    • Release packages

    With QWED Infra

    One line of infrastructure code can open everything.

    The mistakes are small to write and large to live with.

    Nobody checked any of it

    Without QWED

    • Access to everythingA policy grants s3:* on every resource, so any bucket can be read or deleted.
    • Open to the internetSSH port 22 is opened to 0.0.0.0/0, the whole internet.
    • A bill nobody expectedA development server is set to a p4d.24xlarge instance, about $23,000 a month.

    Each one checked before it is used

    With QWED

    1. Access to everythingIamGuardThe solver proves the policy reaches every bucket.
      VERIFIED · DENY
    2. Open to the internetNetworkGuardThe internet can reach port 22, so the change is held.
      VERIFIED · DENY
    3. A bill nobody expectedCostGuardOver budget, so the change is not applied.
      BLOCKED · DENY

    What is proven correct goes through, with a record of why.

    QWED returns the decision; your integration acts on it.

    What QWED checks

    Every check is deterministic. QWED Infra does not ask a model to judge a model, and Terraform does not need to be installed.

    • IamGuard

      Access policies

      Uses the Z3 solver to prove what AWS IAM policies allow, including wildcards, explicit denies, and source IP and time conditions.

    • NetworkGuard

      Network reachability

      Whether the internet can reach a subnet or a database.

    • CostGuard

      Cost

      Estimates cost from public on-demand prices before deployment and blocks changes over budget.

    • ArtifactBoundaryGuard

      Release packages

      Release artefacts must not contain secrets, debug files or wrong build paths.

    Where it fits

    1. Your AI

      Writes or edits Terraform, an IAM policy or a network rule.

    2. QWED

      Proves what the change allows, who can reach what, and what it will cost.

    3. Your systems

      Your pipeline applies only changes that passed.

    Good to know

    • QWED Infra currently focuses on AWS and Terraform. Kubernetes and Azure are on the roadmap.
    • NetworkGuard does not model NAT gateways, VPC peering, network ACLs or Transit Gateway. When they are present it returns UNVERIFIABLE instead of guessing.

    Get started

    • QWED Infra

      v0.3.0Status not declared

      Terraform, IAM and cloud cost. Results can be exported as signed Verification Context documents.

      pip install qwed-infra

    Bringing AI into cloud infrastructure?

    Tell us what your AI does and where a mistake would hurt.

    Contact

    Other fields