Bring AI to your vault —
with guardrails at runtime.

Your vault is not a repository. Losing it is losing your externalized memory.

Most thinking about "AI can touch my files" happens in the context of a codebase, where the worst case is broken code and the fix is one git revert away. A vault is different. It holds years of reflection, decisions and their rationale, the source material for the book you've been planning. Some of it is replaceable. Most of it is not.

The operations an AI might perform on a vault are not all in the same risk bucket. Renaming a note is trivial. Rewriting a meeting summary is recoverable. A shell command writing into ~/.ssh is a different category entirely — the AI just touched the trust boundaries around your notes, not the notes themselves. Treating those as points on the same dimension of risk is what most permission systems get wrong. Gryphon doesn't.

The AI cannot be the last line of defense for AI.

The most underdiscussed real-world risk in AI-assisted knowledge work isn't a dramatic exploit. It's the fetch. You ask the AI to save an article, summarize a webpage, clip a markdown copy of a blog post. Ordinary second-brain work. The AI does exactly what you asked.

But that fetched content now sits in your vault as a note — indistinguishable, at the filesystem level, from content you wrote yourself. Future sessions will read it the same way they read anything else you authored. And it can contain instructions: prompt-injection payloads embedded in scraped HTML, in zero-width text, in summaries from sites that themselves contain injection attempts. Anything that enters your vault inherits its trust, and anything it carries gets executed as context in every subsequent session — until you notice and clean it up.

The shortcut is to hope the model is robust enough to ignore injection attempts. Every major AI lab has published research on this; the consensus is the same. Models can be made more resistant; they cannot be made reliable defenders against attacks aimed at themselves. And when the model fails, the failure is invisible — no error, no anomaly, no warning. The blast radius unfolds silently: a leaked credential, an exfiltrated note, a quiet persistence hook. By the time consequences surface, it's too late.

That's the argument for a layer that doesn't depend on the AI's judgment. Gryphon applies the second-dimension principle to the fetch step. Web fetches that deposit content into the vault always go through the guardrail, regardless of the convenience setting. You see what's about to enter, you decide whether to trust the source, and every downstream session benefits from the decision you made once.