DRE compiles policy.md into a provider-specific enforcement artifact. The artifact differs by adapter — a steering vector here, a guardrail config there, a judge sidecar elsewhere. What stays constant is the judgment loop: every governed action passes through a claim bound back to the policy text.
For models where DRE owns the inference path, a compiled steering vector is added to the residual stream at a chosen layer with a coefficient alpha. The vector is not a universal abstraction — it requires model-specific evals, layer selection, alpha tuning, and a contrast-pair corpus per policy. Feasible via PyTorch forward hooks or llama.cpp hidden-state access.
For customers running Gemini on Vertex, DRE compiles policy.md into a Vertex guardrail config plus a structured reasoning contract the model is asked to satisfy. The DRE judge checks the contract output before any tool call is admitted.
DRE compiles policy.md into a Bedrock guardrail config plus a system-prompt digest. The guardrail evaluates input and output; the digest anchors the model's behavior. The audit chain links action → claim → policy text + digest hash, not a residual vector.
The closed API generates the response under a DRE-compiled system preamble. A small open-weight model (governed by the self-hosted adapter) runs as a judge over risky claim classes before a tool call is admitted. The judge is how DRE enforces policy when the frontier model exposes no hook.
Planned. Compiled policy would emit a Claude tool-use schema whose shape enforces disclosure tokens and claim fields. The judge sidecar would verify claims against the policy text before the tool executes. No shipping code yet.
DRE's long-term goal is compile once, govern everywhere. Across open-weight models, frontier APIs, and enterprise runtimes, the enforcement surface may change. The policy, audit trail, and trust logic should not.