Your application supplies a verified client IP and a real security signal. Guard records the decision in observe mode or applies a short, process-local application limit in enforce mode.

A registered app signs evidence for its own Unix socket. The local agent checks the app identity, Linux peer UID, entitlement, mode, and policy before it may create an app-owned grant.

The scoped XDP path has limited VM evidence. Full two-app enforcement, recovery, and distributed qualification remain open; this panel is an illustrative walkthrough, not a production performance claim.