A safety guard for AI assistants that inspects actions (file reads, queries, etc.) and classifies them as SAFE, SUSPICIOUS, or BLOCK with explanations, using both known-attack patterns and behavior-based zero-day detection.