Guardian Cloud · Module
the knowledge the AI reasons with
Doctrine is a living knowledge base the AI reasons with — not a static rule file. Rules of engagement, playbooks, verified intelligence and the lessons of past incidents, retrieved by meaning and fed into every decision the officers make.
Retrieval is two-stage: an instruction-aware embedder (Qwen3-VL-Embedding-8B, 1024-dim) recalls candidates by intent, and a cross-encoder reranker (Qwen3-VL-Reranker-2B) keeps only the most precise — the model sees the few most relevant pieces, not a keyword dump.
The knowledge is layered and governed: rules of engagement always sit on top, unreviewed entries stay out of live reasoning, and after every incident the outcome is distilled back into doctrine — so each next decision is sharper than the last.
Recall broadly, then rerank precisely — so the model sees the few most relevant pieces, not a keyword dump.
Retrieval pipeline
The instruction-aware 8B embedder finds candidates by meaning, not exact words — so the officer’s intent (“how do I report and contain this attacker”) surfaces the right doctrine.
A cross-encoder reranker scores each candidate against the query and keeps only the strongest — precision over volume.
Not all knowledge is equal. Doctrine is ranked by authority and gated by review.
Rules of engagement
always injected · top authority
Playbooks
operational procedures
Verified references
trusted intel & vendor guidance
Community knowledge
lowest authority
Higher-authority layers win when guidance conflicts. Unreviewed entries are excluded from live reasoning.
After an incident, the outcome is distilled into a lesson — held pending until a human approves it, then it becomes active doctrine. Superseded guidance is retired, never silently overwritten.
Debrief → doctrine learns
Doctrine is grounded in industry standards and vendor documentation — every entry cites a verifiable source, not an invented rule — and enriched by open threat-intel feeds.
Sysadmin
Operational playbooks for diagnosis and remediation.
ITDR
Rules of engagement, incident playbooks and threat intel.
Coding
Secure-coding rules and project context for AI Studio.
The doctrine pipeline was exercised end-to-end against a live embedder on GPU — write, retrieve, learn, govern.
| Check | Detail | Result |
|---|---|---|
| Write | New entries indexed and made retrievable | ✅ PASS |
| Semantic read | A query by intent returned exactly the relevant intel at the top | ✅ PASS |
| Debrief → doctrine | Incident outcome written back as a reviewable lesson | ✅ PASS |
| Governance | Pending lessons excluded from live reasoning until approved | ✅ PASS |
End-to-end on the live srag-l4 embedder (Qwen3-VL-Embedding-8B + Qwen3-VL-Reranker-2B) over Qdrant — 2026-06-13.