ChangeGuard is the decision layer for infrastructure change. It judges every Kubernetes change against live cluster evidence before it ships - returning SHIP, HOLD or BLOCK with the reasons in plain language - then records what actually happened after deploy, linked to the verdict that judged it. When evidence is missing or stale, ChangeGuard holds rather than assuming safety. Connect your AWS account read-only in minutes: nothing is installed in each cluster for standard Kubernetes evidence, and judgment stays separate from execution authority.