The security and guardrails layer for AI agents

A decision point for every step your agents take.

Every request, tool call and response is evaluated against a policy pack and recorded. Actions above the threshold are referred to a person. It runs on your own network.

Request a demo → Explore the product

The layers · every request crosses three layers; the deciding layer lights up0 allow0 redact0 hold0 deny

Illustrative simulation; durations are the D7 design budgets.runs in your browser, nothing leaves

Works with

OpenAI-compatible APIMCPvLLMKubernetesOIDC · SPIFFEAginies

0outbound connections at run time

29detectors, one API contract

13sectors with policy templates

26controls, 7 evidence profiles

Human approval

Actions above the threshold are referred to a person.

Moving money, deleting records or sending data out lands in the approval inbox. Two signatures, a time limit and escalation are written in the policy pack. On approval the run resumes where it paused.

See the approval flow →

Evidence

Every decision is written to a verifiable chain.

Each record holds the policy version, detector versions, findings and latency. The chain is anchored daily. Signed evidence packs are produced for the auditor in seven regulator profiles and verified offline.

See the evidence packs →

Policy

The decision comes from the policy pack.

Which rail runs at which stage and in which mode is defined in a signed pack. It is observed in shadow mode and promoted to enforce when ready. Packs are layered at the organisation, tenant and application levels.

See the policy packs →

Closed circuit

No outbound connection at run time.

There is no telemetry, licence server or remote generation. The licence is a signed file verified inside the installation. An air-gap bundle for defence and government, in-country installation for banks.

Trust page →

Integration

One address and one key change in the application.

OpenAI-compatible gateway

Sits in front of the model; input before the first byte, output sentence by sentence.

MCP proxy

Sits in front of tool servers; schemas pinned, arguments checked.

Check API

Called from inside the application at every stage; Python and TypeScript SDKs.

With Aginies

Platform adapters call it from the executor hooks; approvals land on the Platform card.

Live run

Every stage of an agent run is evaluated.

Pick a sector, follow the steps, approve a held action. The chain is computed in your browser.

Classified design-document review · Engineering knowledge assistant (closed network)gatewaytr-defenceonerilen

Decision trailDesign Assistant · qwen3-32b · vLLM · on-site

01inputuser

“Summarise the SS-7 power distribution subsystem test report and list the risks.”

02retrievalretrieval

docs:search returns 4 chunks; two carry a “CLASSIFIED” marking.

03output_chunkmodel

The stream starts; every sentence passes content safety and the exfiltration rail.

04tool_callagent

The agent calls mail:send: it wants to e-mail the summary to the supplier’s engineer.

05tool_callagent

The agent opens an internal tracking ticket with tickets:create; the arguments fit the schema.

06outputmodel

The full answer: six risks, cited to the source chunks; groundedness on every sentence.

07memory_writeagent

The agent wants to write the conversation summary to long-term memory.

Thulpar · Rails

An engineer asks for a summary of a classified subsystem report; the “classified” label travels with the content and never reaches e-mail.

docs:searchdocs:readmail:sendtickets:create

Controls: GR-IFC-01 · GR-EXF-01 · GR-MEM-01 · GR-INJ-02 · GR-LOG-01

Evidence ledger0000…0000

Simulation · runs in your browser · no request leaves the pageadded latency: 0 ms · 7 steps · SHA-256 chain

Industries

Policy templates for thirteen sectors.

Defence Guardrails for agents on a closed network. 4 scenariostr-defence Banking Customer secrets masked, money movement approved by a person. 3 scenariostr-banking-bddk Insurance Health data in claims files is flagged separately. 3 scenariostr-insurance-seddk Fintech & Payments Limit and recipient checks in single-digit milliseconds. 3 scenariostr-banking-bddk Public Sector Citizen data stays in the institution, every decision recorded. 3 scenariostr-public-sector Telecom SIM swaps and number porting wait for approval. 3 scenariostr-banking-bddk Healthcare Patient data flagged on every line an agent reads. 3 scenariostr-insurance-seddk Energy & Critical Infrastructure Agents read OT tools, a person approves writes. 3 scenariostr-public-sector E-commerce & Retail Refund caps enforced, customer data kept out of marketing. 3 scenarioseu-ai-act-high-risk Logistics Every file checked before the agent opens it. 3 scenarioseu-ai-act-high-risk Manufacturing & Automotive Production knowledge stays on site, ERP writes need approval. 4 scenariostr-public-sector Robotics & Autonomous Systems A deterministic gate for agents that command hardware. 4 scenariostr-defence Software & AI Products Guardrails for your product with one base URL change. 4 scenarioseu-ai-act-high-risk All sectors43 scenarios→

Resources

See it with your own scenario.

A one-hour technical demo: your use case, your sector’s policy template and a closed-circuit installation. Then the install kit and a trial licence for a pilot.

Request a demo → Read the docs info@thulpar.com