The guardrail market splits into six categories. Each does one job well. None offers the following six together. Closed-circuit operation, human approval on tool calls, information-flow enforcement at the sink, MCP server pinning, Turkish evaluation and regulator-grade evidence. Thulpar combines the six in one product. The table below describes category behaviour as read in public documentation. It is not a benchmark claim. The version with product names is in the access-coded docs.
Closed-circuit operation, human approval on tool calls, information-flow enforcement at the sink, MCP server pinning, Turkish evaluation and regulator-grade evidence. Thulpar combines the six in one product. The table describes category behaviour as read in public documentation; it is not a benchmark claim.
The capability matrix →The horizontal axis shows closed-circuit depth: air-gap, offline licence, CPU tier, install product. The vertical axis shows agent-security depth: tool authorisation, approval, labels, MCP, memory. The placement is a qualitative reading.
Trust page →Open-source frameworks a developer adds to the application as a library. Rails are defined in code or a DSL. The detectors are self-hosted.
An experienced engineering team, one application, low policy and evidence requirements.
No multi-tenant policy, signed versions, approval inbox, regulator-grade ledger or install product. Accountability stays with the enterprise.
Classifier APIs that send every request to the vendor’s cloud. Some offer a self-hosted GPU option.
Cloud applications, sectors without a data-residency requirement, a quick start.
Prompts and answers leave the perimeter. There is no closed-circuit mode. The tool-call and approval layer is thin.
Security vendors that offer model inventory, discovery, posture management and runtime protection. Usually cloud-managed and tied to the vendor’s own network and endpoint ecosystem.
Large enterprises already on the vendor’s security stack, in cloud and hybrid environments.
Air-gapped installs and offline licensing are the exception. There is no Turkish evaluation. Evidence stays in the vendor’s console.
Guardrail services embedded in a cloud provider’s own model services.
Workloads that stay in that cloud and use that provider’s models.
Cloud only and tied to its own ecosystem. On-premise models and MCP servers are out of scope.
Gateways that route model traffic, cache responses and manage cost and keys. Guardrail plugins are mostly calls to third-party APIs.
Multi-provider model access, cost and quota management.
No decision engine, policy packs, approval flow or evidence ledger. Detectors are external.
Classifier models published by vendors. A model on its own is not a product. Thulpar runs many of them as replaceable detectors.
A building block for teams assembling their own pipeline.
Serving, policy, decision, approval, evidence, install and Turkish evaluation remain the team’s own work.
It is not a benchmark claim. The version with product names is in the access-coded docs.
| Capability | Thulpar | Open-source guardrail frameworks | Cloud guardrail APIs | AI security platforms | Hyperscaler natives | LLM gateways | Guard models |
|---|---|---|---|---|---|---|---|
| Deployment | |||||||
| Closed circuit: air-gap without callbacks, no telemetry or licence ping D3: zero runtime egress; signed model bundle; offline licence file; a no-egress gate in CI | ● | ● | ◐ | ◐ | ○ | ◐ | ● |
| A production tier without a GPU (CPU) Starter: ONNX int8 + llama.cpp; 8 vCPU / 16 GB | ● | ◐ | ○ | – | ○ | ○ | ◐ |
| An install product: kit, air-gap bundle, Helm, upgrade, backup, rollback thulpar install | upgrade | backup | restore | rollback; Helm chart | ● | ○ | ○ | ◐ | ○ | ◐ | ○ |
| Gateway, check API and platform-embedded on one policy and ledger | ● | ○ | ○ | ◐ | ◐ | ◐ | ○ |
| Agent security | |||||||
| Human approval on tool calls: hold, four-eyes, SLA, escalation; the run resumes on approval Cedar @advice("hold:<profile>"), approval inbox, webhooks | ● | ○ | ○ | ◐ | ○ | ○ | ○ |
| Tool authorisation policy (Cedar), argument schemas, SSRF, argument injection | ● | ◐ | ○ | ◐ | ◐ | ◐ | ○ |
| MCP proxy: schema pinning, diff, quarantine, description hygiene, OAuth resource server | ● | ○ | ◐ | ◐ | ◐ | ◐ | ○ |
| Information-flow labels enforced at sensitive sinks (egress, messaging, export, write) The CaMeL/FIDES mechanism without the dual-LLM cost | ● | ○ | ○ | ○ | ○ | ○ | ○ |
| Memory-write policy and provenance; workload identity (SPIFFE) | ● | ○ | ○ | ◐ | ○ | ○ | ○ |
| Detectors | |||||||
| Turkish-evaluated detectors; an eval set and report per language 11,000+ rows of Turkish eval; the CPU bake-off report published | ● | ○ | ○ | ○ | ○ | ○ | ◐ |
| Replaceable detectors (HTTP Detector API); no mandatory vendor model | ● | ● | ○ | ◐ | ○ | ◐ | ● |
| Files, images, YARA, code and health data at the same decision point | ● | ○ | ◐ | ◐ | ◐ | ○ | ◐ |
| Policy and evidence | |||||||
| Tenant policy packs, inheritance, signed versions, sector templates BDDK banking, SEDDK insurance, public sector, defence, EU AI Act high risk | ● | ◐ | ○ | ◐ | ◐ | ○ | ○ |
| A hash-chained, regulator-grade decision ledger; signed evidence packs SHA-256 chain, daily anchors, 7 profiles (KVKK, BDDK, SEDDK, public, EU AI Act, ISO 42001, DORA), offline verification | ● | ○ | ○ | ◐ | ○ | ○ | ○ |
| Red team in CI; a failing benchmark blocks policy activation | ● | ◐ | ◐ | ◐ | ○ | ○ | ○ |
| Runtime | |||||||
| Streaming sentence-level moderation with in-band retraction | ● | ● | – | ◐ | ◐ | ◐ | ○ |
| Security rails fail closed, quality rails fail open; a skipped rail is always a ledger event | ● | ◐ | – | – | – | ○ | ○ |
The matrix and positioning with product names, in the access-coded docs →
The horizontal axis shows closed-circuit depth (air-gap, offline licence, CPU tier, install product). The vertical axis shows agent-security depth (tool authorisation, approval, labels, MCP, memory). The placement is a qualitative reading.
The matrix and positioning with product names, in the access-coded docs →
A one-hour technical demo: your scenario, your policy pack, on a closed-circuit install. Then the install kit and a trial licence for a pilot.