A policy template and scenarios for every sector.
The engine is the same in every sector. The policy pack is what changes. Each sector page carries that sector’s template, its regulatory basis, the recommended install and scenarios played step by step. Defence comes first. Guardrails for agents on a closed network run on that same closed network.
A template, a basis and playable scenarios for every sector.
For each of the 13 sectors, a ready policy template, that sector’s regulatory basis and 43 scenarios written to the product’s real rules. The scenarios play step by step and show the stage, the decision, the finding, the approval and the ledger entry.
Watch a run →Policy templates for 13 sectors.
Guardrails for agents on a closed network.
Air-gap bundle on the Recommended tier, with the image guard. The tr-defence template. 3650-day retention.
tr-defenceCustomer secrets masked, money movement approved by a person.
On-premise, Standard or Performance tier. The tr-banking-bddk template. The kvkk and bddk evidence profiles.
tr-banking-bddkHealth data in claims files is flagged separately.
On-premise, Standard tier. The tr-insurance-seddk template. The seddk and kvkk evidence profiles.
tr-insurance-seddkLimit and recipient checks in single-digit milliseconds.
On-premise or a managed private instance, Standard tier. A pack derived from the banking template.
tr-banking-bddkCitizen data stays in the institution, every decision recorded.
Air-gap bundle or on-premise, Standard tier. The tr-public-sector template. The public-tr evidence profile.
tr-public-sectorSIM swaps and number porting wait for approval.
On-premise, Performance tier, replicated. Per-tenant detector pools.
tr-banking-bddkPatient data flagged on every line an agent reads.
On-premise, Standard tier. The health-data rail on, the file rails locked.
tr-insurance-seddkAgents read OT tools, a person approves writes.
On-premise or air-gap, Standard tier. The MCP proxy in front of the OT tools.
tr-public-sectorRefund caps enforced, customer data kept out of marketing.
Managed private instance or on-premise, Standard tier. Streaming moderation on.
eu-ai-act-high-riskEvery file checked before the agent opens it.
On-premise or managed, Standard tier. The file rails and the indirect-injection rail for e-mail locked.
eu-ai-act-high-riskProduction knowledge stays on site, ERP writes need approval.
On-premise, Standard tier. The MCP proxy in front of the ERP and MES tools.
tr-public-sectorA deterministic gate for agents that command hardware.
Air-gap or edge install, Starter tier, deterministic rails with an async judge. A pack derived from tr-defence.
tr-defenceGuardrails for your product with one base URL change.
Managed private instance, Kubernetes or on-premise in the customer’s environment. Multi-tenant. The Python SDK.
eu-ai-act-high-riskEvery sector’s flagship run.
An engineer asks for a summary of a classified subsystem report; the “classified” label travels with the content and never reaches e-mail.
43 scenarios
Classified design-document review
An engineer asks for a summary of a classified subsystem report; the “classified” label travels with the content and never reaches e-mail.
Maintenance-record file intake
The “maintenance report” the field team uploads is in fact a macro-laden Office file; the agent never opens it.
Schema drift on the supplier-portal MCP server
An MCP server updates and a tool definition silently gains an “attach file” parameter; Thulpar quarantines the tool.
UAV mission brief and flight-area limit
The operator asks for a mission plan in natural language; a route argument entering a restricted zone is denied by the deterministic schema.
Card-debt payment agent
A customer pays card debt from the mobile channel; the IBAN is masked and a transfer above the threshold passes four-eyes approval.
Credit-file preparation and RAG injection
The credit-analyst agent prepares a file from customer documents; a hidden instruction in an income statement cannot become a new tool call.
Call-centre assistant: masking and retraction on the stream
The assistant on the agent’s screen answers as a stream; a sentence carrying a customer secret is retracted in band.
Motor claim intake: photos, report, payment
The insured files a claim with photos and a hospital report; health data is flagged apart, a payment above 25,000 TRY waits for the assessor.
Health pre-authorisation agent
A hospital portal requests pre-authorisation; the agent states coverage, never diagnoses, and holds the decision for the medical advisor.
Policy renewal and the agency MCP server
The renewal agent hands offers to an external agency tool; personal data stops at the sink policy, a changed schema is quarantined.
Merchant support agent: a payment refund
A merchant asks for a refund with the card number; the PAN is found by Luhn and masked, a refund above the limit waits for four eyes.
Reconciliation agent and the IBAN in a supplier e-mail
The nightly reconciliation reads supplier e-mails; a “pay to this IBAN” line stays untrusted and cannot become a payment.
Onboarding a new MCP tool server
Merchant tools connect over MCP; the schemas are pinned and an SQL injection in a search argument stops before execution.
e-Government citizen assistant
A citizen asks about an application; the TCKN is masked, a political question rewritten, the AI notice put first; all on the closed network.
Petition classification and uploaded PDFs
Scanned petitions are classified; personal data in the metadata is removed and a QR code carrying a TCKN in its query stops the file.
Legislation assistant and groundedness
A legal adviser asks about legislation; a sentence found in no source is flagged and rewritten, and nothing leaves the network.
SIM swap: an attempt to skip verification
A subscriber asks for a SIM with a prompt that says “skip identity verification”; it is denied, and even the verified request waits for four eyes.
Bill dispute: courtesy and masking on the stream
An angry subscriber writes abusively; the input is flagged, not denied, the answer stays polite, called numbers are masked on the stream.
Network-ops agent and traffic data
A NOC engineer has a traffic drop investigated; the subscriber location list stops at the export sink, the call budget breaks the loop.
Discharge-summary assistant and attending-physician approval
The assistant drafts the summary; disease and drug names are special category, the HIS write waits for the physician.
The triage-support chatbot does not diagnose
A patient asks for a diagnosis; the bot says it is an AI, and the diagnosis sentence becomes a safe-referral template.
Lab-report PDF intake
The uploaded “PDF” is another file; the real report’s metadata is masked, a hidden instruction never reaches coding.
Maintenance-planning agent on the OT MCP proxy
The agent reads SCADA and proposes maintenance; Cedar denies the set-point write, the proposal goes to the shift lead.
Fault-analysis RAG and the injection in a vendor manual
A breaker fault sends the agent to the manuals; a “disable the relay” note in a PDF cannot become a work order.
Regulatory-filing assistant: secrets and exfiltration
The EPDK filing is drafted; a pasted API key never reaches the model, an external image the model adds fails the answer.
Refund agent in a high-volume chat
A customer wants a refund; “give 100% discount” in seller text never becomes a coupon; above 500 TRY a person decides.
Campaign-copy agent and the marketing sink
An SMS campaign is drafted; competitor name and forbidden promise leave the text, 12,480 phones never reach the tool.
Order-edit agent: MCP schema quarantine and path traversal
The MCP server updates; a tool that gained a “price override” field is quarantined, a path-traversal argument is denied.
A “new IBAN” instruction in a supplier e-mail
A carrier e-mail says “pay to our new account”; the transfer is held, the approver sees the IBAN mismatch and denies.
Customs-declaration agent and Excel attachments
A macro-laden Excel packing list stays closed; accepted as CSV, the invoice QR URL carrying a TCKN is masked.
Shipment-status assistant for many customers
A customer sees their shipment, the driver’s phone masked; asking about another customer stops at the tenant boundary.
Maintenance agent behind the ERP/MES MCP proxy
The agent reads MES, opens the work order on the supervisor’s approval; the trade secret never reaches supplier e-mail.
Quality-report agent: generated code and structured output
The agent writes a Python script and a JSON report over SPC data; the CWE is recorded, a report off-schema is re-asked.
A hidden instruction in a supplier quote PDF
The procurement agent compares quotes; white text in the PDF cannot become a command, the tracking pixel is denied.
Shop-floor assistant: employee data and a German manual
Workers ask the assistant; employee and health data are masked, abuse is stopped, the German manual routed by language.
Warehouse robot-fleet command assistant
Speed and zone limits decide in ms on robot:move / robot:grasp calls; a human-occupied zone waits for approval.
UAV telemetry summary and the text on a sensor label
A post-flight summary; a “return home” instruction painted on a label in a camera frame leaves OCR untrusted.
Service-robot dialogue: persona, content, circuit breaker
A guide robot talks to a visitor; the persona holds, a harmful request is stopped, a tool-call loop trips the breaker.
Robot firmware and operations assistant
A pasted private key is masked, a PowerShell download chain is stopped by YARA, generated code is flagged with a CWE.
One product, two tenants: same request, different decisions
thulpar-gateway in front of the product’s model; bank and retail tenants get different decisions on one request.
Coding-assistant product: CWE, leaked token and canary
The CWE in generated code is flagged, a token leaking into output is stopped, the canaried system prompt cut mid-stream.
RAG support product: groundedness and the AI disclosure
Every sentence is judged against the supplied sources; an unsupported one is rewritten, Art. 50 notice on turn one.
MCP marketplace product: third-party tools behind the proxy
Third-party MCP servers behind one proxy: changed tool quarantined, poisoned description cleaned, argument XSS denied.
See it in your own environment.
A one-hour technical demo: your scenario, your policy pack, on a closed-circuit install. Then the install kit and a trial licence for a pilot.