Guardrails for agents on a closed network.
In defence, language models summarise design documents, search procurement and maintenance records and interpret test data. Each of these tasks touches classified information. No request may leave the facility. Law 5202 and Circular 2019/12 require records for the life of the programme. Thulpar installs as an air-gap bundle, with the models in a signed tar. The defence template denies every egress, stops classified-labelled content at every sink and writes each decision to a ledger retained for ten years.
tr-defence
Air-gap bundle on the Recommended tier, with the image guard. The tr-defence template. 3650-day retention.
- Defence Industry Security Law 5202 and its Regulation
- Presidential Circular 2019/12 · Information and Communication Security Guide
- KVKK 6698 Art. 12 (personnel data)
- NATO / allied programme security instructions
Tools that need the internet
Most guardrail products call a cloud service or a licence server. They do not run on the facility network.
Watch the runs →The scenarios below are derived from the product’s real rules.
Every scenario is an agent run written to the product’s real rules. It shows the stage, the rails, the decision, the finding, the approval and the ledger entry step by step.
4 scenarios →What comes up in practice
Tools that need the internet
Most guardrail products call a cloud service or a licence server. They do not run on the facility network.
Classification levels
A classified document an agent reads must not reach an e-mail or an external tool. The label has to travel with the content.
The evidence duty
Law 5202 and Circular 2019/12 require records for the life of the programme. Plain logs do not meet that duty. A hash-chained ledger does.
4 scenarios
The player opens on the flagship scenario. Pick the others below.
An engineer asks for a summary of a classified subsystem report; the “classified” label travels with the content and never reaches e-mail.
12 GR-*
| id | control | OWASP | rails |
|---|---|---|---|
| GR-IFC-01 | Information-flow labels (integrity, confidentiality, tenant, PII class) enforced at sensitive sinks | LLM02 / ASI01, ASI03 / MCP10 | labels.sink, pii.detect |
| GR-EXF-01 | Tenant egress allowlist; no remote images in chat; no PII in URLs; SSRF | LLM02, LLM05 / ASI02 / MCP06 | exfil, tool.args, file.qr |
| GR-MEM-01 | Memory-poisoning policy + provenance | — / ASI06 / MCP10 | memory.write |
| GR-INJ-02 | Indirect injection from tool/RAG output: untrusted label, no new tool call without policy | LLM01, LLM08 / ASI01, ASI06 / MCP06, MCP10 | injection.indirect, file.hidden_text |
| GR-LOG-01 | Tamper-evident event log (model/tool/policy/approval/hit), ≥ 6 months, auditor export | — / — / MCP08 | |
| GR-OUT-01 | Output handling: no raw HTML, code sandbox, schema validation | LLM05 / ASI05 / MCP05 | code, schema, regex, secrets, file.analyze, file.type, file.active_content, yara |
| GR-TOOL-02 | Durable human approval on high-impact actions, four eyes | LLM06 / ASI02, ASI09 | labels.sink |
| GR-PII-01 | PII and special-category detection + masking (TCKN, IBAN, phone, health) on input/tool/output/log | LLM02 / — / MCP10 | pii.detect, pii.redact, file.metadata_pii |
| GR-TOOL-03 | Tool schema pinning / diff / quarantine (rug-pull) | LLM03 / ASI04 / MCP03, MCP04 | tool.schema_pin |
| GR-TOOL-04 | Tool description hygiene | LLM03 / ASI04 / MCP03 | |
| GR-TOOL-01 | Tool-call privilege policy (default deny) | LLM06 / ASI02, ASI03 / MCP02 | tool.authz, tool.args |
| GR-RES-01 | Per-run rate/cost/loop limits, circuit breaker | LLM10 / ASI08 | budget |
See it in your own environment.
A one-hour technical demo: your scenario, your policy pack, on a closed-circuit install. Then the install kit and a trial licence for a pilot.