Agents read OT tools, a person approves writes.
Energy companies use agents for maintenance planning, fault analysis, field reports and regulatory compliance. Some want read access to OT systems. EPDK regulations and critical-infrastructure guides keep the OT network closed. Thulpar runs in front of the OT tool servers as an MCP proxy. Schemas are pinned, write tools are denied by default and read tools are labelled.
tr-public-sector
On-premise or air-gap, Standard tier. The MCP proxy in front of the OT tools.
- EPDK regulations · Energy Market legislation
- Presidential Circular 2019/12 (critical infrastructure)
- NIS2 (EU subsidiaries), the IEC 62443 context
The OT/IT boundary
Sensor data the agent reads must not flow to external tools. Writes must not happen at all.
Watch the runs →The scenarios below are derived from the product’s real rules.
Every scenario is an agent run written to the product’s real rules. It shows the stage, the rails, the decision, the finding, the approval and the ledger entry step by step.
3 scenarios →What comes up in practice
The OT/IT boundary
Sensor data the agent reads must not flow to external tools. Writes must not happen at all.
Tool-server drift
When an MCP server updates, a new tool must not run without authorisation.
Incident evidence
After an incident, what the agent saw, what it proposed and who approved must sit in one chain.
3 scenarios
The player opens on the flagship scenario. Pick the others below.
The agent reads SCADA and proposes maintenance; Cedar denies the set-point write, the proposal goes to the shift lead.
9 GR-*
| id | control | OWASP | rails |
|---|---|---|---|
| GR-TOOL-01 | Tool-call privilege policy (default deny) | LLM06 / ASI02, ASI03 / MCP02 | tool.authz, tool.args |
| GR-TOOL-02 | Durable human approval on high-impact actions, four eyes | LLM06 / ASI02, ASI09 | labels.sink |
| GR-TOOL-03 | Tool schema pinning / diff / quarantine (rug-pull) | LLM03 / ASI04 / MCP03, MCP04 | tool.schema_pin |
| GR-IFC-01 | Information-flow labels (integrity, confidentiality, tenant, PII class) enforced at sensitive sinks | LLM02 / ASI01, ASI03 / MCP10 | labels.sink, pii.detect |
| GR-LOG-01 | Tamper-evident event log (model/tool/policy/approval/hit), ≥ 6 months, auditor export | — / — / MCP08 | |
| GR-INJ-02 | Indirect injection from tool/RAG output: untrusted label, no new tool call without policy | LLM01, LLM08 / ASI01, ASI06 / MCP06, MCP10 | injection.indirect, file.hidden_text |
| GR-MEM-01 | Memory-poisoning policy + provenance | — / ASI06 / MCP10 | memory.write |
| GR-OUT-01 | Output handling: no raw HTML, code sandbox, schema validation | LLM05 / ASI05 / MCP05 | code, schema, regex, secrets, file.analyze, file.type, file.active_content, yara |
| GR-EXF-01 | Tenant egress allowlist; no remote images in chat; no PII in URLs; SSRF | LLM02, LLM05 / ASI02 / MCP06 | exfil, tool.args, file.qr |
See it in your own environment.
A one-hour technical demo: your scenario, your policy pack, on a closed-circuit install. Then the install kit and a trial licence for a pilot.