Every file checked before the agent opens it.
In logistics, agents prepare customs declarations, plan routes, answer shipment status and process supplier e-mail. Documents arrive as PDF and Excel. E-mail is the most frequent source of indirect injection. Thulpar’s file analyzer reads the type from the bytes and denies macros and hidden text. E-mail content is labelled untrusted and cannot become a tool call without policy.
eu-ai-act-high-risk
On-premise or managed, Standard tier. The file rails and the indirect-injection rail for e-mail locked.
- Customs Law 4458 · Single Window
- KVKK 6698 · GDPR (EU flows)
- EU AI Act Art. 50 transparency
Document safety
Macro-laden Excel and PDFs with hidden text make every file the agent reads an attack surface.
Watch the runs →The scenarios below are derived from the product’s real rules.
Every scenario is an agent run written to the product’s real rules. It shows the stage, the rails, the decision, the finding, the approval and the ledger entry step by step.
3 scenarios →What comes up in practice
Document safety
Macro-laden Excel and PDFs with hidden text make every file the agent reads an attack surface.
Injection by e-mail
A “pay to this account” line in a supplier e-mail must not become a tool call.
Multi-party data
Customer, carrier and customs data pass through one agent. Tenant isolation is mandatory.
3 scenarios
The player opens on the flagship scenario. Pick the others below.
A carrier e-mail says “pay to our new account”; the transfer is held, the approver sees the IBAN mismatch and denies.
9 GR-*
| id | control | OWASP | rails |
|---|---|---|---|
| GR-INJ-02 | Indirect injection from tool/RAG output: untrusted label, no new tool call without policy | LLM01, LLM08 / ASI01, ASI06 / MCP06, MCP10 | injection.indirect, file.hidden_text |
| GR-IFC-01 | Information-flow labels (integrity, confidentiality, tenant, PII class) enforced at sensitive sinks | LLM02 / ASI01, ASI03 / MCP10 | labels.sink, pii.detect |
| GR-TOOL-02 | Durable human approval on high-impact actions, four eyes | LLM06 / ASI02, ASI09 | labels.sink |
| GR-PII-01 | PII and special-category detection + masking (TCKN, IBAN, phone, health) on input/tool/output/log | LLM02 / — / MCP10 | pii.detect, pii.redact, file.metadata_pii |
| GR-LOG-01 | Tamper-evident event log (model/tool/policy/approval/hit), ≥ 6 months, auditor export | — / — / MCP08 | |
| GR-OUT-01 | Output handling: no raw HTML, code sandbox, schema validation | LLM05 / ASI05 / MCP05 | code, schema, regex, secrets, file.analyze, file.type, file.active_content, yara |
| GR-EXF-01 | Tenant egress allowlist; no remote images in chat; no PII in URLs; SSRF | LLM02, LLM05 / ASI02 / MCP06 | exfil, tool.args, file.qr |
| GR-TEN-01 | Tenant isolation across retrieval, credentials, memory, logs + canary tests | LLM08, LLM02 / ASI03, ASI06 / MCP10 | |
| GR-TOOL-01 | Tool-call privilege policy (default deny) | LLM06 / ASI02, ASI03 / MCP02 | tool.authz, tool.args |
See it in your own environment.
A one-hour technical demo: your scenario, your policy pack, on a closed-circuit install. Then the install kit and a trial licence for a pilot.