Production knowledge stays on site, ERP writes need approval.
In manufacturing and automotive, agents search maintenance instructions, write quality reports, open work orders in ERP and correspond with suppliers. Product design and process knowledge are trade secrets. A write to ERP costs money. Thulpar groups ERP and MES tools with Cedar, binds write tools to the shift supervisor’s approval and keeps trade-secret-labelled content out of supplier e-mail.
tr-public-sector
On-premise, Standard tier. The MCP proxy in front of the ERP and MES tools.
- Industrial Property Law 6769 (trade secrets)
- IATF 16949 / ISO 9001 record requirements
- KVKK 6698 (employee data)
Trade-secret leakage
Knowledge taken from a design document must not reach an external supplier.
Watch the runs →The scenarios below are derived from the product’s real rules.
Every scenario is an agent run written to the product’s real rules. It shows the stage, the rails, the decision, the finding, the approval and the ledger entry step by step.
4 scenarios →What comes up in practice
Trade-secret leakage
Knowledge taken from a design document must not reach an external supplier.
ERP writes
Work orders and purchase requests are writes that a person approves.
Quality records
IATF 16949 and customer audits require immutable records.
4 scenarios
The player opens on the flagship scenario. Pick the others below.
The agent reads MES, opens the work order on the supervisor’s approval; the trade secret never reaches supplier e-mail.
11 GR-*
| id | control | OWASP | rails |
|---|---|---|---|
| GR-TOOL-01 | Tool-call privilege policy (default deny) | LLM06 / ASI02, ASI03 / MCP02 | tool.authz, tool.args |
| GR-TOOL-02 | Durable human approval on high-impact actions, four eyes | LLM06 / ASI02, ASI09 | labels.sink |
| GR-IFC-01 | Information-flow labels (integrity, confidentiality, tenant, PII class) enforced at sensitive sinks | LLM02 / ASI01, ASI03 / MCP10 | labels.sink, pii.detect |
| GR-TOOL-03 | Tool schema pinning / diff / quarantine (rug-pull) | LLM03 / ASI04 / MCP03, MCP04 | tool.schema_pin |
| GR-LOG-01 | Tamper-evident event log (model/tool/policy/approval/hit), ≥ 6 months, auditor export | — / — / MCP08 | |
| GR-OUT-01 | Output handling: no raw HTML, code sandbox, schema validation | LLM05 / ASI05 / MCP05 | code, schema, regex, secrets, file.analyze, file.type, file.active_content, yara |
| GR-PII-01 | PII and special-category detection + masking (TCKN, IBAN, phone, health) on input/tool/output/log | LLM02 / — / MCP10 | pii.detect, pii.redact, file.metadata_pii |
| GR-EXEC-01 | Isolated sandbox for code/MCP (gVisor/Kata; Wasm plugin) | — / ASI05 / MCP05, MCP09 | code |
| GR-INJ-02 | Indirect injection from tool/RAG output: untrusted label, no new tool call without policy | LLM01, LLM08 / ASI01, ASI06 / MCP06, MCP10 | injection.indirect, file.hidden_text |
| GR-EXF-01 | Tenant egress allowlist; no remote images in chat; no PII in URLs; SSRF | LLM02, LLM05 / ASI02 / MCP06 | exfil, tool.args, file.qr |
| GR-CONT-01 | Content-harm policy (AILuminate 12 + TR) with tenant thresholds | LLM09 / ASI09 | content.input, content.output, toxicity, topic, groundedness, language, image.content_safety, banlist, competitors |
See it in your own environment.
A one-hour technical demo: your scenario, your policy pack, on a closed-circuit install. Then the install kit and a trial licence for a pilot.