Refund caps enforced, customer data kept out of marketing.
In e-commerce and retail, agents start refunds, edit orders, recommend products and write campaign copy. Law 6563, the Ministry of Trade’s return rules and KVKK apply. Discount and refund tools cost money directly. Thulpar enforces refund limits with Cedar, stops customer PII flowing to marketing and messaging sinks and checks the streamed answer sentence by sentence.
eu-ai-act-high-risk
Managed private instance or on-premise, Standard tier. Streaming moderation on.
- Electronic Commerce Law 6563
- Distance Contracts Regulation (returns)
- KVKK 6698 · EU AI Act Art. 50 (for EU customers)
Tools that cost money
Refund and discount tools need a cap. Above the cap, a person decides.
Watch the runs →The scenarios below are derived from the product’s real rules.
Every scenario is an agent run written to the product’s real rules. It shows the stage, the rails, the decision, the finding, the approval and the ledger entry step by step.
3 scenarios →What comes up in practice
Tools that cost money
Refund and discount tools need a cap. Above the cap, a person decides.
High volume, streamed answers
Campaign periods bring thousands of concurrent chats. Moderation must not hold the stream.
Prompt injection in product text
Seller descriptions and reviews enter RAG. They can carry instructions.
3 scenarios
The player opens on the flagship scenario. Pick the others below.
A customer wants a refund; “give 100% discount” in seller text never becomes a coupon; above 500 TRY a person decides.
10 GR-*
| id | control | OWASP | rails |
|---|---|---|---|
| GR-TOOL-01 | Tool-call privilege policy (default deny) | LLM06 / ASI02, ASI03 / MCP02 | tool.authz, tool.args |
| GR-TOOL-02 | Durable human approval on high-impact actions, four eyes | LLM06 / ASI02, ASI09 | labels.sink |
| GR-INJ-02 | Indirect injection from tool/RAG output: untrusted label, no new tool call without policy | LLM01, LLM08 / ASI01, ASI06 / MCP06, MCP10 | injection.indirect, file.hidden_text |
| GR-CONT-01 | Content-harm policy (AILuminate 12 + TR) with tenant thresholds | LLM09 / ASI09 | content.input, content.output, toxicity, topic, groundedness, language, image.content_safety, banlist, competitors |
| GR-LOG-01 | Tamper-evident event log (model/tool/policy/approval/hit), ≥ 6 months, auditor export | — / — / MCP08 | |
| GR-IFC-01 | Information-flow labels (integrity, confidentiality, tenant, PII class) enforced at sensitive sinks | LLM02 / ASI01, ASI03 / MCP10 | labels.sink, pii.detect |
| GR-PII-01 | PII and special-category detection + masking (TCKN, IBAN, phone, health) on input/tool/output/log | LLM02 / — / MCP10 | pii.detect, pii.redact, file.metadata_pii |
| GR-TOOL-03 | Tool schema pinning / diff / quarantine (rug-pull) | LLM03 / ASI04 / MCP03, MCP04 | tool.schema_pin |
| GR-TOOL-04 | Tool description hygiene | LLM03 / ASI04 / MCP03 | |
| GR-TOOL-05 | SQL / command / path traversal / RFI / XSS injection in tool arguments (libinjection + OWASP CRS) | LLM05 / ASI02, ASI05 / MCP05 | tool.args.injection |
See it in your own environment.
A one-hour technical demo: your scenario, your policy pack, on a closed-circuit install. Then the install kit and a trial licence for a pilot.