A deterministic gate for agents that command hardware.
In robotics, UAVs and autonomous systems, language models plan missions, interpret operator commands and summarise telemetry. Here a tool call is a physical action. It may be a motion, a grasp or a change of flight path. Thulpar keeps the tool rails deterministic. Cedar authorisation and the argument schema decide within milliseconds. An unsafe command is denied, speed and area limits are checked as facets, and an action that needs operator approval becomes a hold. The model judge runs only asynchronously.
tr-defence
Air-gap or edge install, Starter tier, deterministic rails with an async judge. A pack derived from tr-defence.
- SHGM UAV Instruction · defence programme security rules
- ISO 10218 / ISO 13482 (robot safety) context
- EU AI Act Annex III (high risk)
The real-time boundary
A motion command cannot wait for an LLM judge. The gate has to be deterministic.
Watch the runs →The scenarios below are derived from the product’s real rules.
Every scenario is an agent run written to the product’s real rules. It shows the stage, the rails, the decision, the finding, the approval and the ledger entry step by step.
4 scenarios →What comes up in practice
The real-time boundary
A motion command cannot wait for an LLM judge. The gate has to be deterministic.
Command injection
Text on a sensor label or in a mission brief must not be read as a new command.
Black-box recording
After an incident, the chain of what the agent saw, proposed and did has to be immutable.
4 scenarios
The player opens on the flagship scenario. Pick the others below.
Speed and zone limits decide in ms on robot:move / robot:grasp calls; a human-occupied zone waits for approval.
11 GR-*
| id | control | OWASP | rails |
|---|---|---|---|
| GR-TOOL-01 | Tool-call privilege policy (default deny) | LLM06 / ASI02, ASI03 / MCP02 | tool.authz, tool.args |
| GR-TOOL-02 | Durable human approval on high-impact actions, four eyes | LLM06 / ASI02, ASI09 | labels.sink |
| GR-TOOL-03 | Tool schema pinning / diff / quarantine (rug-pull) | LLM03 / ASI04 / MCP03, MCP04 | tool.schema_pin |
| GR-RES-01 | Per-run rate/cost/loop limits, circuit breaker | LLM10 / ASI08 | budget |
| GR-LOG-01 | Tamper-evident event log (model/tool/policy/approval/hit), ≥ 6 months, auditor export | — / — / MCP08 | |
| GR-INJ-02 | Indirect injection from tool/RAG output: untrusted label, no new tool call without policy | LLM01, LLM08 / ASI01, ASI06 / MCP06, MCP10 | injection.indirect, file.hidden_text |
| GR-IFC-01 | Information-flow labels (integrity, confidentiality, tenant, PII class) enforced at sensitive sinks | LLM02 / ASI01, ASI03 / MCP10 | labels.sink, pii.detect |
| GR-OUT-01 | Output handling: no raw HTML, code sandbox, schema validation | LLM05 / ASI05 / MCP05 | code, schema, regex, secrets, file.analyze, file.type, file.active_content, yara |
| GR-INJ-01 | Direct injection and jailbreak at the gate (TR+EN) | LLM01 / ASI01 / MCP06 | injection.direct, jailbreak |
| GR-CONT-01 | Content-harm policy (AILuminate 12 + TR) with tenant thresholds | LLM09 / ASI09 | content.input, content.output, toxicity, topic, groundedness, language, image.content_safety, banlist, competitors |
| GR-TOOL-05 | SQL / command / path traversal / RFI / XSS injection in tool arguments (libinjection + OWASP CRS) | LLM05 / ASI02, ASI05 / MCP05 | tool.args.injection |
See it in your own environment.
A one-hour technical demo: your scenario, your policy pack, on a closed-circuit install. Then the install kit and a trial licence for a pilot.