Guardrails for your product with one base URL change.
Software and AI product companies have to offer their enterprise customers a guardrail, evidence and approval layer. Few want to write one from scratch. Thulpar runs in front of the model as an OpenAI-compatible gateway, in front of tool servers as an MCP proxy, and is called from inside the application through the check API. It is multi-tenant. Every customer gets its own policy pack, ledger and evidence pack. The only things that change in the code are the base URL and an API key.
eu-ai-act-high-risk
Managed private instance, Kubernetes or on-premise in the customer’s environment. Multi-tenant. The Python SDK.
- EU AI Act Art. 50, Annex III (provider obligations)
- ISO/IEC 42001 · SOC 2 evidence requirements
- KVKK / GDPR (as processor)
Policy per customer
A bank customer and a retail customer want different rules. Policy inheritance is needed.
Watch the runs →The scenarios below are derived from the product’s real rules.
Every scenario is an agent run written to the product’s real rules. It shows the stage, the rails, the decision, the finding, the approval and the ledger entry step by step.
4 scenarios →What comes up in practice
Policy per customer
A bank customer and a retail customer want different rules. Policy inheritance is needed.
Evidence as a sales blocker
Enterprise buyers ask for an audit trail and evidence packs. The product ends up carrying them alone.
Closed-circuit demands
Some customers want the product in their own data centre. The guardrail has to come along.
4 scenarios
The player opens on the flagship scenario. Pick the others below.
thulpar-gateway in front of the product’s model; bank and retail tenants get different decisions on one request.
17 GR-*
| id | control | OWASP | rails |
|---|---|---|---|
| GR-TEN-01 | Tenant isolation across retrieval, credentials, memory, logs + canary tests | LLM08, LLM02 / ASI03, ASI06 / MCP10 | |
| GR-TOOL-02 | Durable human approval on high-impact actions, four eyes | LLM06 / ASI02, ASI09 | labels.sink |
| GR-IFC-01 | Information-flow labels (integrity, confidentiality, tenant, PII class) enforced at sensitive sinks | LLM02 / ASI01, ASI03 / MCP10 | labels.sink, pii.detect |
| GR-PII-01 | PII and special-category detection + masking (TCKN, IBAN, phone, health) on input/tool/output/log | LLM02 / — / MCP10 | pii.detect, pii.redact, file.metadata_pii |
| GR-GOV-01 | Versioned, signed policy packs; ISO 42001 / Annex IV / BDDK / DORA evidence export | — | |
| GR-OUT-01 | Output handling: no raw HTML, code sandbox, schema validation | LLM05 / ASI05 / MCP05 | code, schema, regex, secrets, file.analyze, file.type, file.active_content, yara |
| GR-SYS-01 | System-prompt leak + canary | LLM07 / ASI01 | system_prompt.leak |
| GR-INJ-01 | Direct injection and jailbreak at the gate (TR+EN) | LLM01 / ASI01 / MCP06 | injection.direct, jailbreak |
| GR-TOOL-05 | SQL / command / path traversal / RFI / XSS injection in tool arguments (libinjection + OWASP CRS) | LLM05 / ASI02, ASI05 / MCP05 | tool.args.injection |
| GR-LOG-01 | Tamper-evident event log (model/tool/policy/approval/hit), ≥ 6 months, auditor export | — / — / MCP08 | |
| GR-TRANS-01 | AI disclosure: chat + voice | — / ASI09 | conversation |
| GR-CONT-01 | Content-harm policy (AILuminate 12 + TR) with tenant thresholds | LLM09 / ASI09 | content.input, content.output, toxicity, topic, groundedness, language, image.content_safety, banlist, competitors |
| GR-TOOL-01 | Tool-call privilege policy (default deny) | LLM06 / ASI02, ASI03 / MCP02 | tool.authz, tool.args |
| GR-TOOL-03 | Tool schema pinning / diff / quarantine (rug-pull) | LLM03 / ASI04 / MCP03, MCP04 | tool.schema_pin |
| GR-TOOL-04 | Tool description hygiene | LLM03 / ASI04 / MCP03 | |
| GR-RES-01 | Per-run rate/cost/loop limits, circuit breaker | LLM10 / ASI08 | budget |
| GR-INJ-02 | Indirect injection from tool/RAG output: untrusted label, no new tool call without policy | LLM01, LLM08 / ASI01, ASI06 / MCP06, MCP10 | injection.indirect, file.hidden_text |
See it in your own environment.
A one-hour technical demo: your scenario, your policy pack, on a closed-circuit install. Then the install kit and a trial licence for a pilot.