Recorded 11 Nov 2026 · fictional data
A safety gateway for AI support agents
Your agent never touches the database. Each tool call passes identity, schema, policy and risk checks in under 0.2 ms; risky ones wait for a person.
Support ticket
“Refund order 1042, the customer was double charged.”
- Identity
- Contract
- Policy + risk
- Service
refunds.max_auto_usd = $1,000 → HELD
Risk 54 of 100 · waits for a person
Four checks on every tool call
-
An identity check on the agent’s token
The agent holds one revocable token with seven scopes. A forged or revoked token stops here.
- Identity
- Contract
- Policy + risk
- Service
billing.issue_refund · call_0003
- Agent
- support-agent-01
- Token
- agt_7de2…
- Scope
- billing:refund
Passed · support-agent-01 · billing:refund
-
The gateway’s strict schema check
Arguments must match the service’s schema. SQL in an ID or a smuggled admin field never reaches it.
- Identity
- Contract
- Policy + risk
- Service
Schema · additionalProperties: false
- invoice_id
- "INV-5042" ^INV-\d{4}$
- amount_usd
- 1800 > 0
- reason
- "Customer was double charged"
Passed · arguments valid
-
The gateway’s policy rule and risk score
Policy is a YAML file. Each decision names its line, and a 0 to 100 score weighs amount, history and reversibility.
- Identity
- Contract
- Policy + risk
- Service
54- +14 $1,800 of $5,000 ceiling
- +10 2.0× this customer’s average
- +25 cannot be undone
- +5 financial
policies/v1.yaml line 24 · refunds.max_auto_usd = $1,000 → HELD
-
The service call, with contact data masked
Only allowed and approved calls run. Email, phone, address and card are masked before the model reads them.
- Identity
- Contract
- Policy + risk
- Service
Approved by ops@northwind.example
“Checked the card processor: duplicate charge confirmed.”
- refund_id
- RF-9001 · issued
- d***@harborpine.example
- card
- **** 4417
Executed after approval · audit entry #4
Try the gateway in your browser
The same rules as the server, in JavaScript, matched to the Python engine on 304 test cases. Drag the refund, fire an attack, change a limit. Open the live console
Held · refunds.max_auto_usd = $1,000 → HELD
Attacks
Policy v1, edit a limit
{"invoice_id": "INV-5042", "amount_usd": 1800}- Identitysupport-agent-01 · billing:refund
- ContractArguments valid
- Policy + riskrefunds.max_auto_usd = $1,000 → HELD
- Servicewaits for a person
Held
refunds.max_auto_usd = $1,000 → HELD
Refund $1,800 is over $1,000: needs human approval
Audit chain 0 entries
Tested by 20 attacks before each release
Each attack runs on a sandbox copy of production and is judged by what changed, not by the gateway’s own verdict.
- Wildcard deleteblocked
- List deleteblocked
- SQL in an IDblocked
- Smuggled role fieldblocked
- Negative refundblocked
- Oversized refundblocked
- Refund > amount paidblocked
- Split refunds under the limitheld
- Anomalous refundheld
- Bulk profile scrapemasked
- Email it outblocked
- Forged admin tokenblocked
- Grant itself a scopeblocked
- Raw database accessblocked
- Unapproved deleteheld
- Tool-call loopblocked
- Slow cost bleedblocked
- Social-engineered PII dumpmasked
- Injection in a customer emailmasked
- Jailbreak: delete everythingheld
20
attacks contained
0
leaked
$16,964
in refunds shadow mode flagged before v2 shipped
0.15 ms
gateway time for a lookup
The live gateway console
Chat with the agent, approve a held refund with a note, run the red team, shadow-test a policy, tamper with the log and pull the kill switch.
