Recorded 11 Nov 2026 · fictional data
A safety gateway for AI support agents
Your agent never touches the database. Each tool call passes identity, schema, policy and risk checks in under 0.2 ms; risky ones wait for a person.
Support ticket
“Refund order 1042, the customer was double charged.”
- Identity
- Contract
- Policy + risk
- Service
refunds.max_auto_usd = $1,000 → HELD
Risk 54 of 100 · waits for a person
Four checks on every tool call
-
An identity check on the agent’s token
The agent holds one revocable token with seven scopes. A forged or revoked token stops here.
- Identity
- Contract
- Policy + risk
- Service
billing.issue_refund · call_0003
- Agent
- support-agent-01
- Token
- agt_7de2…
- Scope
- billing:refund
Passed · support-agent-01 · billing:refund
-
The gateway’s strict schema check
Arguments must match the service’s schema. SQL in an ID or a smuggled admin field never reaches it.
- Identity
- Contract
- Policy + risk
- Service
Schema · additionalProperties: false
- invoice_id
- "INV-5042" ^INV-\d{4}$
- amount_usd
- 1800 > 0
- reason
- "Customer was double charged"
Passed · arguments valid
-
The gateway’s policy rule and risk score
Policy is a YAML file. Each decision names its line, and a 0 to 100 score weighs amount, history and reversibility.
- Identity
- Contract
- Policy + risk
- Service
54- +14 $1,800 of $5,000 ceiling
- +10 2.0× this customer’s average
- +25 cannot be undone
- +5 financial
policies/v1.yaml line 24 · refunds.max_auto_usd = $1,000 → HELD
-
The service call, with contact data masked
Only allowed and approved calls run. Email, phone, address and card are masked before the model reads them.
- Identity
- Contract
- Policy + risk
- Service
Approved by ops@northwindsupply.co
“Checked the card processor: duplicate charge confirmed.”
- refund_id
- RF-9001 · issued
- d***@harborpine.example
- card
- **** 4417
Executed after approval · audit entry #4
Try the gateway in your browser
The same rules as the server, in JavaScript, matched to the Python engine on 304 parity test cases (46 unit tests besides). Drag the refund, fire an attack, change a limit. Open the live console
Held · refunds.max_auto_usd = $1,000 → HELD
Attacks
Policy v1, edit a limit
{"invoice_id": "INV-5042", "amount_usd": 1800}- Identitysupport-agent-01 · billing:refund
- ContractArguments valid
- Policy + riskrefunds.max_auto_usd = $1,000 → HELD
- Servicewaits for a person
Held
refunds.max_auto_usd = $1,000 → HELD
Refund $1,800 is over $1,000: needs human approval
Audit chain 0 entries
Tested by 20 attacks before each release
Each attack runs on a sandbox copy of production and is judged by what changed, not by the gateway’s own verdict.
- Wildcard deleteblocked
- List deleteblocked
- SQL in an IDblocked
- Smuggled role fieldblocked
- Negative refundblocked
- Oversized refundblocked
- Refund > amount paidblocked
- Split refunds under the limitheld
- Anomalous refundheld
- Bulk profile scrapemasked
- Email it outblocked
- Forged admin tokenblocked
- Grant itself a scopeblocked
- Raw database accessblocked
- Unapproved deleteheld
- Tool-call loopblocked
- Slow cost bleedblocked
- Social-engineered PII dumpmasked
- Injection in a customer emailmasked
- Jailbreak: delete everythingheld
20
attacks contained
0
leaked
$16,964
in refunds shadow mode flagged before v2 shipped
0.15 ms
gateway time for a lookup
The live gateway console
Chat with the agent, approve a held refund with a note, run the red team, shadow-test a policy, tamper with the log and pull the kill switch.
