TrustRail sits between your AI agents and the real world. It checks every consequential action against your rules, asks a human when it matters, and keeps your credentials out of the agent’s hands — with a tamper-evident record of everything.
AI agents are genuinely useful right up until one buys the wrong thing, emails the wrong person, or deletes something that mattered. TrustRail exists for that moment.
01 Canonical action
Every action starts as a request.
The agent submits a typed, normalized action. TrustRail computes a canonical SHA-256 digest that every later stage binds to.
actionpayments.purchase.create
02 Deterministic decision
A rule decides. Not a model.
A bounded, non-Turing-complete policy engine plus integer-only risk scoring decide allow, deny, or require-approval — bit-identically reproducible.
decisionREQUIRE_APPROVAL · spend over $50
03 Human approval
Risky? A human signs the exact thing.
Approvers confirm the exact subject digest with phishing-resistant MFA. Quorums, separation of duties, and race-safe single finalization built in.
approved byfinance@acme · passkey
04 Signed authorization
One key. Five minutes. One use.
A five-minute Ed25519 token with a closed claim set and a one-use identifier is the only thing that unlocks execution.
tokenEdDSA · exp 300s · jti 7f1c…
05 Enforced execution
The agent never touches the credential.
A separate gateway process holds the provider credential, revalidates every fact, and treats ambiguous outcomes as first-class state to reconcile — never to retry blindly.
executedstripe · at most once
06 Evidence
Every step leaves a receipt.
Every privileged transition appends to a per-tenant SHA-256 hash chain in the same transaction. The whole chain is re-verifiable through the API on demand.
Deny by defaultUnknown authority is refused, not guessed
Ed25519Five-minute, one-use execution tokens
SHA-256 chainPer-tenant, re-verifiable evidence
Row-level securityTenant isolation held by Postgres
01
Agents act faster than you can watch
An agent can send a hundred emails or place an order in the time it takes to glance at a screen. Hoping it behaves is not a plan.
02
One place to say yes, no, or ask me
You set simple rules once. TrustRail applies them to every action, every time — and anything risky waits for a tap from you before it happens.
03
Proof of everything, after the fact
Every decision is recorded in a log that cannot be quietly edited. When someone asks “what did the agent actually do?”, you have the receipt.
07 Bring your agents over. Keep the guarantees.
Moving an agent in takes one pass
The desktop app scans this machine the way Migration Assistant scans an old Mac: it finds your MCP servers, agent configs and provider keys, shows you exactly what it found, and imports only what you tick. No Docker, command line, or local stack is required.
Credential values never leave the app; you enter the key in the console, where it is tested against the real provider and handed straight to the gateway.
Every connection is tested with a real read-only call to the provider over the same pinned-origin transport the gateway uses. You get back one of three words — valid, invalid, unavailable — and never the provider’s response.
Connect stays locked until the current credential, origin, provider and environment have all produced a valid result. Change any one of them and the proof is void.
Connect a provider
StripeGET /v1/accountvalid
Originpinned to api.stripe.comenforced
Credentialstored in the gateway onlynever returned
Containment is a button, not a paragraph
Acknowledge, contain, revoke credentials, inspect the evidence, and recover — each one an executable control in the console, each one gated by the permission it actually needs and each one appended to the tamper-evident chain.
A freeze does not burn credentials, because the next rung has to have somewhere to escalate to.
Incident — release-bot
Acknowledgeoperator@example.comdone
Containtier C4done
Revoke credentialsunusable during recoverydone
Inspect evidence41 ledger entriesnext
08 Built for the failure cases
Most agent frameworks optimize the happy path. TrustRail is engineered around what goes wrong.
INV-01
A denied action cannot execute
The gateway consumes a signed, digest-bound, one-use token before any provider call. No token, no execution — enforced in a separate process with its own least-privilege database role.
INV-02
Mutation invalidates authorization
Approvals bind to the canonical digest of the exact request. Change one byte of the payload and every downstream authorization fails closed.
INV-03
Delegation only narrows
Agent-to-subagent handoffs are signed grants checked on ten axes — capabilities, resources, spend, depth, time — in both the application and the database. Revoking an ancestor kills the whole subtree.
INV-04
Ambiguity is never a retry
A provider timeout is recorded as UNKNOWN and reconciled by a stable idempotency key. The guarantee is at most one logical operation — stated honestly, engineered thoroughly.
INV-05
Tenants are isolated in the database
Forced PostgreSQL row-level security with composite tenant keys means isolation holds even if application code has a bug. Cross-tenant probes return 404, never a hint.
INV-06
Evidence is tamper-evident
Every privileged transition appends to a per-tenant SHA-256 hash chain in the same transaction. The whole chain is re-verifiable through the API on demand.
09 Honest enforcement modes
What each mode guarantees — and what it does not.
Only Enforce mode prevents external action; the others are for visibility and rollout.
Mode
Behavior
Security claim
Observe
Receives telemetry alongside or after actions
Visibility only — no prevention claim
Shadow
Evaluates before the action; the client still executes independently
Policy impact measurement — no enforcement claim
Decision
Returns allow/deny/approval, but a client could bypass it
Advisory authorization
Enforce
The gateway holds the provider credential and the execution path
Protected against ordinary client bypass within the deployment boundary
10 Two integration modes, two different promises
Decision mode
guard() — one wrapper, no migration
Your tool keeps its signature and its implementation. TrustRail decides whether it runs, and a denial reaches the model as a tool result that tells it not to route around the refusal.
Gates your code; does not hold your credentials. A compromised agent process could bypass it. Not enforcement.
Enforce mode
act() — the agent never holds the credential
A separate gateway process holds the provider credential, revalidates every fact, and spends a one-use Ed25519 authorization. The agent cannot perform the action on its own.
Requires a reviewed provider adapter, so it covers the action types the registry marks EXECUTABLE.
// Enforce mode: evaluate, wait for a human if required, execute
const result = await agent.act({
purpose: "Reorder the stock the planner flagged",
actionType: "payments.purchase.create",
resource: { type: "payment", id: "order-4821" },
parameters: restockOrder,
financial: { amountMinor: "4999", currency: "USD" },
waitForApprovalSeconds: 120,
});
// -> result.status: "EXECUTED" | "DENIED" | "AWAITING_APPROVAL"