Railproof
If the action is not explicitly allowed, it does not execute.
A tool call can be perfectly valid JSON and still be wrong: data sent to the wrong host, retrieved content used as an email recipient, a budget exceeded, an approval reused after the action changed. Railproof puts a deterministic contract in front of every tool call.
- Deny-by-default YAML policy over tool, full arguments, user, tenant, roles, data labels, provenance and session budgets. The model has no authority to override it.
- One-time approval tokens bound to the exact action: change the recipient or amount and the old approval stops working.
- 110 passing tests, 44 µs median decision time, adapters for OpenAI function calls and MCP tools/call.
Know the limit
An enforcement runtime, not a full platform, and still alpha. Its 10/10 versus 5/10 result is a narrow comparison against one NeMo Guardrails validator, not a claim to replace NeMo.
$ python -m pip install railproof
$ railproof validate policy.yaml
$ railproof check policy.yaml event.json