A boundary designed for compromised agents

TrustRail separates decision, approval, credential custody, execution, reconciliation, egress, and analysis so no single agent-facing process can silently turn a request into an unbounded real-world effect.

The governed control flow

CanonicalizeValidate a typed action and bind its RFC 8785 digest.

DecideEvaluate deterministic policy, risk, intent, influence, and live runtime facts.

ApproveBind human votes and separation-of-duty rules to the exact subject.

AuthorizeIssue a short-lived Ed25519 token with a one-use identifier.

ExecuteThe gateway revalidates current state and spends a gateway-held credential.

ReconcileUNKNOWN is durable state, never guessed success or failure.

Process boundaries

A component receives only the authority its job requires.

Plane	May hold	Must not hold
Control API	Identity, policy, risk, approvals, encrypted integration envelopes	Plaintext provider credentials
Execution gateway	One credential for one authorized dispatch	Policy-authoring or human-session authority
Egress broker	Signed policy bundles and workload mTLS identity	Payload plaintext or provider credentials
Reconciliation worker	Narrow claimed jobs and bounded leases	Unclaimed tenant state
Forensic plane	Verified evidence and local case artifacts	Provider credentials or control-plane writes

Threat assumptions

The model, prompt, retrieved context, tool output, and agent process may be hostile.

Every caller-supplied tenant, role, time, risk, digest, workload, and containment fact is untrusted.

DNS, redirects, provider responses, webhooks, and ambiguous timeouts may be adversarial.

The agent runtime may be compromised; TrustRail does not claim to prevent sandbox escape.

Customer infrastructure implements runtime isolation and the sole-egress route; readiness probes verify rather than assume it.