One platform, every layer of agent governance
From single-agent tool calls to cross-company agent networks, TrustRail applies the same doctrine: explicit, scoped, expiring, non-transitive authority.
Platform capabilities
Humans, workloads, and agents
OIDC with PKCE for humans, opaque peppered credentials for agents, versioned RBAC/ABAC with phishing-resistant MFA gates and step-up re-authentication for sensitive operations.
Deterministic policy engine
A bounded JSON policy DSL — no executable code — with deny precedence, three-valued logic for unknown facts, BigInt money math, content-addressed immutable versions, and signed publications requiring separation of duties.
Explainable risk scoring
Eight versioned, integer-only features with full per-feature explanations. Risk can tighten a policy decision but can never weaken it — a machine-learned score will never override a deterministic denial.
Digest-bound human approvals
Any-one, all, N-of-M, and sequential quorums. Approvers confirm the exact canonical digest with no preselected decision; races finalize exactly once; eligibility is re-checked at resolution.
Credential-holding gateway
A separate process with its own database role holds provider credentials, revalidates ~18 facts under lock before dispatch, checks kill switches twice, and classifies every outcome — including honest UNKNOWN with read-only reconciliation.
Narrowing-only delegation
Typed root authorizations and signed grants that can only shrink authority across ten dimensions, with closure-table ancestry, epoch-based revocation, and budget accounting that counts in-flight ambiguity as spent.
Protected MCP tool calls
Content-addressed tool schemas with strict argument validation, material-change re-review, delegated-authority binding, and credential brokering — the agent never sees the provider secret.
Governed agent-to-agent exchange
Verified agent cards, signed canonical message envelopes, replay guards, DLP that catches secrets fragmented across messages, artifact quarantine, and proposals that are structurally non-binding until separately authorized.
Direct, non-transitive trust
Cross-organization sessions require an explicit direct relationship; constraints are the strict intersection of both parties' signed policies. Trust in an intermediary confers nothing.
Residency, retention, legal hold
Regional policy bundles with signed activation and freshness deadlines, residency allowlists, retention schedules with crypto-erase, and legal holds that always win.
Verifiable audit chain
Hash-chained audit events committed transactionally with every privileged change, a transactional outbox streamed to Redis for downstream consumers, and one-call chain verification.
Kill switches with scope
Hierarchical switches from a single action type up to the whole platform, checked at reservation and again at dispatch, with epoch stamping and audited deactivation.
Who it's for
Platform teams shipping agents
Give product teams a paved road: agents declare canonical actions and get policy, approvals, execution, and audit without building any of it.
Security and compliance
Replace "the agent seemed safe" with reconstructable decisions, immutable evidence, measurable revocation, and reviews backed by executable rehearsals.
Finance and operations
Spend caps that intersect across delegation chains, approval quorums for high-value actions, and at-most-once execution against payment providers.