AI runtime security & agent governance

Stop unsafe AI agent actions before they hit production.

RailOps is a control plane that adds runtime guardrails, tool approvals, red-team CI, and audit evidence to your LLM, RAG, and agent apps. One gateway, one policy, every model call inspected.

guarded gateway POST /v1/gateway/chat
app app_support_demo  policy support_agent_v1
user prompt
 
block Refused at input. Category prompt_injection, severity high, 0 ms added.
input retrieval prompt assembly tool args output
Drop-in across your stack
OpenAI-compatible gateway OpenAI, Anthropic & self-hosted models Layered runtime + red-team engine SaaS or self-host / VPC

Your AI controls are scattered. The blast radius is not.

Input scanners here, output validators there, red-team in a notebook, tool approvals hand-rolled per app. The real risk is not a rude reply. It is an agent taking the wrong action with no one watching.

01
Wrong tool callAn agent cancels the order, refunds the account, sends the email. No approval, no owner.
02
RAG injectionA retrieved document carries instructions the model obeys as if they were yours.
03
Secrets in output and logsA key leaks into a response, then sits in plaintext logs forever.
04
Silent policy regressionsA release ships and quietly breaks a guardrail. You find out from a customer.
05
Compliance without evidenceAudit asks what your AI is allowed to do. You have prompts, not proof.

One gateway in front of every model call

RailOps sits between your app and the model. Every request and response runs the policy chain across input, retrieval, prompt, tool, and output stages.

Your app / agent SDK
|
RailOps guarded gateway
|
OpenAI, Anthropic, self-hosted

From endpoint to governed agent, same day.

Point your client at the gateway, write one policy, and watch the controls run live. No model retraining, no per-app plumbing.

CONNECT

Swap one base URL

Repoint your OpenAI-compatible client or drop in the SDK. RailOps proxies the call and starts inspecting traffic.

DEFINE

Write the policy once

Block prompt injection, redact PII, require approval for refund, cancel, and send-email. Policy as code, versioned.

SHIP

Gate every release

Red-team CI runs the policy against attack corpora on every deploy and fails the build before regressions reach production.

Runtime defense and red-team evidence, in one product.

A layered detection engine, governed by a single policy and a single audit trail.

Guardrail engine

Prompt injection, jailbreaks, PII, secrets, malicious content, and RAG poisoning, scored across every boundary stage. Deterministic fast path with model-backed scanners behind it.

5
boundary stages
0ms
added p50
fail-closed
default

AI gateway

OpenAI-compatible proxy for chat, responses, and streaming. Every call carries a trace id and a decision.

Tool approvals

High-risk tool calls pause for a human. Refund, cancel, send-email gated by condition, not by hope.

Policy studio

UI plus policy-as-code that compiles to runtime rails, SDK middleware, and scanner chains.

Red-team CI

Adversarial attack corpora run as a release gate, scored automatically.

Evidence room

Signed, exportable audit packs. Decisions, policy versions, and red-team runs, ready for review.

Agent registry

A live inventory of which agents reach which tools, with risk scoring on every one, so the blast radius is mapped before an attacker finds it.

SDKs & integrations

Guard your calls in a few lines — TypeScript or Python.

First-class SDKs for both runtimes. Check any boundary stage, route traffic through the guarded gateway, and gate high-risk tool calls behind human approval — same API, same policy.

@railops/sdk-ts  ·  TypeScript
// npm install @railops/sdk-ts
import { RailOpsClient, wrapTool } from "@railops/sdk-ts";

const railops = new RailOpsClient({
  baseUrl: process.env.RAILOPS_API_URL,
  apiKey: process.env.RAILOPS_API_KEY,
});

// Check any boundary stage
const v = await railops.check({ stage: "input", text });
if (v.action === "block") throw new Error(v.category);

// Gate a high-risk tool behind approval
const refund = wrapTool(refundOrder, { name: "refund_order" });
railops-sdk  ·  Python
# pip install railops-sdk
from railops_sdk import RailOpsClient, wrap_tool

railops = RailOpsClient(
    base_url=os.environ["RAILOPS_API_URL"],
    api_key=os.environ["RAILOPS_API_KEY"],
)

# Check any boundary stage
verdict = railops.check(stage="input", text=text)
if verdict.action == "block":
    raise ValueError(verdict.category)

# Gate a high-risk tool behind approval
refund = wrap_tool(refund_order, name="refund_order")
OpenAI-compatible gateway Agent-framework guardrails Input / output guardrails Sync & async clients Tool approval & resume Red-team CI gate Node 18+ · Python 3.11+
Policy as code

One file. Every surface.

Write the rule once. RailOps compiles it to runtime rails, SDK guardrails, and CI checks so the same policy protects production and gates the build.

support_agent_refund_v1.yaml
policy_id: support_agent_refund_v1
scope:
  app: customer-support
  agent: refund-agent
rules:
  input:
    - block: prompt_injection.high
    - redact: pii.basic
    - block: secrets.any
  retrieval:
    - block: indirect_prompt_injection.high
    - require_source_trust: internal_verified
  tools:
    cancel_order:
      approval: required
    refund_order:
      approval: required_if
      condition: amount > 50
  output:
    - redact: pii.basic
    - require_json_schema: support_response_v2

Portable, not locked in

Policies are yours and they travel. The same definition runs on SaaS or in your own VPC, and stays portable across your environments.

Runtime guardrail config SDK middleware (TS / Python) Agent-framework guardrails Scanner chain Red-team suite

Catch regressions in CI. Hand audit the receipts.

Red-team release gate

Every deploy runs the policy against known-bad corpora. High or critical findings fail the build.

Prompt injection corpusblocked 1/1
Indirect injection (RAG)blocked
Tool abuse / excessive agencyreview
Release gatepass

Signed evidence pack

Decisions, policy versions, and red-team runs, bundled and signed for compliance review.

Decisions captured12,480
Digestsha256
Signaturehmac-sha256
ExportJSON / CSV / PDF
Talk to us

Bring guardrails to your agents. Let's talk.

Tell us about your stack and the actions your agents can take. We'll show RailOps block a live attack, pause a risky tool call, and capture the evidence.

Company

RailOps is operated by Leone Intelligence Systems FZE LLC.

Protect a support agent with tools and RAG in under a day.

Connect an endpoint, write one policy, and watch RailOps block a live attack, pause a risky tool call, and capture the evidence.