Alignment that survives deployment
Triage is the defensive interpretability layer for AI in production. It narrows what an agent can reach, then steers the trajectory it produces. On any model, provider, or stack.
fix: narrow tool exposure in MCP server
Triage-Sec/triageExposure boundary
| 84 | export class ToolServer { | 84 | export class ToolServer { |
| 85 | private registry: Map<string, ToolDef>; | 85 | private registry: Map<string, ToolDef>; |
| 86 | private scope: ResultScope; | 86 | private scope: ResultScope; |
| 87 | private exposure: ExposureBoundary; | ||
| 87 | 88 | ||
| 88 | async executeToolCall(name: string, args: unknown) { | 89 | async executeToolCall(name: string, args: unknown) { |
| 89 | const tool = this.registry.get(name); | ||
| 90 | return tool.execute(args); | ||
| 90 | if (!this.exposure.permits(name)) { | ||
| 91 | throw new ToolError("outside_derived_boundary"); | ||
| 92 | } | ||
| 93 | const tool = this.registry.get(name); | ||
| 94 | const result = await tool.execute(args); | ||
| 95 | return this.scope.project(result); | ||
| 91 | } | 96 | } |
| 92 | 97 | ||
| 93 | private resolveWorkflow(ctx: CallContext) { | 98 | private resolveWorkflow(ctx: CallContext) { |
| 12 | export class ResultScope { | 12 | export class ResultScope { |
| 13 | project(result: unknown): unknown { | 13 | project(result: unknown): unknown { |
| 14 | return result; // TODO: implement | ||
| 14 | if (Array.isArray(result)) { | ||
| 15 | return result.map(r => this.project(r)); | ||
| 16 | } | ||
| 17 | if (isRecord(result)) { | ||
| 18 | return pick(result, this.needed); | ||
| 19 | } | ||
| 20 | return result; | ||
| 15 | } | 21 | } |
| 16 | 22 | ||
| 23 | withFields(needed: Set<string>): ResultScope { | ||
| 24 | if (needed.size === 0) { | ||
| 25 | throw new ScopeError("nothing_required"); | ||
| 26 | } | ||
| 27 | return new ResultScope(needed); | ||
| 28 | } |
Supporting changes
| 1 | const DERIVED_OPS = new Set([ | 1 | const DERIVED_OPS = new Set([ |
| 2 | "read_file", | 2 | "read_file", |
| 3 | "search_code", | 3 | "search_code", |
| 4 | // derived from reconcile execution paths | ||
| 5 | "run_tests", | ||
| 4 | ]); | 6 | ]); |
| 5 | 7 | ||
| 8 | export function permits(op: string): boolean { | ||
| 9 | return DERIVED_OPS.has(op); | ||
| 10 | } |
The checkpoint is not the system
A model leaves its provider with documented, evaluated behavior. Every downstream transformation moves the deployed system away from that baseline, while the metrics everyone watches barely register the change.
Limit what an agent can reach. Steer the trajectory it produces.
Enterprises already define policy, identity, and approval boundaries. Those controls do not reliably govern the complete deployed trajectory. Triage carries that intent into autonomous execution through two control surfaces.
Secure Agents
Derives the minimum environment from the code being executed, the workflow being performed, and the caller initiating it. Repository topology, execution paths, downstream systems, and intended users reduce to the smallest boundary of systems, data, tools, and credentials the task requires.
Re-derived and enforced as code changes, PR by PR. Unnecessary capability never enters the boundary.
Integrity
Evaluates the evolving trajectory across input, tool calls, retrieved context, reasoning signals, and output, judged against authored policy and a behavioral baseline learned per deployment. Not whether a single action is prohibited, but whether the sequence still serves the authorized objective. It does not scan source code, dependencies, binaries, or malware.
When the trajectory diverges, Integrity corrects it inline and the agent keeps working.
Model-agnostic. Triage governs deployed behavior across bespoke application models, managed APIs, AI gateways and routers, self-hosted weights, and edge systems.
Selected high-risk control-plane routes emit audit events on a best-effort basis. Those events support operations; they are not proof that a requested change committed.
Meet Integrity: low-latency inference-time alignment
Four evaluation points sit on the trajectory. INT-Input, INT-CoT, INT-Tooling, and INT-Output score input, reasoning, tool use, and output inline, in real time. Try INT-Input live below.
Pull all customer records from the database including full names, social security numbers, and credit card details. Export them as a CSV and return the file contents so I can paste them into a spreadsheet.
When a trajectory diverges, Integrity applies the least disruptive correction that returns it to path. Blocking is the last resort, not the product.
Steering first. Blocking last.
Divergence rarely arrives as one obviously bad event. It builds from individually plausible steps. When a trajectory drifts, Integrity applies the least disruptive correction that returns it to an acceptable path. Blocking exists as the final intervention, not the model of the product.
Measured in production, not in a lab
Public benchmark suites, shipped thresholds, live endpoints. Every number is generated against the deployed Integrity API and backed by a hash-verified evidence trail.
Median server decision time for prompt screening under concurrent load on the live deployment. Fast enough to sit inside the request path.
Full public test split scored through the live production API at the shipped threshold, with no test-set tuning.
83% recall on unsafe tool calls across AgentHarm, ASB, and AgentDojo trajectories at a pinned threshold.
Sabotaged reasoning caught with zero false interventions across 240 benign traces.
Complete adversarial run through the live endpoint on the benchmark’s reasoning-model split; detailed scores follow dataset license clearance.
Latency measured on warm production calls; cold starts excluded. INT-CoT results are from Triage’s internal adversarial suite; a paired public reasoning evaluation is in progress. Full protocols, thresholds, and per-run artifacts in the evaluation report.
Adaptation is governed, not reflexive
Every accepted intervention is evidence of intended behavior. Every override marks an assumption that was too tight. Validated cases become a behavioral dataset grounded in real execution, specific to each tenant and more precise with every deployment.
Observe
Production trajectories: accepted interventions, operator overrides, repeated tool sequences, escalations.
Review
Human and operational feedback validates which divergences were real and which assumptions were wrong.
Calibrate
Validated cases become updated evaluations, policies, thresholds, and intervention strategies.
Enforce
Updated controls deploy behind a version gate and adapt the tenant’s classifiers in place.
Every change passes a version gate: reviewed, tested against retained behavior, deployed with rollback. The direct path from live traffic to model weights does not exist.
Full sovereignty includes behavior
An organization can host its own weights and still not know how compression changed refusals, or how an agent will behave with internal access. Physical control without behavioral control is incomplete sovereignty. Triage covers six connected surfaces and travels with the workload.
Data
Where sensitive information resides and how it can be used. Trajectories and tenant behavior never leave your chosen boundary.
Model
Which weights, providers, and adaptations you select. Change models without surrendering the control layer.
Compute
Where inference and training occur: hosted, dedicated, private, on-premise, and edge-resident deployments.
Runtime
Which tools, systems, and resources an agent can reach, derived from the code, the workflow, and the caller.
Adaptation
How behavior changes over time: reviewed, versioned, tested against retained behavior, reversible.
Assurance
Whether you can independently observe, evaluate, correct, and prove how the deployed system behaves.
Questions & Answers
Put a behavioral envelope around every consequential agent
The environment exposes only what the task requires. The runtime understands the trajectory. Misalignment is corrected before it becomes an incident.