Which provider breaks your agent's tool calls? Daily data for every open model.

See the index
01For teams that run agents · alpha

Agents that keep your rules.

Your policy, written once, holds on every turn of every conversation. A tool the policy doesn't allow yet is taken away for that turn, arguments are narrowed to the values it allows, and the model is told why. A forbidden call isn't caught and retried: it can't be written. Every decision names the rule behind it.

Start a pilot S
02Will not, cannot

A prompt holds most of the time. .ctrl holds every time.

Today an agent's rules live in its system prompt, which the model follows most of the time, and in a checker that runs after the call is written, where the only remedy is to reject it and retry. .ctrl applies the policy before the model writes, so the only calls it can make are the ones your rules allow. Keep your execution-time checks as the last line.

Your policy, and what the model can do this turn

A Rubric policy over the tools your agent already has. At the start of a conversation, cancelling isn't possible yet, and the model is told what has to happen first.

Source Code Example

📁 support.rubric
state pending[order_id] =
    once within 1h get_order_details(order_id) returned status = "pending";

allow cancel_order when
    pending[order_id]   "List the order details and get an explicit yes before cancelling.",
    reason in reasons,
    confirmed           "List the order details and get an explicit yes before cancelling.";

Output

3 tools · 2 available · 1 masked

  ✓ get_order_details  unrestricted
  ✗ cancel_order       masked  [cancel_order]
      ↳ List the order details and get an explicit yes before cancelling.
      ↳ next: get_order_details
  ✓ refuel_data        amount_gb ≤ 2  [refuel_data]
A support agent's log with a forbidden refund call: agents will break your policy.

What it does on every turn

  • Takes away what isn't allowed yet

    cancel_order isn't on offer until the order has been looked up and the customer has said yes. The model is told what to do instead of guessing.

  • Narrows the arguments

    order_id is limited to the order that was looked up, reason to the accepted values, amount_gb to the cap.

  • Fixes a value

    When the policy allows only one value, it is written for the model.

  • Records every decision

    Each turn records the policy and the conversation it came from, by hash, and why each tool was offered, narrowed or taken away. Rerun the same inputs and you get the same result.

  • Bring the policy you have

    Rubric, .ctrl's policy language, or Dogwood, the policy language of AWS AgentCore, unchanged: the same file you enforce at execution time.

  • Replay and diff

    Check recorded conversations against a policy, or compare two policies over them, and see every call a change would block or allow before it ships.

  • Same answers as Dogwood

    For stock Dogwood policies, with one tool call per turn, a call is allowed exactly when Dogwood would allow it, tested against Dogwood's reference interpreter.

  • No silent approximation

    A rule .ctrl can't enforce exactly is an error that names it, never a looser rule.

  • 0 of 456 runs with a forbidden action

    tau2-bench retail, Qwen3.8-27B, 114 tasks × 4 trials, with task success unchanged.

  • One call per turn

    The guarantees hold when the agent makes one tool call per turn, as most production harnesses do.

  • Hosted frontier models

    The full guarantee needs an open-weight model you serve, or one served with .txt inside. On hosted frontier models, .ctrl checks each call before it runs and replays conversations, with those limits stated.

Replay your traces against one policy. 

A pilot starts with your policy and your tasks. We run them with and without .ctrl, replay your recorded conversations against the policy, and hand you the results and the record.